Zero-minute virus and spam detection

• US 20070050461A1
• Filed: 10/26/2006
• Published: 03/01/2007
• Est. Priority Date: 02/19/2003
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Postini, Inc. (Alphabet Inc.)
• Inventors: Cox, Fred, Akamine, Shinya, Lund, Peter, Petry, Scott, Oswall, Michael
• Granted Patent: US 7,603,472 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/108 Remote banking, e.g. home banking
• CPC Class Codes: G06Q 20/1085 involving automatic teller machines [ATMs]
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Disclosed in this application are systems and methods for detecting unwanted electronic message transmissions at a certain location on an electronic communications network. The disclosed principles include establishing a database for storing metadata associated with message traffic according to at least the source addresses of the senders of electronic message transmissions. The disclosed principles also include monitoring electronic message transmissions at the certain location on the electronic communications network. Also, included is populating the database with metadata derived from analysis of the monitored electronic messages, where the metadata includes metadata derived by analyzing the contents of the monitored electronic messages. Based upon the populated database, it is determined whether certain received electronic messages are likely to be unwanted based on an examination of the metadata associated with the source addresses of the senders of the received electronic messages and based on the analysis of the content of monitored electronic messages at least in part without reference to a promulgated database of “signatures” of known unwanted electronic messages.

Claims

1. A method for detecting unwanted electronic messages at a certain location on an electronic communications network, the method comprising:

a) establishing a database for storing metadata associated with electronic message traffic according to at least source addresses of senders of electronic messages;

b) monitoring electronic message transmissions at the certain location on the electronic communications network;

c) populating the database with metadata derived from analysis of the monitored electronic messages, the metadata including metadata derived by analyzing the content of the monitored electronic messages;

d) determining that certain monitored electronic messages are likely to be unwanted by an intended recipient based on an examination of the metadata associated with the source addresses of the senders of the monitored electronic messages and based on the analysis of the content of the monitored electronic messages, and at least in part without reference to a promulgated database of “

signatures”

of unwanted electronic messages.

2. A method according to claim 1, and further comprising establishing SMTP connections between the senders of electronic messages and at least certain mail servers of intended recipients of the electronic messages.

3. A method according to claim 2, wherein the monitoring of the electronic message transmissions occurs as each of the SMTP connections between a sender and a certain mail server of an intended recipient of a monitored electronic message is processed.

4. A method according to claim 1, wherein the method derives metadata from the monitored electronic messages at least in part by using program threads for detecting unwanted messages.

5. A method according to claim 4, wherein the unwanted electronic messages are detected at least in part by examining their content.

6. A method according to claim 5, wherein the examined content indicates that the unwanted electronic messages are spam.

7. A method according to claim 6, wherein the metadata comprises a count of the number of spam messages sent from a sending mail server.

8. A method according to claim 5, wherein the examined content indicates that the unwanted electronic messages are viruses.

9. A method according to claim 8, wherein the metadata comprises a count of the number of virus-bearing messages sent from a sending mail server.

10. A method according to claim 4, wherein the unwanted electronic messages are detected at least in part by examining their size.

11. A method according to claim 1, wherein the determining comprises detecting that the same or similar messages are being transmitted repeatedly.

12. A method according to claim 11, wherein it is detected that the same or similar messages are being transmitted repeatedly to the same intended recipient or group of intended recipients.

13. A method according to claim 12, wherein the detecting comprises detecting a pattern consistent with an email bomb attack.

14. A method according to claim 12, wherein the detecting comprises detecting a pattern consistent with a directory harvest attack.

15. A method according to claim 1, wherein the monitoring further comprises:

a) extracting information from the monitored electronic messages as they are transmitted across the electronic communications network, substantially without imposing a delay on the transmission of the electronic messages;

b) conditionally delivering electronic messages according to instructions from an interpreter process, the interpreter process communicating with a content-sensing application in logical communication with the interpreter process, such that if the content-sensing application analyzes the monitored electronic messages as likely unwanted by an intended recipient, then the method can, in coordination with the interpreter process and content-sensing application, configure the delivery of the unwanted electronic messages to route them to a message quarantine center.

16. A method according to claim 15, wherein actions of the interpreter process and configuration parameters corresponding to the actions of the interpreter process are logged to an interpreter process database and then later used for the determining that certain monitored electronic messages are likely to be unwanted based on patterns recognized in the traffic monitor.

