STOPPING AND REMEDIATING OUTBOUND MESSAGING ABUSE

• US 20130117397A1
• Filed: 12/25/2012
• Published: 05/09/2013
• Est. Priority Date: 02/28/2005
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Chasin, C. Scott, Lin, Wei, Kincaid-Smith, Paul
• Granted Patent: US 9,210,111 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Systems and methods are provided for allowing subscriber message sending profiles to be maintained and used in conjunction with behavior-based anomaly detection techniques and traditional content-based spam signature filtering to enable application of appropriate message disposition policies to outbound subscriber message traffic. According to one embodiment, subscriber profiles are constructed for multiple subscriber accounts associated with a service provider based on outbound message flow originated from the subscriber accounts. Then, possible subscriber account misuse may be discovered by performing behavior-based anomaly detection, including a comparison of a subscriber profile associated with the subscriber account with recent subscriber account usage information, to identify one or more behavioral anomalies in outbound message flow originated from a subscriber account, the behavior-based anomaly detection.

Claims

1-5. -5. (canceled)

6. A method, comprising:

modeling a subscriber account to construct a subscriber profile; and

detecting, at a gateway that includes a processor and a memory, a deviation from the subscriber profile based, at least in part, on outbound e-mail message flow.

7. The method of claim 6, wherein the subscriber profile is based, at least in part, on behavior data extracted from e-mail messages originated via the subscriber account.

8. The method of claim 6, wherein a reputation score of subscriber trustworthiness is included in the subscriber profile and is based on reputation data associated with e-mailing activities via the subscriber account.

9. The method of claim 6, wherein subscriber reputation data associated with the subscriber account is used to determine an immediate e-mail action for a current e-mail message sought to be communicated in a network.

10. The method of claim 6, wherein subscriber reputation data associated with the subscriber account is used to determine a long-term subscriber action for subsequent e-mail messages originated via the subscriber account.

11. The method of claim 6, wherein reputation data generated from a single e-mail message is used to determine a message disposition for that single e-mail message.

12. The method of claim 6, wherein reputation data generated from a single e-mail message is combined with long-term reputation data included in the subscriber profile to determine whether actions are to be taken for the subscriber account.

13. The method of claim 12, wherein the actions include a selected one of a group of actions, the group consisting of:

a) redirecting subsequent e-mail messages originated via the subscriber account to a relay pool;

b) reducing at least one privilege associated with the subscriber account; and

c) lowering a trustworthiness rating for the subscriber account.

14. The method of claim 6, wherein a plurality of content filters are provided for outbound traffic associated with a plurality of subscriber accounts.

15. The method of claim 14, wherein the plurality of content filters include a selected one of a group of filters, the group consisting of:

a) a spam filter;

b) a virus filter;

c) a throttle filter; and

d) a phishing filter.

16. The method of claim 6, further comprising:

providing web-based access to a plurality of e-mail message disposition policies via a graphical user interface.

17. The method of claim 16, wherein the graphical user interface is configured to provide notifications, alerts, and traffic reports associated with e-mail traffic.

18. The method of claim 6, wherein the presence of antivirus software installed on a computer positively affects reputation data associated with the subscriber profile.

19. The method of claim 6, further comprising:

maintaining subscriber profile data by tracking, aggregating, and applying statistical analysis to subscriber behavior attributes.

20. The method of claim 19, wherein the subscriber behavior attributes are extracted from Simple Mail Transfer Protocol (SMTP) data.

21. The method of claim 6, further comprising:

extracting behavior attributes from outbound message traffic originated by a plurality of authenticated subscribers in a network;

updating message sending behavior profiles based on the outbound message traffic; and

storing the message sending behavior profiles in a database.

22. A gateway, comprising:

a processor; and

a memory coupled to the memory, wherein the gateway is configured to;

model a subscriber account to construct a subscriber profile; and

detect a deviation from the subscriber profile based, at least in part, on outbound e-mail message flow.

23. The gateway of claim 22, wherein the subscriber profile is based, at least in part, on behavior data extracted from e-mail messages originated via the subscriber account, and wherein a reputation score of subscriber trustworthiness is included in the subscriber profile and is based on reputation data associated with e-mailing activities via the subscriber account.

24. The gateway of claim 22, wherein subscriber reputation data associated with the subscriber account is used to determine a long-term subscriber action for subsequent e-mail messages originated via the subscriber account.

25. Logic encoded in non-transitory media that includes instructions for execution and when executed by a processor, is operable to perform operations, comprising:

modeling a subscriber account to construct a subscriber profile; and

detecting a deviation from the subscriber profile based, at least in part, on outbound e-mail message flow, wherein the subscriber profile is based, at least in part, on behavior data extracted from e-mail messages originated via the subscriber account, and wherein a reputation score of subscriber trustworthiness is included in the subscriber profile and is based on reputation data associated with e-mailing activities via the subscriber account.