IDENTIFYING USER BEHAVIOR IN A DISTRIBUTED COMPUTING SYSTEM

• US 20170244747A1
• Filed: 02/24/2016
• Published: 08/24/2017
• Est. Priority Date: 02/24/2016
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Moreau-Cook, Aaron J., Trim, Samuel Terrence, Xu, Yuxiang, John, Aby
• Granted Patent: US 10,104,117 B2
• Time in Patent Office: Days
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A list of electronic mail (e-mail) accounts is extracted from an electronic mail system. A list of electronic mail accounts, with forwarding enabled, are identified as a set of collection accounts. A dropbox account is identified, from the collection accounts, as a destination e-mail account for the forwarded collection accounts. The collection accounts that forward to the dropbox account that has in excess of a threshold number of collection accounts forwarding to it, are identified as malicious e-mail collection accounts and are forwarded to a resolution system, for resolution.

Claims

1. A computing system, comprising:

dropbox account identification logic that obtains electronic mail (e-mail) data indicative of a set of forwarding e-mail accounts, that are configured to forward messages to another e-mail account and identifies a dropbox e-mail account as an account that is a destination of forwarded messages from a threshold number of the forwarding e-mail accounts;

malicious collection account identifying logic that is configured to identify malicious collection e-mail accounts, based on the e-mail data identifying a subset of the forwarding e-mail accounts that forward messages to the identified dropbox e-mail account, and generate a malicious collection account identifier identifying the malicious collection e-mail accounts; and

a resolution system that receives the malicious collection account identifier and performs a resolution action to resolve the malicious collection e-mail accounts based on the malicious collection account identifier.

2. The computing system of claim 1 and further comprising:

collection account identifying logic that accesses the e-mail data in a user account data store and identifies the set of forwarding e-mail accounts, as a set of collection accounts, based on the accessed data.

3. The computing system of claim 2 wherein the collection account identifying logic accesses forwarding status information associated with e-mail accounts identified in the e-mail data to identify the set of forwarding e-mail accounts.

4. The computing system of claim 2 and further comprising:

boundary identifying logic that is configured to identify a boundary in the user account data store that stores the e-mail data, the boundary delineating e-mail data in the user account data store that is accessed by the collection account identifying logic in identifying the set of collection accounts.

5. The computing system of claim 3 and further comprising:

threshold setting logic that is configured to identify a dropbox forwarding account threshold indicative of the threshold number of forwarding e-mail accounts.

6. The computing system of claim 5 wherein the threshold setting logic is configured to identify the dropbox forwarding account threshold based on a ratio of a number of e-mail accounts in the set of forwarding e-mail accounts to a number of dropbox e-mail accounts identified in the boundary.

7. The computing system of claim 6 wherein the threshold setting logic is configured to identify the dropbox forwarding account threshold based on a ratio of a total number of e-mail accounts in the boundary to a total number of forwarding e-mail accounts in the boundary.

8. The computing system of claim 7 wherein the threshold setting logic is configured to identify the dropbox forwarding account threshold based on a threshold number of unique dropbox e-mail accounts identified in the boundary.

9. The computing system of claim 1 wherein the resolution system comprises:

an account suspension system that is configured to automatically suspend the malicious collection e-mail accounts.

10. The computing system of claim 1 wherein the resolution system comprises:

an e-mail filtering configuration system that is configured to automatically reconfigure filtering information corresponding to the malicious collection e-mail accounts to inhibit forwarding of messages from the malicious collection e-mail accounts.

11. The computing system of claim 1 wherein the resolution system comprises:

a forwarding status removal system that is configured to automatically remove forwarding status information corresponding to the malicious collection e-mail accounts to inhibit forwarding of messages from the malicious collection e-mail accounts.

