Probability based whitelist

• US 10,699,246 B2
• Filed: 01/22/2018
• Issued: 06/30/2020
• Est. Priority Date: 05/29/2003
• Status: Expired due to Term

• Current Assignee: SonicWALL US Holdings, Inc. (SonicWall Holdings Ltd.)
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Wieneke, Paul R., Eikenberry, Scott D., Nufire, Tim, Koblas, David A., Wilson, Brian K.
• Primary Examiner(s): Nguyen, Minh Chau
• Application Number:
  US15/877,203
• Publication Number:
  US 20180211226A1
• Time in Patent Office: 890 Days
• Field of Search: 709206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases

Abstract

A system and method are disclosed for maintaining a whitelist, including: obtaining message data based on an email message sent by a user; extracting recipient information from message data; updating the whitelist using the recipient information.

Claims

1. A method for filtering messages, the method comprising:

storing one or more data sets in a memory at a private network, the one or more data sets identifying a plurality of data sources;

identifying a data source of an incoming message sent to one or more users of a private network;

performing a first analysis on the incoming message that compares the identified data source to the plurality of data sources stored in the memory at the private network, the first analysis resulting in the incoming message being identified as unclassifiable;

accessing an external database associated with a trusted community when the incoming message is identified as unclassifiable, wherein the external database is accessed to retrieve a list of one or more allowable message sources;

performing a second analysis on the incoming message that compares the identified data source to the list of allowable message sources from the external database, wherein the second analysis results in allowing the incoming message to be delivered to the one or more users of the private network;

identifying that an outgoing message from at least one user of the one or more users has been sent to the data source of the incoming message; and

updating a first data set of the one or more data sets, the first data set associated with the at least one user, wherein the updated first data set indicates that subsequent incoming messages from the data source are allowed to be delivered to the at least one user without requiring the second analysis.

2. The method of claim 1, further comprising:

receiving a second outgoing message from the at least one user and sent to a recipient; and

updating the first data set associated with the at least one user to identify the recipient, wherein the updated first data set indicates that incoming messages from the recipient are allowed to be delivered to the at least one user without requiring the second analysis.

3. The method of claim 2, further comprising sending the second outgoing message to at least the recipient.

4. The method of claim 1, further comprising:

receiving votes from one or more user devices, the votes indicating whether one or more messages sent from a sender are identified as being associated with spam; and

calculating a spam probability that the identified sender is associated with spam based on the received votes.

5. The method of claim 4, further comprising identifying that the identified sender is associated with spam based on the calculated spam probability meeting at least a threshold value.

6. The method of claim 4, further comprising identifying that the identified sender is not associated with spam based on the calculated spam probability not meeting a threshold value.

7. The method of claim 1, further comprising:

receiving a second incoming message from a sender that is not currently identified in any of the stored data sets; and

assigning an initial non-zero value to the sender of the second message based on a policy associated with messages received from senders that are not currently identified in the stored data sets, wherein the non-zero value sets a counter associated with the second incoming message and with at least one of the stored data sets.

8. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for filtering messages, the method comprising:

storing one or more data sets in a memory at a private network, the one or more data sets identifying a plurality of data sources;

identifying a data source of an incoming message sent to one or more users of a private network;

performing a first analysis on the incoming message that compares the identified data source to the plurality of data sources stored in the memory at the private network, the first analysis resulting in the incoming message being identified as unclassifiable;

accessing an external database associated with a trusted community when the incoming message is identified as unclassifiable, wherein the external database is accessed to retrieve a list of one or more allowable message sources;

performing a second analysis on the incoming message that compares the identified data source to the list of allowable message sources from the external database, wherein the second analysis results in allowing the incoming message to be delivered to the one or more users of the private network;

identifying that an outgoing message from at least one user of the one or more users has been sent to the data source of the incoming message; and

updating a first data set of the one or more data sets, the first data set associated with the at least one user, wherein the updated first data set indicates that subsequent incoming messages from the data source are allowed to be delivered to the at least one user without requiring the second analysis.

