REPUTATION-BASED METHOD AND SYSTEM FOR DETERMINING A LIKELIHOOD THAT A MESSAGE IS UNDESIRED

• US 20130347108A1
• Filed: 08/30/2013
• Published: 12/26/2013
• Est. Priority Date: 10/31/2006
• Status: Active Grant

• Current Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Original Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Inventors: Gabe, Christopher John
• Granted Patent: US 10,193,898 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system and method for providing a reputation service for use in messaging environments employs a reputation of compiled statistics, representing whether SPAM messages have previously been received from respective a selected set of identifiers for the origin of the message, in a decision making process for newly received messages. In a preferred embodiment, the set of identifiers includes the IP address, a tuple of the domain and IP address and a tuple of the user and IP address and the set of identifiers allows for a relatively fine grained set of reputation metrics to be compiled and used when making a determination of a likelihood as to whether a received message is undesired in accordance with the invention.

Claims

1-13. -13. (canceled)

14. A system, comprising:

a security appliance configured to calculate a value indicative of a likelihood that a message received at a messaging server is undesired by use of two or more reputation metrics received from a reputation engine;

wherein the reputation engine is configured to determine the two or more reputation metrics in response to a plurality of tuples comprising a pre-selected set of identifiers relating to an origin of the message, wherein the tuples comprise respective identifiers deemed difficult to fake, and wherein the tuples correspond to a different respective granularity of identification of the origin of the message; and

wherein the security appliance is configured to calculate the value by overriding a first one of the two or more reputation metrics with a second one of the two or more reputation metrics in response to the tuple of the second reputation metric being associated with a more finely grained identification of the origin of the received message than the tuple of the first reputation metric.

15. The system of claim 14, wherein the security appliance is configured to provide a second value indicative of a likelihood that the received message is undesired without use of the two or more reputation metrics to the reputation engine for use in updating the two or more reputation metrics.

16. The system of claim 14, wherein the identifier deemed difficult to fake in one of the plurality of tuples is one of:

at least a portion of an Internet Protocol address, a domain, and a user identifier.

17. The system of claim 14, wherein the security appliance is configured to receive a spoof metric corresponding to one of the two or more reputation metrics, and to calculate the value by use of the received spoof metric.

18. The system of claim 14, wherein the messaging server is one of:

a Session Initiation Protocol server, and an email server.

19. The system of claim 14, wherein a reputation metric associated with a tuple assigned a higher granularity contributes to the value more than a reputation metric associated with a tuple assigned a lower granularity.

20. An apparatus, comprising:

a reputation engine operating on a computing device and configured to identify two or more reputation metrics in a database in response to receiving a plurality of tuples from a message server, the tuples comprising a respective combination of identifiers relating to an originator of a message received at the message server deemed difficult to fake; and

wherein the reputation engine is configured to associate each of the two or more reputation metrics with a respective granularity of identification of the originator of the received message, and to provide the two of more reputation metrics to a security appliance configured to calculate a value indicative of a likelihood that the received message is undesired using the two or more reputation metrics, the value comprising a contribution of each of the two or more reputation metrics based on the granularity of identification associated with the tuples corresponding to the respective reputation metrics.

21. The apparatus of claim 20, wherein the reputation engine is configured to update the two or more reputation metrics by use of another value indicative of a likelihood that the received message is undesired calculated independently of the two or more reputation metrics.

22. The apparatus of claim 20, wherein the reputation engine is configured to assign a tuple comprising a combination of a user identifier and an Internet Protocol address a higher granularity than a tuple comprising a combination of a domain name and an Internet Protocol address.

23. The apparatus of claim 20, wherein the reputation engine is configured to determine a reputation metric of a tuple based on a total of received messages corresponding to the tuple and a total of received messages corresponding to the tuple that have been identified as undesired.

24. The apparatus of claim 20, wherein the reputation engine is configured to determine a spoof metric corresponding to one of the two or more reputation metrics, and to provide the spoof metric to the security appliance for use in calculating the value.

25. A computer program product comprising a computer-readable storage medium storing program code executable to perform operations, comprising:

determining a plurality of tuples at a security appliance, the tuples comprising respective identifiers deemed difficult to fake pertaining to an origin of a message received at a server,

receiving two or more reputation metrics at the security appliance, each reputation metric corresponding a respective one of the tuples and having a different respective granularity of identification of the origin of the message; and

calculating, at the security appliance, a value indicative of a likelihood that the message is undesired using the two or more reputation metrics, wherein calculating the value comprises overriding a first one of the two or more reputation metrics with a second one of the two or more reputation metrics in response to the tuple of the second reputation metric being associated with a more finely grained identification of the origin of the received message than the tuple of the first reputation metric.

26. The computer program product of claim 25, wherein the operations further comprise:

calculating a second value indicative of a likelihood that the received message is undesired without use of the two or more reputation metrics; and

providing the second value to a reputation engine for use in updating the two or more reputation metrics.

27. The computer program product of claim 25, wherein one of the tuples corresponds to one of an Internet Protocol address from which the message was received, a domain from which the message was sent, and a sender of the message.

28. The computer program product of claim 25, wherein the server comprises one of an email server and a Session Initiation Protocol server.

29. The computer program product of claim 25, wherein a reputation metric associated with a tuple assigned a higher granularity contributes to the value more than a reputation metric associated with a tuple assigned a lower granularity.

30. The computer program product of claim 25, wherein a tuple comprising a combination of a user identifier and an Internet Protocol address is assigned a higher granularity than a tuple comprising a combination of a domain name and an Internet Protocol address.

31. The computer program product of claim 25, the operations further comprising creating a set of identifiers corresponding to the origin of the message, wherein the tuples are determined by use of the set of identifiers.

32. The computer program product of claim 25, wherein the value indicative of a likelihood that the message is undesired is based on a spoof metric of one of more of the reputation metrics.

33. The computer program product of claim 25, one of the plurality of tuples comprises domain name and Internet Protocol address identifiers, and wherein the spoof metric is based on whether messages have previously been received from the identified domain name and Internet Protocol address.