Stopping and remediating outbound messaging abuse

• US 9,560,064 B2
• Filed: 11/30/2015
• Issued: 01/31/2017
• Est. Priority Date: 02/28/2005
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Chasin, C. Scott, Lin, Wei, Kincaid-Smith, Paul
• Primary Examiner(s): Anwah, Olisa
• Application Number:
  US14/954,044
• Publication Number:
  US 20160156654A1
• Time in Patent Office: 428 Days
• Field of Search: 379/93.24, 709/206, 709/202, 709/203
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Systems and methods are provided for allowing subscriber message sending profiles to be maintained and used in conjunction with behavior-based anomaly detection techniques and traditional content-based spam signature filtering to enable application of appropriate message disposition policies to outbound subscriber message traffic. According to one embodiment, subscriber profiles are constructed for multiple subscriber accounts associated with a service provider based on outbound message flow originated from the subscriber accounts. Then, possible subscriber account misuse may be discovered by performing behavior-based anomaly detection, including a comparison of a subscriber profile associated with the subscriber account with recent subscriber account usage information, to identify one or more behavioral anomalies in outbound message flow originated from a subscriber account, the behavior-based anomaly detection.

Claims

1. Logic, encoded in non-transitory media, that includes instructions for execution and that, when executed by a processor, is operable to perform operations comprising:

applying a reputation value, based on a subscriber profile associated with a subscriber account, to an outbound message originated via the subscriber account, the outbound message being either an email message or an instant message;

applying a spam filter to the outbound message;

adding a blind carbon copy recipient to the outbound message, based on reputation data of the outbound message; and

revising the reputation value of the subscriber account based on a plurality of metrics, including a detection of spam, the plurality of metrics further including a deviation from the subscriber profile based, at least in part, on behavior data extracted from a plurality of messages originated via the subscriber account.

2. The logic of claim 1, wherein the operations further comprise:

redirecting, based on the reputation value, an e-mail message originated via the subscriber account to a relay pool.

3. The logic of claim 1, wherein the subscriber profile includes an average Bayesian spam filter probability score for messages originated by the subscriber account.

4. The logic of claim 1, wherein the spam filter performs a signature-based spam filtering.

5. The logic of claim 1, wherein the subscriber profile includes an average number of recipients to which messages originated by the subscriber account are addressed.

6. The logic of claim 1, wherein the subscriber profile includes an average number of messages originated by the subscriber account within a predetermined time interval.

18. The logic of claim 1, wherein the operations further comprise:

denying the outbound message.

7. A method, comprising:

applying a reputation value, based on a subscriber profile associated with a subscriber account, to an outbound message originated via the subscriber account, the outbound message being either an email message or an instant message;

applying a spam filter to the outbound message;

adding a blind carbon copy recipient to the outbound message, based on reputation data of the outbound message; and

revising the reputation value of the subscriber account based on a plurality of metrics, including a detection of spam, the plurality of metrics further including a deviation from the subscriber profile based, at least in part, on behavior data extracted from a plurality of messages originated via the subscriber account.

8. The method of claim 7, further comprising:

redirecting, based on the reputation value, an e-mail message originated via the subscriber account to a relay pool.

9. The method of claim 7, wherein the subscriber profile includes an average Bayesian spam filter probability score for messages originated by the subscriber account.

10. The method of claim 7, wherein the spam filter performs a signature-based spam filtering.

11. The method of claim 7, wherein the subscriber profile includes an average number of recipients to which messages originated by the subscriber account are addressed, or the subscriber profile includes an average number of messages originated by the subscriber account within a predetermined time interval.

19. The method of claim 7, further comprising:

denying the outbound message.

12. A system, comprising:

a processor configured to apply a reputation value, based on a subscriber profile associated with a subscriber account, to an outbound message originated via the subscriber account, the outbound message being either an email message or an instant message,

the processor further configured to apply a spam filter to the outbound message, to add a blind carbon copy recipient to the outbound message, based on reputation data of the outbound message, and to revise the reputation value of the subscriber account based on a plurality of metrics, including a detection of spam, the plurality of metrics further including a deviation from the subscriber profile based, at least in part, on behavior data extracted from a plurality of messages originated via the subscriber account.

13. The system of claim 12, wherein the processor is further configured to redirect, based on the reputation value, an e-mail message originated via the subscriber account to a relay pool.

14. The system of claim 12, wherein the subscriber profile includes an average Bayesian spam filter probability score for messages originated by the subscriber account.

15. The system of claim 12, wherein the spam filter performs a signature-based spam filtering.

16. The system of claim 12, wherein the subscriber profile includes an average number of recipients to which messages originated by the subscriber account are addressed.

17. The system of claim 12, wherein the subscriber profile includes an average number of messages originated by the subscriber account within a predetermined time interval.

20. The system of claim 12, wherein the processor is further configured to deny the outbound message.