Systems and methods for classification of messaging entities

• US 8,549,611 B2
• Filed: 07/19/2011
• Issued: 10/01/2013
• Est. Priority Date: 03/08/2002
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Judge, Paul, Alperovitch, Dmitri, Moyer, Matt, Krasser, Sven
• Primary Examiner(s): Abrishamkar, Kaveh
• Application Number:
  US13/185,653
• Publication Number:
  US 20120271890A1
• Time in Patent Office: 805 Days
• Field of Search: None
• US Class Current: 726/13
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Methods and systems for operation upon one or more data processors for assigning a reputation to a messaging entity. A method can include receiving data that identifies one or more characteristics related to a messaging entity'"'"'s communication. A reputation score is determined based upon the received identification data. The determined reputation score is indicative of reputation of the messaging entity. The determined reputation score is used in deciding what action is to be taken with respect to a communication associated with the messaging entity.

Claims

1. A method for operation upon one or more data processors to assign a reputation to a messaging entity, comprising:

receiving data that identifies one or more characteristics related to a messaging entity'"'"'s communication;

for each criterion in a set of criteria for use in discriminating between reputable and non-reputable classifications;

determining, by one or more data processors, whether the criterion applies to the messaging entity;

determining, by the one or more data processors, a first conditional probability that the messaging entity is a non-reputable messaging entity in response to determining that the criterion applies to the messaging entity; and

determining, by the one or more data processors, a second conditional probability that the messaging entity is a reputable messaging entity in response to determining that the criterion applies to the messaging entity;

determining, by the one or more data processors, a first probability that is indicative of the messaging entity being a non-reputable messaging entity, the first probably being determined from a product of the first conditional probabilities;

determining, by the one or more data processors, a second probability that is indicative of the messaging entity being a reputable messaging entity, the second probably being determined from a product of the second conditional probabilities;

determining, by the one or more data processors, a reputation score from the first and second probabilities, wherein the determined reputation score is indicative of reputation of the messaging entity; and

wherein the determined reputation score is used in deciding what action is to be taken with respect to a communication associated with the messaging entity.

2. The method of claim 1, wherein the determined reputation score is distributed to one or more computer systems for use in filtering transmissions.

3. The method of claim 1, wherein the determined reputation score is locally distributed to a program for use in filtering transmissions.

4. The method of claim 1, wherein reputation scores include numeric, textual or categorical reputations that are assigned to messaging entities based on characteristics of the messaging entities and their behavior;

wherein the numeric reputations fluctuate between a continuous spectrum of reputable and non-reputable classifications.

5. The method of claim 1, wherein a type of messaging entity to which reputations are assigned is a domain name, IP address, phone number, or individual electronic address or username representing an organization, computer, or individual user that transmits electronic messages.

6. The method of claim 1, wherein the reputation of each messaging entity is encoded within the form of a 32-bit, dotted decimal IP address;

said method further comprising;

creating a domain name server (DNS) zone comprising the reputations of all messaging entities in a universe of messaging entities; and

distributing reputations of messaging entities, via the DNS protocol, to one or more computer systems that make use of the reputations for their work.

7. The method of claim 1, wherein the set of criteria are metrics selected from the group:

a mean Spam Profiler score;

a reverse domain name server lookup failure;

membership on one or more real-time blacklists (RBLs);

mail volume;

mail burstiness;

mail breadth;

a geographic location;

malware activity;

a type of address;

a classless inter-domain routing (CIDR) block comprising a number of internet protocol addresses identified to send spam;

rate of user complaints;

rate of honeypot detections;

rate of undeliverable transmissions, identified conformance with laws, regulations, and well-established standards of transmission behavior;

continuity of operation;

responsiveness to recipient demands; and

combinations thereof.

8. The method of claim 1, further comprising encoding the messaging entity reputation within a 32-bit dotted decimal IP address according to a function comprising:

9. The method of claim 1, wherein classifications of reputable and non-reputable are related to a tendency for an IP address to send unwanted transmissions or legitimate communication.

10. A method of performing transmission filtering utilizing reputation scores of transmission senders, the method comprising:

identifying at least one characteristic about a transmission from a sender;

performing a real-time query to a reputation system that includes the transmission characteristic;

receiving a score representing reputation related to the sender of the transmission;

performing an action on the transmission from the sender corresponding to the score range of the sender'"'"'s reputation;

wherein the reputation score of the sender is encoded within the form of a 32-bit, dotted decimal IP address;

wherein the reputation system comprises a domain name server (DNS) zone comprising the reputations of all messaging entities in a universe of messaging entities; and

wherein the DNS zone distributes reputations of messaging entities, via the DNS protocol, to querying computer systems for filtering messages.

