REPUTATION-BASED METHOD AND SYSTEM FOR DETERMINING A LIKELIHOOD THAT A MESSAGE IS UNDESIRED

• US 20080104180A1
• Filed: 10/31/2006
• Published: 05/01/2008
• Est. Priority Date: 10/31/2006
• Status: Active Grant

• Current Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Original Assignee: Borderware Technologies Incorporated (Gladiator Corporation)
• Inventors: Gabe, Christopher John
• Granted Patent: US 8,527,592 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system and method for providing a reputation service for use in messaging environments employs a reputation of compiled statistics, representing whether SPAM messages have previously been received from respective a selected set of identifiers for the origin of the message, in a decision making process for newly received messages. In a preferred embodiment, the set of identifiers includes the IP address, a tuple of the domain and IP address and a tuple of the user and IP address and the set of identifiers allows for a relatively fine grained set of reputation metrics to be compiled and used when making a determination of a likelihood as to whether a received message is undesired in accordance with the invention.

Claims

1. A method of determining a likelihood that a received message is an undesired message, comprising the steps of:

(i) receiving a message at a messaging system;

(ii) forwarding to a reputation engine a pre-selected set of identifiers relating to the origin of the message, at least one of the identifiers being in the form of a tuple, one half of which represents data which cannot be faked by the originator of the received message;

(iii) checking databases at the reputation engine to determine previously determined reputation metrics for the forwarded identifiers and returning any previously determined reputation metrics to the messaging system;

(iv) making a first determination at the messaging system of a likelihood as to whether the received message is undesired using a first set of criteria including the returned reputation metrics; and

(v) marking the message as being either desired or undesired in accordance with the first determination.

2. The method according to claim 1 further comprising the steps of:

(vi) making a second determination at the messaging system of a likelihood as to whether the received message is undesired without using any returned reputation metrics; and

(vii) forwarding the second determination to the reputation engine to update the databases and the respective reputation metrics to include the second determination.

3. The method of claim 1 wherein the one half of the tuple which cannot be faked is the IP address of the originator of the message.

4. The method of claim 3 wherein the pre-selected set of identifiers includes the IP address from which the received message originated;

the domain at which the received message allegedly originated; and

the user who allegedly originated the message.

5. The method of claim 3 where step (iii) also comprises forwarding to the messaging system a spoof metric representing whether the reputation engine has previously received identifiers indicating that one or more previously received messages from the domain at which the received message allegedly originated have been received from the IP address at which the received message originated and where the first determination also employs the spoof metric.

6. The method of claim 3 wherein the messaging system is an email messaging system.

7. The method of claim 3 wherein the messaging system is a SIP-based voice communication system.

8. The method of claim 4 wherein the identifiers for the domain at which the received message allegedly originated and the user who allegedly originated the message are created from the domain and user information by a one-way function.

9. A messaging environment employing a reputation service in determining a likelihood as to whether received messages are undesired, comprising:

a plurality of message servers interconnected by a communications network, at least one of the plurality of message servers including an anti-SPAM function to determine a likelihood as to whether received messages are undesired;

a plurality of message clients connected to respective ones of the plurality of message servers and operable to receive messages therefrom;

and a reputation engine operable to communicate with the at least one message server, the reputation engine maintaining a set of databases associating a reputation metric with each of a pre-selected set of identifiers relating to the origins of the messages, at least one of the identifiers being in the form of a tuple, one half of which cannot be faked by the originator of the received message, the anti-SPAM function operating to forward the pre-selected set of identifiers to the reputation engine which returns the reputation metrics stored in its databases for any of the identifiers and the anti-SPAM function using the returned reputation metrics to make a first determination of a likelihood as to whether a received message is undesired.

10. A messaging environment according to claim 9 wherein the anti-SPAM function also makes a second determination of a likelihood as to whether a received message is undesired, the second determination being made independent of the returned reputation metrics, and forwarding that second determination to the reputation engine to appropriately update the reputation metrics stored at the reputation engine to reflect the second determination.

11. A messaging environment according to claim 9 wherein the pre-selected set of identifiers includes the IP address from which the message was received, the domain from which the message was allegedly sent and the user who allegedly sent the message.

12. A messaging environment according to claim 9 wherein at least some of the identifiers are created from message information by a one-way function.

13. A messaging environment according to claim 9 wherein the messaging system is an email system.