PROCESSING A MESSAGE BASED ON A BOUNDARY IP ADDRESS AND DECAY VARIABLE

• US 20150341264A1
• Filed: 08/03/2015
• Published: 11/26/2015
• Est. Priority Date: 02/10/2004
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Oliver, Jonathan J., Koblas, David A.
• Granted Patent: US 9,860,167 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/40 using split connections
• CPC Class Codes: H04L 49/15 Interconnection of switching modules
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A technique for determining a boundary IP address is disclosed. The technique includes processing a header to extract candidate IP address, locating a gateway IP address, and selecting the boundary IP address based on the location of the gateway IP address.

Claims

1. A method of classifying a message transmitted over a network, the method comprising:

receiving the message transmitted over the network and addressed to a recipient; and

executing instructions stored in a non-transitory computer readable storage medium to;

determine an associated domain from which the received message is purported to be sent,

identify that the determined domain appears on a whitelist associated with the recipient,

determine whether the domain has been spoofed based on whether a common classification appears across a plurality of IP addresses associated with the domain, wherein;

the domain is determined not to be spoofed if the received message is on the whitelist but has the common spam classification appearing across the plurality of IP addresses, and

the domain is determined to be spoofed if the received message is on the whitelist but has different classifications appearing across the plurality of IP addresses, and

classify the received message based on the determination whether the domain has been spoofed.

2. The method of claim 1, wherein determining the associated domain from which the received message is purported to be sent includes identifying a stated sender domain associated with the received message.

3. The method of claim 1, wherein classifying the received message comprises assigning a score to the received message based on the determination whether the domain has been spoofed.

4. The method of claim 3, wherein assigning the score is further based on one or more classification variables.

5. The method of claim 4, further comprising weighting the classification variables based on a source of the classification.

6. The method of claim 4, further comprising decaying the classification variables over time.

7. The method of claim 3, wherein assigning the score comprises determining a spam ratio.

8. The method of claim 3, wherein assigning the score includes determining a spam rate.

9. The method of claim 3, wherein assigning the score includes determining an estimated instantaneous spam rate.

10. A system of classifying a message transmitted over a network, the system comprising:

a communication interface that receives the message transmitted over the network and addressed to a recipient; and

a processor that executes instructions stored in a non-transitory computer readable storage medium to;

determine an associated domain from which the received message is purported to be sent,

identify that the determined domain appears on a whitelist associated with the recipient,

determine whether the domain has been spoofed based on whether a common classification appears across a plurality of IP addresses associated with the domain, wherein;

the domain is determined not to be spoofed if the received message is on the whitelist but has the common spam classification appearing across the plurality of IP addresses, and

the domain is determined to be spoofed if the received message is on the whitelist but has different classifications appearing across the plurality of IP addresses, and

classify the received message based on the determination whether the domain has been spoofed.

11. The system of claim 10, wherein the processor determines the associated domain from which the received message is purported to be sent by identifying a stated sender domain associated with the received message.

12. The system of claim 10, wherein the processor classifies the received message by assigning a score to the received message based on the determination whether the domain has been spoofed.

13. The system of claim 12, wherein assigning the score is further based on one or more classification variables.

14. The system of claim 13, further comprising weighting the classification variables based on a source of the classification.

15. The system of claim 13, further comprising decaying the classification variables over time.

16. The system of claim 12, wherein assigning the score comprises determining a spam ratio.

17. The system of claim 12, wherein assigning the score includes determining a spam rate.

18. The system of claim 12, wherein assigning the score includes determining an estimated instantaneous spam rate.

19. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for classifying a message transmitted over a network, the method comprising:

receiving the message transmitted over the network and addressed to a recipient;

determining an associated domain from which the received message is purported to be sent;

identifying that the determined domain appears on a whitelist associated with the recipient;

determining whether the domain has been spoofed based on whether a common classification appears across a plurality of IP addresses associated with the domain, wherein;

the domain is determined not to be spoofed if the received message is on the whitelist but has the common spam classification appearing across the plurality of IP addresses, and

the domain is determined to be spoofed if the received message is on the whitelist but has different classifications appearing across the plurality of IP addresses; and

classifying the received message based on the determination whether the domain has been spoofed.