Methods and Systems for Exposing Messaging Reputation to an End User

• US 20070027992A1
• Filed: 06/09/2006
• Published: 02/01/2007
• Est. Priority Date: 03/08/2002
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Ciphertrust, Incorporated (McAfee, LLC)
• Inventors: Krasser, Sven, Alperovitch, Dmitri, Judge, Paul, Hernandez, Alejandro, Schneck, Phyllis, Caracciolo, Joel
• Granted Patent: US 7,870,203 B2
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements

Abstract

Systems and methods for providing message reputation to an end user.

Claims

1. A method for providing a reputation associated with a message to an end user, wherein the end user comprises a messaging client, the method comprising:

receiving a message, the message being generated by a message originator, and being received from an originating messaging system via a network, the message including a message header comprising originator and recipient information, and a message body comprising content;

retrieving reputation information for the message based on the originating messaging system or originating information associated with the message;

associating a reputation indicator with the message, the reputation indicator being based upon the retrieved reputation information; and

passing the message to a receiving system associated with a recipient of the message based upon the recipient information included in the message header;

wherein the reputation associated with the message is operable to be displayed to the recipient.

2. The method of claim 1, wherein the message comprises a messaging stream.

3. The method of claim 1, wherein the reputation information is based upon information about the message originator stored in a local data store.

4. The method of claim 3, wherein the reputation information is based upon information about the message originator stored in a remote data store.

5. The method of claim 1, wherein the reputation information is based upon a combination and analysis of local information and remote information.

6. The method of claim 1, wherein the reputation indicator includes modifying a font associated with the message to alert the recipient to the reputation information associated with the message.

7. The method of claim 6, wherein the reputation indicator includes modifying the font by changing the color associated with one or more of the message header or message body.

8. The method of claim 1, further comprising scoring the message based upon a plurality of tests, the tests being configured to compare the message content to previously received messages, wherein the previously received messages include content associated with a known classification, and wherein reputation information comprises the message score.

9. The method of claim 8, wherein the reputation indicator includes modifying a header associated with the message based upon the score associated with the message.

10. The method of claim 8, the scoring comprising:

using a plurality of message classification techniques to classify the communication; and

combining outputs of the message classification techniques to generate a message profile score;

wherein the message profile score is used in decoding what action is to be taken with respect to the message.

11. The method of claim 1, wherein the message is an e-mail, SMS, an instant messaging, a VoIP, a hypertext transfer protocol, or a file transfer protocol communication.

12. The method of claim 1, further comprising displaying the message reputation to a recipient using a toolbar.

13. The method of claim 12, wherein the message reputation is displayed using a graphical notation, a text notation, an audio notation, or combinations thereof.

14. The method of claim 13, wherein the graphical notation comprises a representation for a bad reputation, a representation for a good reputation or a representation for an undetermined reputation.

15. The method of claim 12, further comprising displaying both a global reputation and a local reputation on the toolbar.

16. The method of claim 15, wherein the recipient can update a local or global, whitelist or blacklist via the toolbar, wherein the local whitelist or blacklist is maintained by a local client, and wherein the global whitelist or blacklist is stored on a server and is updated with information collected from a plurality of sensor devices.

17. The method of claim 16, wherein the local client receives configuration information from a user, and is operable to override a global reputation based on a local whitelist or blacklist and the configuration information.

18. The method of claim 15, wherein the local reputation is shared with a server storing the global reputation, and the server uses the local reputation as a criterion for adjusting the global reputation.

19. The method of claim 15, wherein the local reputation associated with a user and global reputation associated with a plurality of users are stored in separate data structures on a remote server, and wherein user configuration associated with the user determine which reputation to provide to the user via the toolbar.

20. The method of claim 1, further comprising:

receiving feedback from the user regarding the classification of the message;

using the feedback to update reputation information in at least one of a global reputation system or a local reputation system.

21. The method of claim 20, wherein the feedback is used to update reputation information only for the user providing the feedback.

22. The method of claim 20, wherein the feedback is used to update reputation information for a plurality of users, including the user that provided the feedback.

23. The method of claim 1, further comprising:

determining the originator of the message by inspecting the header, wherein the header includes a plurality of intermediate internet protocol address corresponding to a plurality of nodes through which the message was transferred; and

selecting one of the internet protocol address contained in the header using an origination algorithm.

24. The method of claim 23, wherein the origination algorithm comprises selecting an internet protocol address associated with the last node the message was transferred across before entering a gateway associated with the recipient.

25. A system configured to provide a reputation associated with a message to an end user, wherein the end user comprises a messaging client, the method comprising:

reputation assignment logic coupled to a messaging client and configured to assign to reputation to a message;

graphical or audio user interface logic coupled to the reputation assignment logic and configured to display to a recipient of the message a graphical or audio representation indicating the reputation associated with the message;

wherein the reputation of a message is derived based upon a score assigned to the message based upon a plurality of tests, the tests being configured to compare the message content to previously received messages, wherein the previously received messages include content associated with a known classification, and wherein reputation comprises the message score.

26. The system of claim 25, wherein the reputation is based upon an IP address associated with the originating information.

27. The system of claim 25, further comprising:

message scoring logic configured to generate a score associated with a message to identify how closely the message matches any previously received messages having a known classification.

28. The system of claim 27, wherein the message scoring logic is located remotely from the recipient on a reputation server associated with a messaging server, and the message scoring logic classifies a plurality of messages passing through the messaging server, the messages being sent to a plurality of recipients.

29. The system of claim 27, wherein the message scoring logic is located on a local computer associated with the recipient of the message, and the message scoring logic only classifies messages intended for the recipient.

30. The system of claim 25, wherein the system comprises a toolbar associated with a messaging client.

31. The system of claim 25, further comprising:

receiving feedback from the recipient regarding the classification of the message; and

using the feedback to adjust message scoring logic.

32. The system of claim 31, wherein the feedback received by a central reputation system and is used to adjust the global reputation of the characteristics associated with the message.

33. The system of claim 32, further comprising a plurality of reputation servers configured to retrieve the reputation information retained by the central reputation system to score messages transmitted via messaging servers associated with the reputation servers.

34. The system of claim 29, wherein the feedback is used to adjust the local reputation of the characteristics associated with the message.

35. The system of claim 25, wherein the reputation comprises a local reputation and a global reputation, the local reputation being based upon a whitelist or blacklist entry associated with the originating information, the global reputation comprising the score associated with the message based upon how closely the message matches previously examined messages with known classifications.