Automated message security scanner detection system

• US 9,876,753 B1
• Filed: 12/22/2016
• Issued: 01/23/2018
• Est. Priority Date: 12/22/2016
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Wombat Security Technologies, Inc (Proofpoint Incorporated)
• Inventors: Hawthorn, Trevor Tyler
• Primary Examiner(s): Shingles, Kristie
• Application Number:
  US15/388,961
• Time in Patent Office: 397 Days
• CPC Class Codes: H04L 51/18 Commands or executable codes
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 51/234 for tracking messages

Abstract

An electronic messaging system includes a messaging server that identifies a recipient for an electronic message. The messaging system sends the recipient an electronic message that includes instrumented content. A web server monitors activity and determines whether interaction occurred with the instrumented content. The web server determines whether a sandbox intercepted the message based on whether interaction occurred, or did not occur, with the instrumented content within a threshold time period or with one or more activity characteristics.

Claims

1. A method of determining whether an electronic message was delivered to an intended recipient or intercepted by a sandbox, comprising:

by a message generation server;

identifying a recipient for a message,

selecting a first identifier and a second identifier,

generating an electronic message so that;

the first identifier appears in the electronic message in a format that will be visible to a human when the message is displayed on a display device; and

the second identifier appears in the message in a format that will not be visible to the human when the message is displayed on a display device, and

transmitting the electronic message via a communication network for delivery to an address of the recipient; and

by a web server;

monitoring whether interaction occurs with the second identifier, and

determining whether a sandbox may have intercepted the electronic message based on whether the web server detects interaction with the second identifier within a threshold period of time of the transmitting the electronic message.

2. The method of claim 1, wherein:

the second identifier comprises a hyperlink; and

monitoring whether interaction occurs with the second identifier comprises monitoring an address associated with the hyperlink to determine whether a service request is received at the address within the threshold period of time.

3. The method of claim 1, wherein:

the second identifier comprises an executable message attachment; and

monitoring whether interaction occurs with the second identifier comprises determining whether an action that the message attachment is configured to perform upon opening the executable message attachment has occurred.

4. The method of claim 1, wherein determining whether a sandbox may have intercepted the electronic message comprises:

determining that the sandbox intercepted the electronic message before delivery to the recipient if the web server detects interaction with the second identifier within the threshold period of time, otherwise determining that the electronic message has not been intercepted by the sandbox.

5. The method of claim 1, wherein determining whether a sandbox may have intercepted the electronic message comprises:

determining that the sandbox did not intercept the electronic message and that the message reached the recipient if the web server detects interaction with the first identifier but does not detect interaction with the second identifier after the detecting the interaction with the first identifier.

6. A method of determining whether an electronic message was intercepted by a sandbox, comprising:

by a message generation server;

generating a first electronic message so that the first electronic message includes a first identifier that may be actuated,

generating a first recipient address that the message generation server knows is invalid or that the message generation server determines is likely to be invalid,

transmitting the first electronic message for delivery to the first recipient address via a communication network; and

by a web server;

monitoring whether interaction occurs with the first identifier within a threshold period of time of the transmitting the first electronic message, and

upon detection of interaction with the first identifier within the threshold period of time, determining that a sandbox intercepted the first electronic message.

7. The method of claim 6, wherein:

the first identifier comprises a hyperlink; and

monitoring whether interaction occurs with the first identifier comprises monitoring an address associated with the hyperlink to determine whether a service request is received at the address within the threshold period of time.

8. The method of claim 6, wherein:

the first identifier comprises a message attachment; and

monitoring whether interaction occurs with the first identifier comprises determining whether an action that the message attachment is configured to perform upon opening the message attachment has occurred.

9. The method of claim 6, wherein:

the first identifier comprises an address of an image that is stored on an image server; and

monitoring whether interaction occurs with the first identifier comprises determining whether the image server has received a request for the image.

10. The method of claim 6, further comprising:

analyzing the interaction with the first identifier to generate a fingerprint for the sandbox;

generating a second electronic message so that the second electronic message includes a second identifier that may be actuated;

transmitting the second electronic message for delivery to a second recipient address via the communication network, wherein the second recipient address is an address that the message generation server knows is valid;

monitoring whether interaction occurs with the second identifier;

upon detection of interaction with the second identifier, determining whether the interaction with the second identifier exhibits the fingerprint; and

if the interaction with the second identifier exhibits the fingerprint, determining that the sandbox intercepted the second electronic message, otherwise determining that the second electronic message has not been intercepted.

