Classifying a message based on fraud indicators

• US 8,984,289 B2
• Filed: 02/07/2014
• Issued: 03/17/2015
• Est. Priority Date: 09/08/2003
• Status: Expired due to Term

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan, Eikenberry, Scott D., Budman, Gleb, Kim, Brian
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US14/175,599
• Publication Number:
  US 20140157409A1
• Time in Patent Office: 403 Days
• Field of Search: None
• US Class Current: 713/176
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Systems, methods, and media for classifying messages are disclosed. A plurality of fraud indicators are identified in the message. A signature of the message is generated. The generated signature of the message is compared to a stored signature. The stored signature is based on a statistical analysis of fraud indicators in a second message associated with the stored signature. A determination as to whether the message is fraudulent is made based on the comparison. The message is processed based on the determination that the message is a fraudulent message.

Claims

1. A system for classifying a message, comprising:

a memory;

a communications interface, wherein the communications interface receives the message over a communications network; and

a processor, wherein the processor executes instructions stored in memory to;

maintain a database for storing a plurality of signatures,

identify a plurality of fraud indicators in the message,

generate a signature for the message,

compare the generated signature to a signature stored in the database, the stored signature based on a statistical analysis of fraud indicators in a second message associated with the stored signature,

determine that the message is fraudulent based on the comparison; and

process the message based on the determination that the message is a fraudulent message.

2. The system of claim 1, wherein the processor executes instructions stored in memory to determine whether the message is fraudulent by identifying a match between the stored signature and the generated signature.

3. The system of claim 1, wherein the processor executes instructions stored in memory to identify divergent reference points in the plurality of fraud indicators by identifying at least one good reference point in the message and at least one questionable reference point in the message.

4. The system of claim 1, wherein the processor executes instructions stored in memory to identify a plurality of fraud indicators in the message by searching a second database, and wherein the processor stores information concerning legitimate reference points.

5. The system of claim 3, wherein the processor executes instructions stored in memory to extract the fraud indicators from the message, and stores the fraud indicators in association with a message classification.

6. The system of claim 3, wherein the processor executes instructions stored in memory to extract the fraud indicators from the message, and stores the fraud indicators in association with the stored signature.

7. The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying at least one reference point for contacting an illegitimate source.

8. The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying a raw Internet Protocol (IP) address.

9. The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying a link with an embedded user name.

10. The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying a form in the message.

11. The system of claim 10, wherein the form includes a request for personal information from the user.

12. The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying non-standard encoding in the message.

13. The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying a link including a reference to an entity but not linking to the entity.

14. The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying a mismatched link name, the mismatched link name displaying a uniform resource locator (URL) but linking to a different URL.

15. The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying content known to be associated with fraudulent messages.

16. The system of claim 1, wherein the database is shared among a plurality of users in a network.

17. The system of claim 1, wherein the processor executes instructions stored in memory to generate the signature of the message by applying a hash function to the content of the message.

18. A system for classifying a message, comprising:

a memory;

a communications interface, wherein the communications interface receives the message over a communications network;

a processor, wherein the processor executes instructions stored in memory to;

extract a plurality of reference points from a body of the message, each reference point being information used to contact a referenced entity;

classify each of the plurality of reference points based on a source associated with each reference point;

determine whether the message is a fraudulent message appearing to be from a legitimate source based on the classified reference points; and

process the message based on the determination of whether the message is a fraudulent message appearing to be from a legitimate source.

19. The system of claim 18, wherein the processor executes instructions stored in memory to classify the plurality of reference points by looking up the plurality of reference points in a database.

20. The system of claim 18, wherein the processor executes instructions stored in memory to:

detect that the message is a fraudulent message appearing to be from a legitimate source by determining that the message includes divergent reference points,

detect that the message is a fraudulent message appearing to be from a legitimate source by determining that the plurality of reference points includes a first reference point to a first source and a second reference point to a second source,

detect that the message is a fraudulent message appearing to be from a legitimate source by determining that the plurality of reference points includes a first reference point to a legitimate source and a second reference point to a questionable source,

detect that the message is a fraudulent message appearing to be from a legitimate source by determining that the plurality of reference points includes a first reference point to a first source and a second reference point to a second source, and the second reference point is intended to appear as a reference to the first source,

compute a thumbprint of the message and stores the thumbprint to a database,

compute a thumbprint of the message and storing the thumbprint to a shared database,

identify a plurality of fraud indicators and applies a statistical analysis on the plurality of fraud indicators,

quarantine the message,

delete the message,

provide an alert to a recipient of the message,

provide an alert to a recipient of the message indicating that the message is a fraudulent message appearing to be from a legitimate source, or

provide an explanation of the fraudulent message appearing to be from a legitimate source to a recipient.