17. A method according to claim 15, wherein the extracted information about the quarantined electronic messages is logged to an interpreter process database and then later used for the determining that certain monitored electronic messages are likely to be unwanted based on patterns recognized in the traffic monitor.

18. A method according to claim 1, wherein the metadata upon which the determining is based is generated from substantially all of the monitored electronic messages.

25. A method according to claim 6, wherein the metadata comprises a count of the number of virus-bearing messages sent from a sending mail server.

19. A method for detecting unwanted electronic messages at a certain location on an electronic communications network, the method comprising:

a) establishing a database for storing metadata associated with electronic message traffic according to at least source addresses of senders of electronic messages;

b) monitoring electronic message transmissions at the certain location on the electronic communications network;

c) extracting information from substantially all of the monitored electronic messages as they are transmitted across the electronic communications network, substantially without imposing a delay on the transmission of the electronic messages;

d) populating the database with metadata derived from analysis of the monitored electronic messages, the analysis performed at least in part by program threads for determining unwanted electronic messages, the metadata including metadata derived by analyzing the contents of the monitored electronic messages;

e) determining that certain monitored electronic messages are likely to be unwanted by an intended recipient based on an examination of the metadata associated with the source addresses of the senders of the monitored electronic messages and based on the analysis of the content of the monitored electronic messages, and at least in part without reference to a promulgated database of “

signatures”

of unwanted electronic messages;

f) conditionally delivering electronic messages according to instructions from an interpreter process, the interpreter process communicating with a content-sensing application in logical communication with the interpreter process, such that if the content-sensing application analyzes the monitored electronic messages as likely unwanted, then the method can, in coordination with the interpreter process and content-sensing application, configure the delivery of the unwanted electronic messages to route them to a message quarantine center.

20. A method according to claim 19, and further comprising establishing SMTP connections between the senders of electronic messages and at least certain mail servers of intended recipients of the electronic messages.

21. A method according to claim 20, wherein the monitoring of the electronic messages occurs as each of the SMTP connections between a sender and a certain mail server of an intended recipient of a monitored electronic message is processed.

22. A method according to claim 19, wherein the examined content indicates that the unwanted electronic messages are spam.

23. A method according to claim 22, wherein the metadata comprises a count of the number of spam messages sent from a sending mail server.

24. A method according to claim 19, wherein the examined content indicates that the unwanted electronic messages are viruses.

26. A method according to claim 19, wherein the unwanted electronic messages are detected at least in part by examining their size.

27. A method according to claim 19, wherein the determining comprises detecting that the same or similar messages are being transmitted repeatedly.

28. A method according to claim 27, wherein it is detected that the same or similar messages are being transmitted repeatedly to the same intended recipient or group of intended recipients.

29. A method according to claim 28, wherein the detecting comprises detecting a pattern consistent with an email bomb attack.

30. A method according to claim 28, wherein the detecting comprises detecting a pattern consistent with a directory harvest attack.

31. A method according to claim 19, wherein actions of the interpreter process and configuration parameters corresponding to the actions of the interpreter process are logged to an interpreter process database and then later used for the determining that certain received electronic messages are likely to be unwanted based on patterns recognized in the traffic monitor.

32. A method according to claim 19, wherein the extracted information is logged to an interpreter process database and then later used for the determining that certain monitored electronic messages are likely to be unwanted based on patterns recognized in the traffic monitor.

33. A system for use in detecting the transmission of unwanted electronic messages at a certain location on an electronic communications network, wherein the electronic messages are sent from sending mail servers to a receiving mail servers, the system comprising:

a) a system database for storing metadata associated with electronic message traffic according to at least source addresses of senders of electronic messages, and a system interface facilitating access to the system database;

b) a traffic monitor coupled to the system interface and operable to monitor electronic message transmissions at the certain location on the electronic communications network and to store source and destination data for the monitored electronic messages to the system database;

c) a message processing server coupled to the system interface and operable to analyze the monitored electronic messages and then to further populate the system database with the metadata derived from analysis of the monitored electronic messages, the metadata including metadata derived by analyzing the contents of the monitored electronic messages;

d) an interpreter process coupled to the system interface and operable to determine whether certain monitored electronic messages are likely to be unwanted by an intended recipient based on an examination of the metadata associated with the source addresses of the senders of the monitored electronic messages and based on the analysis of the content of the monitored electronic messages at the certain location, and at least in part without reference to a promulgated database of “

signatures”

of unwanted electronic messages.

