Apparatus and method for augmenting a message to facilitate spam identification

• US 9,634,970 B2
• Filed: 04/30/2013
• Issued: 04/25/2017
• Est. Priority Date: 04/30/2013
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Cloudmark Incorporated (Proofpoint Incorporated)
• Inventors: Stemm, Mark
• Primary Examiner(s): Taylor, Nicholas
• Assistant Examiner(s): Kim, Chong G
• Application Number:
  US13/874,376
• Publication Number:
  US 20140324985A1
• Time in Patent Office: 1,456 Days
• Field of Search: 709206
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/10 Multimedia information
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Abstract

A computer includes a processor and a memory connected to the processor. The memory stores instructions executed by the processor to augment a message with network node attributes derived by linking from an original network node specified in the message to additional network nodes associated with the original network node. Message signatures representing the network node attributes are generated. The message signatures are evaluated to characterize the message.

Claims

1. A computer, comprising:

a processor; and

a memory connected to the processor, the memory storing instructions executed by the processor to;

receive an electronic mail message with original network nodes specifying original host names and original Internet Protocol (IP) addresses,

perform a machine lookup to identify additional host names and additional IP addresses associated with the original host names and original IP addresses,

augment the electronic mail message with network node attributes including the additional host names and additional IP addresses, wherein the network node attributes are added to the electronic mail message in a header section,

generate message signatures representing the network node attributes, and

evaluate the message signatures to characterize the message, wherein the evaluate operation imputes unsolicited bulk electronic message (spam) characteristics to related nodes in a graph linking an original network node specified in the electronic mail message to additional network nodes associated with the original network node.

2. The computer of claim 1 wherein the original network node includes a network device indicator in the message.

3. The computer of claim 2 wherein the network device indicator is a host name.

4. The computer of claim 2 wherein the network device indicator is an Internet Protocol (IP) address.

5. The computer of claim 1 wherein the network node attributes include naming system records.

6. The computer of claim 5 wherein the naming system is selected from Domain Name System (DNS), Network Information Service (NIS), and Server Message Block (SMB).

7. The computer of claim 1 further comprising instructions executed by the processor to decide whether to further augment the message with additional network node attributes through recursive linking.

8. The computer of claim 1 further comprising instructions executed by the processor to form a quarantined message characterized as spam.

9. The computer of claim 8 further comprising instructions executed by the processor to notify a recipient of the quarantined message.

10. The computer of claim 1 further comprising instructions executed by the processor to generate message signatures representing features in the message.

11. The computer of claim 1 further comprising instructions executed by the processor to store in the message relations between network node attributes.

12. The computer of claim 11 further comprising instructions executed by the processor to evaluate the relations to identify a suspect node and ascribe a suspect characteristic to nodes related to the suspect node.