Just-In-Time, Email Embedded URL Reputation Determination

• US 20170005961A1
• Filed: 09/16/2016
• Published: 01/05/2017
• Est. Priority Date: 12/20/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Liebmann, Nicholas, Stecher, Martin, Gartside, Paul, Bishop, Mike, Hunt, Simon
• Granted Patent: US 9,929,991 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/18 Commands or executable codes
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system allows just-in-time checking of information about an email in which a hyperlink is embedded. Upon receipt of the email containing the hyperlink, the resource locator of the hyperlink is modified to allow checking the reputation of the email upon traversal of the hyperlink. At traversal of the hyperlink, the current reputation of the resource locator and the current reputation of the email are both determined, and one or more actions are performed responsive to the determination.

Claims

1. A program storage device, on which is stored for determining whether to allow traversal of a hyperlink embedded in an email, comprising instructions for causing one or more processors to:

receive an email;

create a message identifier for the email;

generate meta-information corresponding to the email;

store the meta-information in a database, keyed by the message identifier;

encrypt the message identifier; and

modify a resource locator of a hyperlink contained in the email to include the encrypted message identifier.

2. The program storage device of claim 1, wherein the meta-information comprises:

a data signature;

header data of the email; and

envelope data of the email.

3. The program storage device of claim 1, wherein the instructions for causing one or more processors to modify the resource locator comprise instructions for causing one or more processors to:

encode the message identifier into the resource locator.

4. The program storage device of claim 3, wherein the instructions for causing one or more processors to encode the message identifier into the resource locator comprise instructions for causing one or more processors to:

encode additional information into the resource locator.

5. The program storage device of claim 1, wherein the instructions for causing one or more processors to modify the resource locator comprise instructions for causing one or more processors to:

replace the resource locator with a different resource locator.

6. The program storage device of claim 1, wherein the instructions for causing one or more processors to modify the resource locator comprise instructions for causing one or more processors to:

encode information regarding a context of the email into the resource locator.

7. A system for determining whether to allow traversal of a hyperlink embedded in an email, comprising:

a web gateway; and

an email gateway,

wherein the web gateway comprises;

a processor;

a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to;

receive a request to make a connection to a location specified by a resource locator of a hyperlink embedded in an email;

determine an identity of the email based on the resource locator;

determine a current reputation of the email; and

determine a current reputation of the resource locator; and

perform an action responsive to a reputation of the resource locator and the email.

wherein the email gateway comprises;

a processor;

a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to;

receive the email; and

modify the resource locator in the email to identify the email.

8. The system of claim 7, wherein the software of the email gateway further comprises instructions for causing the processor to:

'"'"'

cache information corresponding to the email;

receive the request from the web gateway;

extract information about the email from the cached information based on information in the request;

obtain reputation information for the email; and

send the reputation information to the web gateway.

9. The system of claim 7,

wherein the software of the web gateway further comprises instructions for causing the processor to:

determine that the resource locator comprises information associated with a context of the email,

wherein the instructions for causing the processor to request reputation information comprise instructions for causing the processor to;

include the information associated with the context of the email in the request.

10. The system of claim 7,

wherein the software of the email gateway further comprises instructions for causing the processor to:

deliver the email containing the modified resource locator.

11. The system of claim 7, wherein the instructions for causing the processor to modify the resource locator comprise instructions for causing the processor to:

generate a message identifier for the email; and

modify the email by encoding the message identifier into the resource locator in the email.

12. The system of claim 7, wherein the software of the email gateway further comprises instructions for causing the processor to:

obtain an initial reputation of the email upon receipt of the email; and

perform an action responsive to the initial reputation.

13. The system of claim 7, further comprising:

a redirection server, comprising;

a processor; and

a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to;

receive information associating the modified resource locator with the resource locator in the email;

receive a connection corresponding to the resource locator;

request a reputation of the email and the resource locator in the email; and

redirect the connection to a destination specified in the resource locator in the email,

wherein the instructions for causing the processor to modify the resource locator comprise instructions for causing the processor to;

replace the resource locator in the email with a resource locator pointing to the redirection server.

14. A method for determining whether to allow traversal of a hyperlink embedded in an email, comprising:

receiving an email, comprising;

determining an initial reputation of the email; and

modifying a first resource locator of a hyperlink embedded in the email to identify the email; and

receiving a request to traverse the first resource locator, comprising;

determining a current reputation of the first resource locator;

analyzing the first resource locator to identify the email in which the hyperlink was embedded;

determining a current reputation of the email; and

performing an action responsive to the reputation of the first resource locator and the current reputation of the email.

15. The method of claim 14, wherein modifying a first resource locator comprises:

replacing the resource locator with a second resource locator; and

associating the first resource locator with the second resource locator.

16. The method of claim 15, wherein receiving a request to traverse the first resource locator further comprises:

receiving a request by a redirection service to traverse the second resource locator; and

determine the first resource locator associated with the second resource locator.

17. The method of claim 14,

wherein receiving an email further comprises:

storing meta-information about the email; and

associating the meta-information with a message identification data, and wherein modifying a first resource locator comprises;

encoding the message identification data into the first resource locator.

18. The method of claim 17, wherein the meta-information comprises:

a data signature;

header data of the email; and

envelope data of the email.

19. The method of claim 14, wherein modifying a first resource locator of a hyperlink embedded in the email to identify the email comprises:

encoding information regarding a context of the email into the resource locator.

20. The method of claim 14, wherein modifying a first resource locator of a hyperlink embedded in the email to identify the email comprises:

replacing the resource locator with a difference resource locator.