34. A system according to claim 33, wherein SMTP connections are established between the senders of electronic messages and at least certain mail servers of intended recipients of the electronic messages.

35. A system according to claim 34, wherein the traffic monitor is operable to monitor the electronic messages as each of the SMTP connections between a sender and a certain mail server of an intended mail recipient is processed.

36. A system according to claim 35, wherein the message processing server is operable to derive metadata from the monitored electronic messages at least in part by using program threads for detecting unwanted electronic messages.

37. A system according to claim 36, wherein the message processing server is operable to detect unwanted electronic messages at least in part by examining their content.

38. A system according to claim 37, wherein the message processing server is operable to examine the message content and determine that the unwanted electronic messages are spam.

39. A system according to claim 38, wherein the message processing server is operable to derive metadata comprising a count of the number of spam messages sent from a sending mail server.

40. A system according to claim 37, wherein the message processing server is operable to examine the message content and determine that the unwanted electronic messages contain viruses.

41. A system according to claim 40, wherein the message processing server is operable to derive metadata comprising a count of the number of virus-bearing messages sent from a sending mail server.

42. A system according to claim 36, wherein the message processing server is operable to detect the unwanted electronic messages at least in part by examining their size.

43. A system according to claim 33, wherein the interpreter process is operable to determine that certain monitored electronic messages are likely to be unwanted by detecting that the same or similar messages are being transmitted repeatedly.

44. A system according to claim 43, wherein the interpreter process is operable to detect a pattern that the same or similar messages are being transmitted repeatedly to the same intended recipient or group of intended recipients.

45. A system according to claim 44, wherein the detected pattern is consistent with an email bomb attack.

46. A system according to claim 44, wherein the detected pattern is consistent with a directory harvest attack.

47. A system according to claim 33, wherein the message processing server extracts information from the monitored electronic messages as they are transmitted across the electronic communications network, substantially without imposing a delay on the transmission of the electronic messages.

48. A system according to claim 47, wherein the system is operable to conditionally deliver messages according to instructions from the interpreter process, the interpreter process communicating with a content-sensing application in logical communication with the interpreter process, such that if the content-sensing application analyzes the monitored electronic messages as likely unwanted, then the system can, in coordination with the interpreter process and content-sensing application, configure the delivery of the unwanted electronic messages to route them to a message quarantine center.

49. A system according to claim 48, wherein an interpreter process interface coupled to an interpreter process database is configured to facilitate access to the interpreter process database.

50. A system according to claim 49, wherein the interpreter process is operable to log its actions to the interpreter process database and to store configuration parameters for applying message processing actions and then to later use the contents of the interpreter process database for the determining that certain monitored electronic messages are likely to be unwanted based on patterns recognized in the traffic monitor.

51. A system according to claim 49, wherein the interpreter process is operable to log the information about the quarantined electronic messages to the interpreter process database and then to later use the contents of the interpreter process database for the determining that certain monitored electronic messages are likely to be unwanted based on patterns recognized in the traffic monitor.

52. A system according to claim 49, wherein an administrative console coupled to the interpreter process interface facilitates the review of actions taken by the interpreter process such that the system is then configured with regard to the actions to be taken in certain message monitoring circumstances.

53. A system according to claim 33, wherein the metadata upon which the determining is based is generated from substantially all of the monitored electronic messages.

54. A system according to claim 33, wherein the system includes multiple message processing servers coupled to the system interface, the multiple message processing servers operable to analyze the plurality of monitored electronic messages and then to further populate the system database with the metadata derived from analysis of the monitored electronic messages, the metadata including metadata derived by analyzing the contents of the monitored electronic messages.

