Messaging security device

• US 9,077,739 B2
• Filed: 07/03/2013
• Issued: 07/07/2015
• Est. Priority Date: 11/28/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Pirzada, Shamim Sharifuddin, Rao, Anup Venkat, Thomas, Michael Allen, Fenton, James L., Szeto, Bailey G., Pol, Sanjay, Ramaswami, Ashok
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US13/934,592
• Publication Number:
  US 20130298232A1
• Time in Patent Office: 734 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

In one embodiment, a system can comprise an interface that receives data related to a communication session and a messaging security device component that evaluates the data and enables a security measure for preventative monitoring of a threat based on the evaluation, the security measure can be universally applied to two or more messaging formats.

Claims

1. A system, comprising:

an interface component of a computer processor that receives data related to a plurality of communication sessions; and

a messaging security device (MSD) component of the computer processor that dynamically evaluates the data related to the plurality of communication sessions corresponding to a plurality of messaging, wherein the MSD component;

identifies all messaging protocols originated by a single communication device;

analyzes messages sent from the single communications device irrespective of the messaging protocol to determine whether a given message is malicious;

determines an infected messaging protocol through which a malicious message from the single communication device is received and that is associated with a threat; and

a repair component, wherein the repair component;

initiates a mechanism that corrects the single communication device by applying a security measure to all messaging protocols originated by the single communication device, and

utilizes a messaging protocol that is disparate in comparison with the infected messaging protocol sending a notification to the single communication device,

wherein the notification includes repair instructions that correct the single communication device.

2. The system of claim 1, wherein the messaging protocols comprise at least two of email, instant messaging, web-browsing, web mail, Internet Protocol (IP) telephony, audio communications, video communications, voice mail, video mail, and facsimile.

3. The system of claim 1, the single communication device comprises a device suitable for transmission of the data, a gaming device, a portable media device, a computer, a machine, a laptop, a portable digital assistant (PDA), a smartphone, a mobile communication device, a cellular phone, a messaging device, a wireless device, a server, and a network.

4. The system of claim 1, wherein the threat is isolated based on at least one of a user identity related to the single communication device and an identity of the single communication device.

5. The system of claim 1, wherein the threat is isolated based upon a messaging protocol that initially contained the threat.

6. The system of claim 1, further comprising a policy engine that implements the security measure independent of messaging protocol.

7. The system of claim 1, further comprising a scanning engine that evaluates data associated with the plurality of communication sessions utilizing at least one of the following types of filters:

an anti-spam filter, an AV (Anti-Virus) filter, a URL (Universal Resource Locator) filter, a URI (Uniform Resource Identifier) filter, a content analysis, a compliance filter, and an authentication filter.

8. The system of claim 1, further comprising a common data store that stores data related to at least one of an active communication session and a past communication session.

9. The system of claim 8, wherein the common data store includes an identity involved in the plurality of communication sessions including at least one of an email address, an IP address, an instant messaging handle, and a URI (Uniform Resource Identifier) including a SIP (Session Initiation Protocol) type URI.

10. The system of claim 8, wherein the MSD component utilizes the active communication session data to employ dynamic evaluation and implementation of the security measure to at least one messaging protocol.

11. The system of claim 8, wherein the MSD component utilizes the past communication session data to employ the security measure to at least one messaging protocol.

12. The system of claim 1, wherein the MSD component identifies a source of the threat, the source is at least one of a device, a user, a gaming device, a computer, a machine, a laptop, a portable digital assistant (PDA), a smartphone, a mobile communication device, a cellular phone, a messaging device, an IP address, a website, an attachment associated with an email, a wireless device, a server, a portable media device, a person, an identity, a persona, a characteristic of the threat, a type of the threat, and a network.

13. The system of claim 12, wherein the MSD component further identifies a persona corresponding to the source and associated with a messaging protocol, the persona is at least one of an email address, an IP telephony number, an instant messaging handle, an Internet Protocol (IP) address, a URI (Uniform Resource Identifier) including a SIP (Session Initiation Protocol) URI, a web mail address, and a facsimile number.

14. A method, comprising:

analyzing data related to a plurality of communication sessions corresponding to a plurality of messaging protocols;

identifying, using a computer processor, all messaging protocols originated by a single communication device;

analyzing messages sent from the single communications device to determine whether a given message is malicious;

determining an infected messaging protocol through which a malicious message from the single communication device is received and that is associated with a threat;

initiating a mechanism that corrects the single communication device by applying a security measure to all messaging protocols originated by the single communication device and by utilizing a messaging protocol that is disparate in comparison with the infected messaging protocol sending a notification to the single communication device,

wherein the notification includes repair instructions that correct the single communication device.