12. A computer implemented method, comprising:

obtaining electronic mail (e-mail) data indicative of a set of forwarding e-mail accounts, that are configured to forward messages to another e-mail account;

identifying a dropbox e-mail account as an account that is a destination of forwarded messages from a threshold number of the forwarding e-mail accounts;

identifying malicious collection e-mail accounts, based on the e-mail data identifying a subset of the forwarding e-mail accounts that forward messages to the identified dropbox e-mail account;

generating a malicious collection account identifier identifying the malicious collection e-mail accounts; and

performing a resolution action to resolve the malicious collection e-mail accounts based on the malicious collection account identifier.

13. The computer implemented method of claim 12 and further comprising:

accesses forwarding status information associated with e-mail accounts identified in the e-mail data the e-mail data in a user account data store; and

identifying the set of forwarding e-mail accounts, as a set of collection accounts, based on the accessed data.

14. The computer implemented method of claim 13 and further comprising:

identifying a boundary in the user account data store that stores the e-mail data, the boundary delineating e-mail data in the user account data store that is accessed in identifying the set of collection accounts.

15. The computer implemented method of claim 14 and further comprising:

identifying a dropbox forwarding account threshold indicative of the threshold number of forwarding e-mail accounts.

16. The computer implemented method of claim 15 wherein identifying the dropbox forwarding account threshold comprises:

determining a first ratio of a number of e-mail accounts in the set of forwarding e-mail accounts to a number of dropbox e-mail accounts identified in the boundary, a second ratio of a total number of e-mail accounts in the boundary to a total number of forwarding e-mail accounts in the boundary, and a threshold number of unique dropbox e-mail accounts identified in the boundary; and

identifying the dropbox forwarding account threshold based on the first threshold, the second threshold and the threshold number of unique dropbox e-mail accounts identified in the boundary.

17. The computer implemented method of claim 12 wherein performing a resolution action comprises at least one of:

automatically suspending the malicious collection e-mail accounts;

automatically re-configuring filtering information corresponding to the malicious collection e-mail accounts to inhibit forwarding of messages from the malicious collection e-mail accounts;

or

automatically removing forwarding status information corresponding to the malicious collection e-mail accounts to inhibit forwarding of messages from the malicious collection e-mail accounts.

18. A computing system, comprising:

collection account identifying logic that accesses electronic mail (e-mail) data in a user account data store and identifies a set of forwarding e-mail accounts, that are configured to forward messages to another e-mail account, as a set of collection accounts, based on the accessed data and generates a collection account identifier output indicative of the set of collection accounts;

dropbox account identification logic that obtains the collection account identifier and identifies a dropbox e-mail account as an account that is a destination of forwarded messages from a threshold number of the forwarding e-mail accounts in the set of collection accounts;

malicious collection account identifying logic that is configured to identify malicious collection e-mail accounts, based on the e-mail data identifying a subset of the forwarding e-mail accounts that forward messages to the identified dropbox e-mail account, and generate a malicious collection account identifier identifying the malicious collection e-mail accounts; and

a resolution system that receives the malicious collection account identifier and performs a resolution action to resolve the malicious collection e-mail accounts based on the malicious collection account identifier.

19. The computing system of claim 18 and further comprising:

boundary identifying logic that is configured to identify a boundary in the user account data store that stores the e-mail data, the boundary delineating e-mail data in the user account data store that is accessed by the collection account identifying logic in identifying the set of collection accounts; and

threshold setting logic that is configured to identify a dropbox forwarding account threshold indicative of the threshold number of forwarding e-mail accounts.

20. The computing system of claim 18 wherein the resolution system comprises at least one of:

an account suspension system that is configured to automatically suspend the malicious collection e-mail accounts;

an e-mail filtering configuration system that is configured to automatically reconfigure filtering information corresponding to the malicious collection e-mail accounts to inhibit forwarding of messages from the malicious collection e-mail accounts;

or

a forwarding status removal system that is configured to automatically remove forwarding status information corresponding to the malicious collection e-mail accounts to inhibit forwarding of messages from the malicious collection e-mail accounts.