Just-in-time, email embedded URL reputation determination

• US 9,467,410 B2
• Filed: 12/20/2012
• Issued: 10/11/2016
• Est. Priority Date: 12/20/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Liebmann, Nicholas, Stecher, Martin, Gartside, Paul, Bishop, Mike, Hunt, Simon
• Primary Examiner(s): NGUYEN, TU T
• Application Number:
  US13/721,303
• Publication Number:
  US 20140181216A1
• Time in Patent Office: 1,391 Days
• Field of Search: 709/206
• US Class Current: 1/1
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/18 Commands or executable codes
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system allows just-in-time checking of information about an email in which a hyperlink is embedded. Upon receipt of the email containing the hyperlink, the resource locator of the hyperlink is modified to allow checking the reputation of the email upon traversal of the hyperlink. At traversal of the hyperlink, the current reputation of the resource locator and the current reputation of the email are both determined, and one or more actions are performed responsive to the determination.

Claims

1. A non-transitory program storage device, on which are stored instructions comprising instructions for causing one or more processors to:

receive a request to traverse a resource locator of a hyperlink from an email containing the hyperlink;

determine a reputation of the email and a reputation of the resource locator, responsive to the request;

store reputation information associated with an identity of the email in a reputation database; and

perform an action responsive to the reputation of the email and the reputation of the resource locator.

2. The program storage device of claim 1, wherein the action comprises one or more of:

subjecting the resource locator to greater scrutiny;

refusing to allow traversal of the resource locator; and

redirecting traversal to an alternate destination.

3. The program storage device of claim 2, wherein the action further comprises subjecting downloaded data corresponding to the resource locator to greater scrutiny.

4. The program storage device of claim 1, on which are stored instructions further comprising instructions for causing one or more processors to:

receive an email containing a hyperlink; and

modify the resource locator of the hyperlink in the email to indicate the identity of the email.

5. The program storage device of claim 4, wherein the instructions for causing one or more processors to modify the resource locator comprise instructions for causing one or more processors to:

replace the resource locator in the email message.

6. The program storage device of claim 1, wherein the instructions for causing one or more processors to determine a reputation of the email and a reputation of the resource locator comprise instructions for causing one or more processors to:

request reputation information for the email from an email gateway.

7. A system, comprising:

a web gateway; and

an email gateway,

wherein the web gateway comprises;

a processor;

a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to;

receive a request to make a connection to a location specified by a resource locator of a hyperlink embedded in an email;

determine an identity of the email based on the resource locator;

determine a current reputation of the email; and

determine a current reputation of the resource locator;

store reputation information associated with the identity of the email in a reputation database; and

perform an action responsive to a reputation of the resource locator and the email;

wherein the email gateway comprises;

a processor;

a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to;

receive the email; and

modify the resource locator in the email to identify the email.

8. The system of claim 7, wherein the software of the email gateway further comprises instructions for causing the processor to:

′

cache information corresponding to the email;

receive the request from the web gateway;

extract information about the email from the cached information based on information in the request;

obtain reputation information for the email; and

send the reputation information to the web gateway.

9. The system of claim 7,

wherein the software of the web gateway further comprises instructions for causing the processor to:

determine that the resource locator comprises information associated with a context of the email,

wherein the instructions for causing the processor to request reputation information comprise instructions for causing the processor to;

include the information associated with the context of the email in the request.

10. The system of claim 7,

wherein the software of the email gateway further comprises instructions for causing the processor to:

deliver the email containing the modified resource locator.

11. The system of claim 7, wherein the instructions for causing the processor to modify the resource locator comprise instructions for causing the processor to:

generate a message identifier for the email; and

modify the email by encoding the message identifier into the resource locator in the email.

12. The system of claim 7, wherein the software of the email gateway further comprises instructions for causing the processor to:

obtain an initial reputation of the email upon receipt of the email; and

perform an action responsive to the initial reputation.

13. The system of claim 7, further comprising:

a redirection server, comprising;

a processor; and

a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to;

receive information associating the modified resource locator with the resource locator in the email;

receive a connection corresponding to the resource locator;

request a reputation of the email and the resource locator in the email; and

redirect the connection to a destination specified in the resource locator in the email,

wherein the instructions for causing the processor to modify the resource locator comprise instructions for causing the processor to;

replace the resource locator in the email with a resource locator pointing to the redirection server.

14. A method, comprising:

receiving an email, comprising;

determining by the computing device an initial reputation of the email; and

modifying by the computing device a first resource locator of a hyperlink embedded in the email to identify the email; and

receiving a request to traverse the first resource locator, comprising;

determining by the computing device a current reputation of the first resource locator;

analyzing by the computing device the first resource locator to identify the email in which the hyperlink was embedded;

determining by the computing device a current reputation of the email;

storing reputation information associated with an identity of the email in a reputation database; and

performing an action responsive to the reputation of the first resource locator and the current reputation of the email.

15. The method of claim 14, wherein modifying by the computing device a first resource locator comprises:

replacing the resource locator by the computing device with a second resource locator; and

associating by the computing device the first resource locator with the second resource locator.

16. The method of claim 15, wherein receiving a request to traverse the first resource locator further comprises:

receiving a request by a redirection service to traverse the second resource locator; and

determine the first resource locator associated with the second resource locator.

17. The method of claim 14,

wherein receiving an email further comprises:

storing by the computing device meta-information about the email; and

associating by the computing device the meta-information with a message identification data, and

wherein modifying by the computing device a first resource locator comprises;

encoding by the computing device the message identification data into the first resource locator.