USE OF GLOBAL INTELLIGENCE TO MAKE LOCAL INFORMATION CLASSIFICATION DECISIONS

• US 20090064323A1
• Filed: 08/30/2007
• Published: 03/05/2009
• Est. Priority Date: 08/30/2007
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Lin, Kunhua
• Granted Patent: US 8,103,727 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

Methods and systems are provided for delaying local information classification until global intelligence has an opportunity to be gathered. According to one embodiment, an initial information identification process, e.g., an initial spam detection, is performed on received electronic information, e.g., an e-mail message. Based on the initial information identification process, classification of the received electronic information is attempted. If the received electronic information cannot be unambiguously classified as being within one of a set of predetermined categories (e.g., spam or clean), then an opportunity is provided for global intelligence to be gathered regarding the received electronic information by queuing the received electronic information for re-evaluation. The electronic information is subsequently classified by performing a re-evaluation information identification process, e.g., re-evaluation spam detection, which provides a more accurate categorization result than the initial information identification process. Handling the electronic information in accordance with a policy associated with the categorization result.

Claims

1. A method comprising:

performing an initial information identification process on received electronic information;

attempting to classify the received electronic information into one of a plurality of categories based on the initial information identification process;

if the received electronic information cannot be unambiguously classified as being within one of the plurality of categories in real-time based on the initial information identification process, then providing an opportunity for global intelligence to be gathered regarding the received electronic information by queuing the received electronic information for a re-evaluation information identification process;

classifying the queued electronic information by performing the re-evaluation information identification process, the re-evaluation information identification process providing a more accurate categorization result than the initial information identification process; and

handling the queued electronic information in accordance with a policy associated with the categorization result.

2. The method of claim 1, wherein:

the received electronic information comprises an electronic mail (e-mail) message;

the initial information identification process comprises an initial spam detection;

the plurality of categories include clean and spam;

said providing an opportunity for global intelligence to be gathered regarding the received electronic information further comprises providing an opportunity for global intelligence to be gathered regarding the e-mail message or e-mail messages having similar attributes by queuing the e-mail message for a re-evaluation spam detection;

said handling the queued electronic information in accordance with a policy associated with the categorization result further comprises

if the e-mail message is classified as clean by the re-evaluation spam detection, then delivering the e-mail message to a destination specified within the e-mail message; and

if the e-mail message is classified as spam by the re-evaluation spam detection, then handling the e-mail message in accordance with an e-mail security policy for spam.

3. The method of claim 2, wherein the initial spam detection comprises performing content analysis.

4. The method of claim 2, wherein the initial spam detection comprises performing reputation analysis.

5. The method of claim 3, wherein said content analysis comprises:

evaluating a signature reputation associated with the e-mail message by forming a signature of the e-mail message based on attributes extracted from the e-mail message and querying a reputation server that maintains and updates signature reputation information based on direct or indirect observations and analysis of queries from a network of a plurality of participating anti-spam engines to a global intelligence network; and

applying heuristic rules to the e-mail message.

6. The method of claim 2, wherein the initial spam detection is performed by a first anti-spam engine of a first device.

7. The method of claim 6, wherein the first device comprises an e-mail server.

8. The method of claim 6, wherein the first device comprises a network gateway.

9. The method of claim 6, wherein the re-evaluation spam detection is performed by the first device.

10. The method of claim 6, wherein the re-evaluation spam detection is performed by a second anti-spam engine of a second device.

11. The method of claim 8, wherein the second device comprises an email server.

12. The method of claim 8, wherein the second device comprises a client workstation.

13. The method of claim 3, further comprising checking a reputation of a sender of the e-mail message prior to performing said content analysis.

14. The method of claim 13, wherein said checking a reputation of a sender of the e-mail message comprises retrieving sender reputation information associated with the sender from a reputation server.

15. The method of claim 6, wherein the e-mail message is transferred to the first device by way of Simple Mail Transfer Protocol (SMTP).

16. The method of claim 6, wherein the e-mail message is transferred to the first device by way of Post Office Protocol version 3 (POP3).

17. The method of claim 6, wherein the e-mail message is transferred to the first device by way of Internet Message Access Protocol (IMAP).

18. The method of claim 5, wherein said performing the re-evaluation spam detection is triggered responsive to a re-evaluation event.

19. The method of claim 18, wherein the re-evaluation event comprises one or more of:

existence of updated signature reputation information within the global intelligence network;

existence of updated sender reputation information within the global intelligence network;

availability of updated heuristic rules;

passing of a predetermined amount of time since the initial content analysis was performed; and

expiration of an interval timer.

20-41. -41. (canceled)