Tertiary classification of communications

• US 9,473,437 B1
• Filed: 02/12/2013
• Issued: 10/18/2016
• Est. Priority Date: 02/13/2012
• Status: Active Grant

• Current Assignee: ZapFraud, Inc. (Bjorn Markus Jakobsson)
• Original Assignee: ZapFraud, Inc. (Bjorn Markus Jakobsson)
• Inventors: Jakobsson, Bjorn Markus
• Primary Examiner(s): Khan, Aftab N.
• Application Number:
  US13/765,630
• Time in Patent Office: 1,344 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

An electronic communication is received. The received communication is classified according to a tertiary classification scheme. In the tertiary classification scheme, communications classified using a first classification are not delivered to a recipient. Also in the tertiary classification scheme, communications classified using a second classification are subjected to heightened review. In some cases, the heightened review is performed by one or more reviewers, after the communication has been at least partially redacted.

Claims

1. A system, comprising:

a set of one or more processors configured to;

receive an electronic communication; and

automatically classify the electronic communication by assigning to it a single one of three different classifications according to a tertiary classification scheme, wherein the three classifications include good, bad, and undetermined;

wherein an action is performed with respect to the electronic communication, and wherein the action that is performed is determined based at least in part on which of the three classifications the-electronic communication was automatically assigned; and

wherein in the event of an automatic classification of the electronic communication as undetermined, the action includes providing the electronic communication to at least one reviewer for analysis, wherein a user interface is provided to the at least one reviewer for classifying the electronic communication, and wherein the provided user interface includes at least one of;

a redacted version of the electronic communication, wherein a first portion of the electronic communication is visually obscured in the user interface provided to the at least one reviewer;

one or more displayed options usable by the at least one reviewer to indicate how the electronic communication should be classified; and

highlighting of a second portion of the electronic communication that is potentially indicative of fraudulent activity, wherein the highlighted portion of the electronic communication is visually emphasized in the user interface provided to the at least one reviewer; and

a memory coupled to the set of one or more processors and configured to provide the set of one or more processors with instructions.

2. The system of claim 1 wherein the receiving comprises receiving a plurality of electronic communications and wherein the classifying comprises identifying fraudulent activity perpetrated across the plurality of communications.

3. The system of claim 1 wherein the classification is performed at least in part based on a collection of terms, wherein the collection of terms is associated with a particular fraudulent storyline.

4. The system of claim 1 wherein the automatic classification is performed at least in part based on an evaluation of the presence or absence of terms indicative of fraudulent activity.

5. The system of claim 1 wherein the automatic classification is performed at least in part based on a determination of whether an originator of the electronic communication was previously classified as friendly.

6. The system of claim 1 wherein the automatic classification is performed at least in part based on a determination of whether a location associated with the electronic communication was previously classified as suspicious.

7. The system of claim 1 wherein the automatic classification is performed at least in part based on a determination of whether a location associated with the electronic communication was previously classified as undisclosed.

8. The system of claim 1 wherein the electronic communication comprises an electronic mail message.

9. The system of claim 1 wherein the electronic communication comprises an instant message.

10. The system of claim 1 wherein the first portion of the electronic communication that is obscured in the user interface provided to the at least one reviewer includes personal information.

11. The system of claim 1 wherein, in the classification scheme, a first communication classified using a first classification in the tertiary classification is not delivered to a recipient and wherein a second communication classified using a second classification in the tertiary classification is subjected to heightened review.

12. The system of claim 11 wherein the first communication and second communication are evaluated using a first classification engine, and wherein the heightened review is performed using a second classification engine.

13. The system of claim 12 wherein the second communication is evaluated by the first classification engine at a first time, and wherein the heightened review is performed at a second time that is later than the first time.

14. The system of claim 11 wherein the second communication is transmitted to a plurality of reviewers for analysis, and wherein a reputation score associated with at least one reviewer in the plurality is updated in response to a completion of the heightened review.

15. The system of claim 1 wherein the at least one reviewer has an associated reviewer reputation score.

16. The system of claim 15 wherein the set of one or more processors is further configured to assign the reputation score to the at least one reviewer.

17. The system of claim 1 wherein the automatic classification is performed at least in part based on a determination of whether a location associated with the electronic communication was previously classified as friendly.

18. The system of claim 17 wherein the friendly classification comprises a global classification.

19. A method, comprising:

receiving an electronic communication; and

automatically classifying, using a set of one or more processors, the electronic communication by assigning to it a single one of three different classifications according to a tertiary classification scheme, wherein the three classifications include good, bad, and undetermined;

wherein an action is performed with respect to the electronic communication, and wherein the action that is performed is determined based at least in part on which of the three classifications the electronic communication was automatically assigned;

wherein in the event of an automatic classification of the electronic communication as undetermined, the action includes providing the electronic communication to at least one reviewer for analysis, wherein a user interface is provided to the at least one reviewer for classifying the electronic communication, and wherein the provided user interface includes at least one of;

a redacted version of the electronic communication, wherein a first portion of the electronic communication is visually obscured in the user interface provided to the at least one reviewer;

one or more displayed options usable by the at least one reviewer to indicate how the electronic communication should be classified; and

highlighting of a second portion of the electronic communication that is potentially indicative of fraudulent activity, wherein the highlighted portion of the electronic communication is visually emphasized in the user interface provided to the at least one reviewer.

20. A computer program product embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving an electronic communication; and

automatically classifying the electronic communication by assigning to it a single one of three different classifications according to a tertiary classification scheme, wherein the three classifications include good, bad, and undetermined;

wherein an action is performed with respect to the electronic communication, and wherein the action that is performed is determined based at least in part on which of the three classifications the electronic communication was automatically assigned;

wherein in the event of an automatic classification of the electronic communication as undetermined, the action includes providing the electronic communication to at least one reviewer for analysis, wherein a user interface is provided to the at least one reviewer for classifying the electronic communication, and wherein the provided user interface includes at least one of;

a redacted version of the electronic communication, wherein a first portion of the electronic communication is visually obscured in the user interface provided to the at least one reviewer;

one or more displayed options usable by the at least one reviewer to indicate how the electronic communication should be classified; and

highlighting of a second portion of the electronic communication that is potentially indicative of fraudulent activity, wherein the highlighted portion of the electronic communication is visually emphasized in the user interface provided to the at least one reviewer.