11. The method of claim 10, wherein analyzing the interaction with the first identifier to generate the fingerprint for the sandbox comprises:

analyzing the interaction to identify a web server access log entry associated with the interaction;

extracting a user-agent identifier or an address from the web server access log entry; and

including the user-agent identifier and the address in a signature.

12. An electronic messaging system, comprising:

a message generation server comprising a processor and a memory portion containing programming instructions that are configured to cause the message generation server to;

identify a recipient for a message,

select a first identifier and a second identifier,

generate an electronic message so that;

the first identifier appears in the electronic message in a format that will be visible to a human when the message is displayed on a display device; and

the second identifier appears in the message in a format that will not be visible to the human when the message is displayed on a display device, and

transmit the electronic message via a communication network for delivery to an address of the recipient; and

a web server comprising a processor and a memory portion containing programming instructions that are configured to cause the web server to;

monitor whether interaction occurs with the second identifier, and

determine whether a sandbox may have intercepted the electronic message based on whether the web server detects interaction with the second identifier within a threshold period of time of the transmitting the electronic message.

13. The system of claim 12, wherein:

the second identifier comprises a hyperlink; and

the instructions to monitor whether interaction occurs with the second identifier comprise instructions to monitor an address associated with the hyperlink to determine whether a service request is received at the address within the threshold period of time.

14. The system of claim 12, wherein:

the second identifier comprises an executable message attachment; and

the instructions to monitor whether interaction occurs with the second identifier comprise instructions to determine whether an action that the message attachment is configured to perform upon opening the executable message attachment has occurred.

15. The system of claim 12, wherein the instructions to determine whether a sandbox may have intercepted the electronic message comprise instructions to:

determine that the sandbox intercepted the electronic message before delivery to the recipient if the web server detects interaction with the second identifier within the threshold period of time, otherwise determine that the electronic message has not been intercepted by the sandbox.

16. The system of claim 12, wherein the instructions to determine whether a sandbox may have intercepted the electronic message comprise instructions to:

determine that the sandbox did not intercept the electronic message and that the message reached the recipient if the web server detects interaction with the first identifier but does not detect interaction with the second identifier after the detecting the interaction with the first identifier.

17. An electronic messaging system, comprising:

a message generation server comprising a processor and a memory portion containing programming instructions that are configured to cause the message generation server to;

generate a first electronic message so that the first electronic message includes a first identifier that may be actuated,

generate a first recipient address that the message generation server knows is invalid or that the message generation server determines is likely to be invalid,

transmit the first electronic message for delivery to the first recipient address via a communication network; and

a web server comprising a processor and a memory portion containing programming instructions that are configured to cause the web server to;

monitor whether interaction occurs with the first identifier within a threshold period of time of the transmitting the first electronic message, and

upon detection of interaction with the first identifier within the threshold period of time, determine that a sandbox intercepted the first electronic message.

18. The system of claim 17, wherein:

the first identifier comprises a hyperlink; and

the instructions to monitor whether interaction occurs with the first identifier comprise instructions to monitor an address associated with the hyperlink to determine whether a service request is received at the address within the threshold period of time.

19. The system of claim 17, wherein:

the first identifier comprises a message attachment; and

the instructions to monitor whether interaction occurs with the first identifier comprise instructions to determine whether an action that the message attachment is configured to perform upon opening the message attachment has occurred.

20. The system of claim 17, wherein:

the first identifier comprises an address of an image that is stored on an image server; and

the instructions to monitor whether interaction occurs with the first identifier comprise instructions to determine whether the image server has received a request for the image.

21. The method of claim 17, wherein:

the web server comprises additional programming instructions that are configured to cause the web server to analyze the interaction with the first identifier to generate a fingerprint for the sandbox;

the message generation server comprises additional programming instructions that are configured to cause the message generation server to;

generate a second electronic message so that the second electronic message includes a second identifier that may be actuated, and

transmit the second electronic message for delivery to a second recipient address via the communication network, wherein the second recipient address is an address that the message generation server knows is valid;

the web server comprises additional programming instructions that are configured to cause the web server to;

monitor whether interaction occurs with the second identifier,

upon detection of interaction with the second identifier, determine whether the interaction with the second identifier exhibits the fingerprint, and

if the interaction with the second identifier exhibits the fingerprint, determine that the sandbox intercepted the second electronic message, otherwise determine that the second electronic message has not been intercepted.

22. The system of claim 21, wherein the instructions to analyze the interaction with the first identifier to generate the fingerprint for the sandbox comprise instructions to:

analyze the interaction to identify a web server access log entry associated with the interaction;

extract a user-agent identifier or an address from the web server access log entry; and

include the user-agent identifier and the address in a signature.