Reputation-based threat protection

• US 9,215,241 B2
• Filed: 08/28/2014
• Issued: 12/15/2015
• Est. Priority Date: 03/10/2010
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Yanovsky, Boris, Eikenberry, Scott
• Primary Examiner(s): RAHIM, MONJUR
• Application Number:
  US14/472,234
• Publication Number:
  US 20140373141A1
• Time in Patent Office: 474 Days
• Field of Search: 726/22
• US Class Current: 1/1
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Information concerning a plurality of identified threats provided by a plurality of preselected sources is stored in memory. An e-mail message may be received over a communication network. The received e-mail message is separated into a plurality of components. The stored information is searched to identify a reputation score associated with each of the plurality of components. It is then determined whether the e-mail is a threat based on the identified reputation score of each of the plurality of components. The determination is sent to a designated recipient.

Claims

1. A method for reputation-based threat protection, the method comprising:

maintaining one or more dictionaries for identifying sensitive data in memory, wherein the sensitive data is defined by policies of an identified organization;

maintaining information in one or more databases concerning a plurality of identified threats;

intercepting an e-mail message from a sender in the organization and addressed to a destination outside of the organization, wherein the e-mail message is intercepted prior to leaving a communication network of the organization;

executing instructions stored in memory, wherein execution of the instructions by a processor;

determines that the intercepted e-mail message includes sensitive data by searching for predefined patterns, wherein searching comprises reference to the one or more dictionaries stored in memory for identifying the sensitive data,

identifies the e-mail message is a threat based on one or more reputation scores associated with the e-mail message and the determination that the e-mail message includes sensitive data, wherein the e-mail message is associated with the one or more reputation scores using the maintained information, and

applies one or more enforcement actions based on the determination that the e-mail message includes sensitive data; and

notifying the sender that the e-mail message was identified to be a threat.

2. The method of claim 1, wherein determining that the intercepted e-mail message includes sensitive data comprises looking at content within an attachment.

3. The method of claim 1, wherein the predefined patterns pertain to at least one of social security numbers, bank routing numbers, and credit card numbers.

4. The method of claim 1, further comprising providing a plurality of approval boxes that allow for viewing and approval of the e-mail message before sending out of the identified organization.

5. The method of claim 1, further comprising matching the e-mail message to a policy based on the sensitive data.

6. The method of claim 5, further comprising routing the matching e-mail message to an e-mail archive.

7. The method of claim 5, further comprising directing the e-mail message to an encryption/decryption server.

8. The method of claim 1, wherein the dictionaries are associated with regulatory policies, industry standards, corporate compliance policies, or intellectual property policies.

9. A system for reputation-based threat protection, the system comprising:

database memory that maintains one or more dictionaries for identifying sensitive data in memory, wherein the sensitive data is defined by policies of an identified organization;

one or more databases that maintain information concerning a plurality of identified threats; and

a server that;

intercepts an e-mail message from a sender in the organization and addressed to a destination outside of the organization, wherein the e-mail message is intercepted prior to leaving a communication network of the organization,

determines that the intercepted e-mail message includes sensitive data by searching for predefined patterns, wherein searching comprises reference to the one or more dictionaries stored in memory for identifying the sensitive data,

identifies the e-mail message is a threat based on one or more reputation scores associated with the e-mail message and the determination that the e-mail message includes sensitive data, wherein the e-mail message is associated with the one or more reputation scores using the maintained information,

applies one or more enforcement actions based on the determination that the e-mail message includes sensitive data, and

notifies the sender that the e-mail message was identified to be a threat.

10. The system of claim 9, wherein the server determines that the intercepted e-mail message includes sensitive data by looking at content within an attachment.

11. The system of claim 9, wherein the predefined patterns pertain to at least one of social security numbers, bank routing numbers, and credit card numbers.

12. The system of claim 9, wherein the server further provides a plurality of approval boxes that allow for viewing and approval of the e-mail message before sending out of the identified organization.

13. The system of claim 9, wherein the server further matches the e-mail message to a policy based on the sensitive data.

14. The system of claim 13, wherein the server further routes the matching e-mail message to an e-mail archive.

15. The system of claim 13, wherein the server further directs the e-mail message to an encryption/decryption server.

16. The system of claim 9, wherein the dictionaries are associated with regulatory policies, industry standards, corporate compliance policies, or intellectual property policies.

17. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for reputation-based threat protection, the method comprising:

maintaining one or more dictionaries for identifying sensitive data in memory, wherein the sensitive data is defined by policies of an identified organization;

maintaining information concerning a plurality of identified threats;

intercepting an e-mail message from a sender in the organization and addressed to a destination outside of the organization, wherein the e-mail message is intercepted prior to leaving a communication network of the organization;

determining that the intercepted e-mail message includes sensitive data by searching for predefined patterns, wherein searching comprises reference to the one or more dictionaries stored in memory for identifying the sensitive data;

identifying the e-mail message is a threat based on one or more reputation scores associated with the e-mail message and the determination that the e-mail message includes sensitive data, wherein the e-mail message is associated with the one or more reputation scores using the maintained information;

applying one or more enforcement actions based on the determination that the e-mail message includes sensitive data; and

notifying the sender that the e-mail message was identified to be a threat.