9. The non-transitory computer-readable storage medium of claim 8, further comprising instructions executable to:

receive a second outgoing message from the at least one user and sent to a recipient; and

update the first data set associated with the at least one user to identify the recipient, wherein the updated first data set indicates that incoming messages from the recipient are allowed to be delivered to the at least one user without requiring the second analysis.

10. The non-transitory computer-readable storage medium of claim 9, further comprising instructions executable to send the second outgoing message to at least the recipient.

11. The non-transitory computer-readable storage medium of claim 8, further comprising instructions executable to:

receive votes from one or more user devices, the votes indicating whether one or more messages sent from a sender are identified as being associated with spam; and

calculate a spam probability that the identified sender is associated with spam based on the received votes.

12. The non-transitory computer-readable storage medium of claim 11, further comprising instructions executable to identify that the identified sender is associated with spam based on the calculated spam probability meeting at least a threshold value.

13. The non-transitory computer-readable storage medium of claim 11, further comprising instructions executable to identify that the identified sender is not associated with spam based on the calculated spam probability not meeting a threshold value.

14. The non-transitory computer-readable storage medium of claim 8, further comprising instructions executable to:

receive a second incoming message from a sender that is not currently identified in any of the stored data sets; and

assigning an initial non-zero value to the sender of the second message based on a policy associated with messages received from senders that are not currently identified in the stored data sets, wherein the non-zero value sets a counter associated with the second incoming message and with at least one of the stored data sets.

15. An apparatus for filtering messages, the apparatus comprising:

memory at a private network that stores one or more data sets, the one or more data sets identifying a plurality of data sources;

a communication interface that receives an incoming message that is identified as being sent from a data source and sent to one or more users of a private network; and

a processor that executes instructions stored in the memory, wherein execution of the instructions by the processor;

performs a first analysis on the incoming message that compares the identified data source to the plurality of data sources stored in the memory at the private network, the first analysis resulting in the incoming message being identified as unclassifiable;

accesses an external database associated with a trusted community when the incoming message is identified as unclassifiable, wherein the external database is accessed to retrieve a list of one or more allowable message sources;

performs a second analysis on the incoming message that compares the identified data source to the list of allowable message sources from the external database, wherein the second analysis results in allowing the incoming message to be delivered to the one or more users of the private network;

identifies that an outgoing message from at least one user of the one or more users is addressed to the data source of the incoming message; and

updates a first data set of the one or more data sets, the first data set associated with the at least one user, wherein the updated first data set indicates that subsequent incoming messages from the data source are allowed to be delivered to the at least one user without requiring the second analysis.

16. The apparatus of claim 15, wherein the communication interface further receives a second outgoing message from the at least one user;

and wherein the processor executes further instructions to;

identify a recipient of the second outgoing message; and

update the first data set associated with the at least one user to identify the recipient, wherein the updated first data set indicates that incoming messages from the recipient are allowed to be delivered to the at least one user without requiring the second analysis.

17. The apparatus of claim 16, wherein the processor executes further instructions to send the second outgoing message to at least the recipient.

18. The apparatus of claim 15, wherein the communication interface further receives votes from one or more user devices, the votes indicating whether one or more messages sent from a sender are identified as being associated with spam, and the processor executes further instructions to calculate a spam probability that the identified sender is associated with spam based on the received votes.

19. The apparatus of claim 18, wherein the processor executes further instructions to identify that the identified sender is associated with spam based on the calculated spam probability meeting at least a threshold value.

20. The apparatus of claim 15, wherein the communication interface further receives a second incoming message, and the processor executes further instructions to:

identify that a sender of the second message is not currently included in any of the stored data sets; and

assign an initial non-zero value to the sender of the second message based on a policy associated with messages received from senders that are not currently included in the stored data sets, wherein the non-zero value sets a counter associated with the second incoming message and with at least one of the stored data sets.