11. The method of claim 10, wherein the action includes at least one of the following actions:

rejecting all further transmissions from that sender for a preset period of time or number of transmissions;

silently dropping all further transmissions from that sender for a preset period of time or number of transmissions;

quarantining all further transmissions from that sender for a preset period of time or number of transmissions;

bypassing certain filtering tests for all further transmissions from that sender for a preset period of time or number of transmissions.

12. The method of claim 10, wherein the step of identifying at least one characteristic includes extracting unique identifying information about the transmission, or authenticating unique identifying information about the transmission, or combinations thereof.

13. The method of claim 12, wherein the unique identifying information includes information about the sender of the transmission.

14. An article of manufacture comprising a physical computer readable storage device having instructions encoded thereon, the instructions operable to cause one or more data processing devices to perform operations comprising:

receiving data that identifies one or more characteristics related to a messaging entity'"'"'s communication;

for each criterion in a set of criteria for use in discriminating between reputable and non-reputable classifications;

determining whether the criterion applies to the messaging entity;

determining a first conditional probability that the messaging entity is a non-reputable messaging entity in response to determining that the criterion applies to the messaging entity; and

determining a second conditional probability that the messaging entity is a reputable messaging entity in response to determining that the criterion applies to the messaging entity;

determining a first probability that is indicative of the messaging entity being a non-reputable messaging entity, the first probably being determined from a product of the first conditional probabilities;

determining a second probability that is indicative of the messaging entity being a reputable messaging entity, the second probably being determined from a product of the second conditional probabilities; and

determining a reputation score from the first and second probabilities, wherein the determined reputation score is indicative of reputation of the messaging entity; and

wherein the determined reputation score is used in deciding what action is to be taken with respect to a communication associated with the messaging entity.

15. A system comprising:

a data processing apparatus; and

software stored on a computer storage apparatus and comprising instructions executable by the data processing apparatus and upon such execution cause the data processing apparatus to perform operations comprising;

receiving data that identifies one or more characteristics related to a messaging entity'"'"'s communication;

for each criterion in a set of criteria for use in discriminating between reputable and non-reputable classifications;

determining, by one or more data processors, whether the criterion applies to the messaging entity;

determining, by the one or more data processors, a first conditional probability that the messaging entity is a non-reputable messaging entity in response to determining that the criterion applies to the messaging entity; and

determining, by the one or more data processors, a second conditional probability that the messaging entity is a reputable messaging entity in response to determining that the criterion applies to the messaging entity;

determining, by the one or more data processors, a first probability that is indicative of the messaging entity being a non-reputable messaging entity, the first probably being determined from a product of the first conditional probabilities;

determining, by the one or more data processors, a second probability that is indicative of the messaging entity being a reputable messaging entity, the second probably being determined from a product of the second conditional probabilities;

determining, by the one or more data processors, a reputation score from the first and second probabilities, wherein the determined reputation score is indicative of reputation of the messaging entity; and

wherein the determined reputation score is used in deciding what action is to be taken with respect to a communication associated with the messaging entity.

16. The system of claim 15, wherein classifications of reputable and non-reputable are related to a tendency for an IP address to send unwanted transmissions or legitimate communication.

17. The system of claim 15, wherein a type of messaging entity to which reputations are assigned is a domain name, IP address, phone number, or individual electronic address or username representing an organization, computer, or individual user that transmits electronic messages.

18. The system of claim 15, wherein reputation scores include numeric, textual or categorical reputations that are assigned to messaging entities based on characteristics of the messaging entities and their behavior;

wherein the numeric reputations fluctuate between a continuous spectrum of reputable and non-reputable classifications.

19. The system of claim 15, wherein the determined reputation score is distributed to one or more computer systems for use in filtering transmissions.

20. The system of claim 15, wherein the determined reputation score is locally distributed to a program for use in filtering transmissions.

21. An article of manufacture comprising a physical computer readable storage device having instructions encoded thereon, the instructions operable to cause one or more data processing devices to perform operations comprising:

identifying at least one characteristic about a transmission from a sender;

performing a real-time query to a reputation system that includes the transmission characteristic;

receiving a score representing reputation related to the sender of the transmission;

performing an action on the transmission from the sender corresponding to the score range of the sender'"'"'s reputation;

wherein the reputation score of the sender is encoded within the form of a 32-bit, dotted decimal IP address;

wherein the reputation system comprises a domain name server (DNS) zone comprising the reputations of all messaging entities in a universe of messaging entities; and

wherein the DNS zone distributes reputations of messaging entities, via the DNS protocol, to querying computer systems for filtering messages.