Classifying a message based on fraud indicators

• US 8,661,545 B2
• Filed: 05/03/2012
• Issued: 02/25/2014
• Est. Priority Date: 09/08/2003
• Status: Expired due to Term

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan, Eikenberry, Scott D., Budman, Gleb, Kim, Brian
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US13/463,768
• Publication Number:
  US 20120222111A1
• Time in Patent Office: 663 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Systems, methods, and media for classifying messages are disclosed. A plurality of fraud indicators are identified in the message. A signature of the message is generated. The generated signature of the message is compared to a stored signature. The stored signature is based on a statistical analysis of fraud indicators in a second message associated with the stored signature. A determination as to whether the message is fraudulent is made based on the comparison. The message is processed based on the determination that the message is a fraudulent message.

Claims

1. A method for identifying fraudulent messages, the method comprising:

storing information in memory regarding a plurality of fraud indicators, each fraud indicator being a pattern previously identified as characteristic of fraudulent messages;

receiving a message sent over a communication network; and

executing instructions stored in memory, wherein execution of the instructions by a processor;

parses the message and detects at least one pattern that is characteristic of fraudulent messages;

matches the at least one pattern with at least one of the fraud indicators stored in memory;

counts a number of fraud indicators identified in the message;

computes a probability of the message being a fraudulent message based on the number of fraud indicators identified in the message;

classifies the received message as a fraudulent message, and

generates an alert that the received message has been classified as a fraudulent message.

2. The method of claim 1, wherein generating the alert comprises adding a fraud notification to a subject line of the received message.

3. The method of claim 1, wherein generating the alert comprises sending a fraud notification message to a designated recipient of the received message.

4. The method of claim 1, wherein generating the alert comprises providing an explanation why the received message is classified as a fraudulent message.

5. The method of claim 4, wherein the explanation includes information regarding the fraud indicators detected in the received message.

6. The method of claim 1, wherein the detected fraud indicators include a questionable or bad reference point.

7. A system for identifying fraudulent messages, the system comprising:

memory for storing information regarding a plurality of fraud indicators, each fraud indicator being a pattern previously identified as characteristic of fraudulent messages;

communications interface for receiving a message sent over a communication network; and

a processor for executing instructions stored in memory, wherein execution of the instructions by the processor;

parses the message and detects at least one pattern that is characteristic of fraudulent messages;

matches the at least one pattern with at least one of the fraud indicators stored in memory;

counts a number of fraud indicators identified in the message;

computes a probability of the message being a fraudulent message based on the number of fraud indicators identified in the message;

classifies the received message as a fraudulent message, and

generates an alert that the received message has been classified as a fraudulent message.

8. The system of claim 7, wherein the generated alert comprises a fraud notification to a subject line of the received message.

9. The system of claim 7, wherein the generated alert comprises a fraud notification message sent to a designated recipient of the received message.

10. The system of claim 7, wherein the generated alert includes an explanation why the received message is classified as a fraudulent message.

11. The system of claim 10, wherein the explanation includes information regarding the fraud indicators detected in the received message.

12. The system of claim 7, wherein the detected fraud indicators include a questionable or bad reference point.

13. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for identifying fraudulent messages, the method comprising:

storing information in memory regarding a plurality of fraudulent indicators, each fraudulent indicator being a pattern previously identified as characteristic of fraudulent messages;

receiving a message sent over a communication network;

parsing the message and detecting at least one pattern that is characteristic of fraudulent messages;

matching the at least one pattern with at least one of the fraud indicators stored in memory;

counting a number of fraud indicators identified in the message;

computing a probability of the message being a fraudulent message based on the number of fraud indicators identified in the message;

classifying the received message as a fraudulent message, and

generating an alert that the received message has been classified as a fraudulent message.

14. The non-transitory computer-readable storage medium of claim 13, further comprising executable instructions for adding a fraud notification to a subject line of the received message.

15. The non-transitory computer-readable storage medium of claim 13, further comprising executable instructions for sending a fraud notification message to a designated recipient of the received message.

16. The non-transitory computer-readable storage medium of claim 13, further comprising executable instructions for providing an explanation why the received message is classified as a fraudulent message.

17. The non-transitory computer-readable storage medium of claim 16, wherein the explanation includes information regarding the fraud indicators detected in the received message.