Message classification using legitimate contact points

• US 8,463,861 B2
• Filed: 01/30/2012
• Issued: 06/11/2013
• Est. Priority Date: 02/20/2003
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan J., Koblas, David A., Wilson, Brian K.
• Primary Examiner(s): Duong, Oanh
• Application Number:
  US13/361,659
• Publication Number:
  US 20120131119A1
• Time in Patent Office: 498 Days
• Field of Search: 709203-207, 709217-219, 709/229, 709/246, 709223-225, 726/4, 726/23
• US Class Current: 709/206
• CPC Class Codes: G06F 16/24558 Binary matching operations
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying all items of a certain type in the message, determining whether each of the items meets a criterion, and in the event that all the items are determined to meet the criterion, determining a classification of the message. The system includes an interface configured to receive the message, a processor coupled to the interface, configured to identify all items of a certain type in the message; determine whether each of the items meets a criterion; and in the event that all the items are determined to meet the criterion, determine a classification of the message.

Claims

1. A method for classifying a message, the method comprising:

storing information in a database in memory, the stored information regarding one or more previously generated signatures of previously received messages;

receiving a message, the message including a distinguishing property; and

executing instructions stored in a memory, wherein execution of the instructions by a processor;

parses the message body to determine that the distinguishing property includes a contact point that is used to classify the message,

reduces the contact point to an identifier that represents the contact point regardless of individual format of the contact point;

generates a signature based on the identifier;

compares the generated signature to the one or more previously generated signatures stored in the database; and

updates a probability associated with the generated signature based on the comparison, wherein the generated signature is classified or reclassified based on the updated probability meeting a threshold.

2. The method of claim 1, wherein the execution of instructions by the processor further classifies the message as acceptable based on the generated signature matching one of the previously generated signatures stored in the database, the matching previously generated signature having been classified as acceptable.

3. The method of claim 2, wherein the execution of instructions by the processor further updates the database through a registration process.

4. The method of claim 3, wherein the registration process includes:

receiving a registration message;

checking a certificate associated with the message, the certificate confirming that the registration message is from an acceptable source;

extracting an item from the message; and

adding an entry derived from the item to the database of acceptable items.

5. The method of claim 1, wherein the execution of instructions by the processor further:

parses the message to identify an additional contact point when the generated signature has not been previously stored in the database,

reduces the contact point to an identifier that represents the additional contact point regardless of individual format of each of the additional contact point,

generates a signature based on the identifier, and

compares the generated signature of the identifier to one or more previously generated signatures stored in a database of acceptable signatures.

6. The method of claim 1, wherein the contact point includes a universal resource locator (URL).

7. The method of claim 1, wherein the contact point includes a phone number.

8. The method of claim 1, wherein the contact point includes an address.

9. The method of claim 1, wherein generating the signature includes performing a function on characters associated with the contact point, the function selected from a group consisting of a hash function, checksum, compression, and expansion.

10. A system for classifying a message comprising:

a memory for storing information in a database, the stored information regarding one or more previously generated signatures of previously received messages;

an interface coupled to a mail server for receiving a message, the message including a distinguishing property; and

a processor at the mail server for executing instructions stored in memory, wherein execution of the instructions by the processor;

parses the message to determine that the distinguishing property includes a contact point that is used to classify the message;

reduces the contact point to an identifier that represents the contact point regardless of individual format of the contact point;

generates a signature based on the identifier;

compares the generated signature to the one or more previously generated signatures stored in the database; and

updates a probability associated with the generated signature based on the comparison, wherein the generated signature is classified or reclassified based on the updated probability meeting a threshold.

11. The system of claim 10, wherein the processor further classifies the message as acceptable based on the generated signature matching one of the previously generated signatures stored in the database, the matching previously generated signature having been classified as acceptable.

12. The system of claim 10, wherein the processor further updates the database through a registration process.

13. The system of claim 12, wherein the processor performs the registration process, wherein the registration process comprises:

receiving a registration message;

checking a certificate associated with the message, the certificate confirming that the registration message is from an acceptable source;

extracting an item from the message; and

adding an entry derived from the item to the database of acceptable items.

14. The system of claim 10, wherein the processor further executes instructions to:

parse the message to identify an additional contact point when the generated signature has not been previously stored in the database,

reduce the contact point to an identifier that represents the additional contact point regardless of individual format of each of the additional contact point,

generate a signature based on the identifier, and

compare the generated signature of the identifier to one or more previously generated signatures stored in a database of acceptable signatures.

15. The system of claim 10, wherein the contact point includes a universal resource locator (URL).

16. The system of claim 10, wherein the contact point includes a phone number.

17. The system of claim 10, wherein the contact point includes an address.

18. The system of claim 10, wherein the processor generates the signature by performing a function on characters associated with the contact point, the function selected from a group consisting of a hash function, checksum, compression, and expansion.

19. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for classifying a message, the method comprising:

storing information regarding one or more previously generated signatures of previously received messages;

receiving a message, the message including a distinguishing property;

parsing the message to determine that the distinguishing property includes a contact point that is used to classify the message;

reducing the contact point to an identifier that represents the contact point regardless of individual format of the contact point;

generating a signature based on the identifier;

comparing the generated signature to the one or more previously generated signatures; and

updating a probability associated with the generated signature based on the comparison, wherein the generated signature is classified or reclassified based on the updated probability meeting a threshold.