55. A system for use in detecting the transmission of unwanted electronic messages at a certain location on an electronic communications network, wherein the messages are sent from sending mail servers to receiving mail servers, the system comprising:

a) a system database for storing metadata associated with interpreter process message traffic according to at least source addresses of senders of electronic messages, and a system interface facilitating access to the system database;

b) a traffic monitor coupled to the system interface and operable to monitor electronic message transmissions at the certain location on the electronic communications network and to store source and destination data for the monitored electronic messages to the system database;

c) a message processing server coupled to the system interface and operable to analyze the monitored electronic messages, extracting information from the monitored electronic messages as they are transmitted across the electronic communications network, substantially without imposing a delay on the transmission of the electronic messages, and then to further populate the system database with the metadata derived from analysis of the monitored electronic messages, the metadata including metadata derived by analyzing the contents of the monitored electronic messages;

d) an interpreter process coupled to the system interface and operable to determine whether certain monitored electronic messages are likely to be unwanted by an intend ed recipient based on an examination of the metadata associated with the source addresses of the senders of the monitored electronic messages and based on the analysis of the content of the monitored electronic messages at the certain location, and at least in part without reference to a promulgated database of “

signatures”

of unwanted electronic messages;

e) a content-sensing application in logical communication with the interpreter process, wherein the content-sensing application is operable to analyze the contents of the monitored electronic messages; and

f) an interpreter process database for storing the actions of the interpreter process and configuration parameters for applying message processing actions, and an interpreter process interface coupled to the interpreter process and facilitating access to the interpreter process database.

56. A system according to claim 55, wherein SMTP connections are established between the senders of electronic messages and at least certain mail servers of intended recipients of the electronic messages.

57. A system according to claim 56, wherein the traffic monitor is operable to monitor the electronic messages as each of the SMTP connections between a sender and a certain mail server of an intended recipient is processed.

58. A system according to claim 57, wherein the message processing server is operable to derive metadata from the monitored electronic messages at least in part by using program threads for detecting unwanted electronic messages.

59. A system according to claim 58, wherein the message processing server is operable to detect unwanted electronic messages at least in part by examining their content.

60. A system according to claim 59, wherein the message processing server is operable to examine the message content and determine that the unwanted electronic messages are spam.

61. A system according to claim 60, wherein the message processing server is operable to derive metadata comprising a count of the number of spam messages sent from a sending mail server.

62. A system according to claim 59, wherein the message processing server is operable to examine the message content and determine that the unwanted electronic messages contain viruses.

63. A system according to claim 62, wherein the message processing server is operable to derive metadata comprising a count of the number of virus-bearing messages sent from a sending mail server.

64. A system according to claim 58, wherein the message processing server is operable to detect the unwanted electronic messages at least in part by examining their size.

65. A system according to claim 55, wherein the interpreter process is operable to determine that certain monitored electronic messages are likely to be unwanted by detecting that the same or similar messages are being transmitted repeatedly.

66. A system according to claim 65, wherein the interpreter process is operable to detect a pattern that the same or similar messages are being transmitted repeatedly to the same intended recipient or group of intended recipients.

67. A system according to claim 66, wherein the detected pattern is consistent with an email bomb attack.

68. A system according to claim 66, wherein the detected pattern is consistent with a directory harvest attack.

69. A system according to claim 55, wherein the system is operable to conditionally deliver electronic messages according to instructions from the interpreter process, the interpreter process in logical communications with the content-sensing application such that if the content-sensing application analyzes the monitored electronic messages as likely unwanted, then the system can, in coordination with the interpreter process and content-sensing application, configure the delivery of the unwanted electronic messages to route them to a message quarantine center.

70. A system according to claim 69, wherein the interpreter process is operable to log the information about the unwanted electronic messages to the interpreter process database.

71. A system according to claim 70, wherein the interpreter process is operable to use the contents of the interpreter process database for the determining that certain monitored electronic messages are likely to be unwanted based on patterns recognized in the traffic monitor.

72. A system according to claim 55, wherein an administrative console coupled to the interpreter process interface facilitates the review of actions taken by the interpreter process such that the system is then configured with regard to the actions to be taken in certain message monitoring circumstances.

73. A system according to claim 55, wherein the metadata upon which the determining is based is generated from substantially all of the monitored electronic messages.

74. A system according to claim 55, wherein the system includes multiple message processing servers coupled to the system interface, the multiple message processing servers operable to analyze the monitored electronic messages and then to further populate the system database with the metadata derived from analysis of the monitored electronic messages, the metadata including metadata derived by analyzing the contents of the monitored electronic messages.