Systems and methods for adaptive message interrogation through multiple queues

• US 6,941,467 B2
• Filed: 03/08/2002
• Issued: 09/06/2005
• Est. Priority Date: 03/08/2002
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: Ciphertrust, Incorporated (McAfee, LLC)
• Inventors: Judge, Paul, Rajan, Guru
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US10/093,553
• Publication Number:
  US 20030172301A1
• Time in Patent Office: 1,278 Days
• Field of Search: 713200-201, 709/200, 709/217, 709219-220, 709223-225, 709/229
• US Class Current: 726/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present invention is directed to systems and methods for enhancing electronic communication security. An electronic communication is received and stored. A plurality of risk assessments are made with respect to the received communication thereby generating a risk profile associated with the communication. The assessments are made in a sequential manner by assigning the stored communication and index and serially placing the index on queue associated with interrogation engines that perform the various assessments. The index is initially placed in a queue associated with an interrogation engine performing the first type of assessment on the communication. The index is placed in a subsequent queue only after the interrogation engine associated with the prior queue in which the index was placed has assessed the communication. This is repeated until all desired assessments have been performed. Each assessment may result in the output of an assessment indicator that indicates the results of the particular assessment.

Claims

1. A security system for interrogation of a communication transmitted over a communication network, the system comprising:

a) a communication interface communicatively coupling the system to a communication network;

b) a system data store comprising;

i) a message data store capable of storing a communication; and

ii) a queue data store capable of storing a plurality of index queues; and

c) a system processor in communication with the communication interface and the system data store, wherein the system processor comprises one or more processing elements and wherein the system processor;

i) receives a communication via the communication interface;

ii) stores the received message in the message data store;

iii) assigns a selected index to the stored communication;

iv) executes a plurality of interrogation engines, wherein each of the interrogation engines has a test type and has an index queue in the queue data store associated with it, and wherein each of the interrogation engines;

1) monitors its associated index queue for a placed index;

2) retrieves the communication associated with the placed index from t data store;

3) assesses the retrieved communication against a set of one or more criteria related to the interrogation engine'"'"'s test type; and

4) outputs an assessment indicator indicating results of assessing the retrieved communication with respect to the set of one or more criteria; and

v) places the selected index into the index queue associated with a first interrogation engine, wherein the first interrogation engine has a first test type; and

vi) responsive to the assessment indicator output by the first interrogation engine, places the selected index into the index queue associated with a second interrogation engine,

wherein the second interrogation engine has a second test type that differs from the first test type.

2. The system of claim 1, wherein the received communication comprises an e-mail communication, an HTTP communication, an FTP communication, a WAIS communication, a telnet communication or a Gopher communication.

3. The system of claim 2, wherein the received communication is an e-mail communication.

4. The system of claim 1, wherein the system processor assigns the selected index by retrieving a previously assigned index and incrementing it by a fixed amount.

5. The system of claim 1, wherein the system processor assigns the selected index based upon the received communication.

6. The system of claim 1, wherein the plurality of interrogation engines comprises one or more further interrogation engines each having a type differing from any interrogation engine that previously assessed the communication associated with the selected index and wherein the system processor, responsive to an assessment indicator output by an interrogation engine, places the selected index in an index queue associated with an interrogation engine having a type differing from any interrogation engine that previously assessed the communication associated with the selected index.

7. The system of claim 1, wherein each of the plurality of interrogation engines comprises intrusion detection, virus detection, spam detection or policy violation detection.

8. The system of claim 1, wherein the system processor adds an interrogation engine to the plurality of interrogation engines based upon the received communication.

9. The system of claim 1, wherein the system processor adds an interrogation engine to the plurality of interrogation engines based upon loading of existing interrogation engines in the plurality of interrogation engines.

10. The system of claim 1, wherein the assessment indicator output by each interrogation engine comprises a risk level associated with received communication with respect to the interrogation engine'"'"'s test type.

11. The system of claim 1, wherein the assessment indicator output by each interrogation engine is output only if the interrogation engine'"'"'s assessment of the received communication with respect to the set of one or more criteria determines that the received communication meets a threshold risk level.

12. The system of claim 11, wherein the assessment indicator signal comprises a notification conveyed to an administrator.

13. The system of claim 12, wherein the notification comprises an e-mail message, a page, a facsimile, an telephone call, an SMS message, a WAP alert or SMNP alert.

14. The system of claim 12, wherein the assessment indicator further comprises the interrogation engine'"'"'s test type for the interrogation engine outputting the assessment indicator and wherein the notification conveyed to the administrator comprises the interrogation engine'"'"'s test type.

15. The system of claim 1, wherein the system processor deletes an interrogation engine from the plurality of interrogation engines based upon loading of existing interrogation engines in the plurality of interrogation engines.

16. The system of claim 1, wherein the system data store further comprises a configuration data store capable of storing configuration information.

17. The system of claim 16, wherein the system processor further updates configuration information based upon data accumulated from received communications.

18. The system of claim 16, wherein the system processor further provides an interface via which an administrator enters configuration information, receives configuration information from the interface and stores the received configuration information in the system data store.

19. The system of claim 18, wherein the system processor further populates the interface with one or more default values prior to providing it to the administrator.

20. The system of claim 18, wherein the system processor provides the interface to the administrator via a Web server, an e-mail server, an automated voice recognition system or an SMS message server.

21. The system of claim 16, wherein the system processor further determines the first interrogation engine based upon configuration information stored in the configuration data store.

22. The system of claim 16, wherein the system processor further determines the second interrogation engine based upon configuration information stored in the configuration data store.

23. The system of claim 16, wherein the system processor further determines the plurality of interrogation engines based upon configuration information stored in the configuration data store.

24. The system of claim 1, further comprising a firewall communication interface communicatively coupling the system to a firewall system, wherein the system processor receives the communication via the firewall communication interface.

25. The system of claim 1, further comprising a firewall communication interface communicatively coupling the system to a firewall system, wherein the received communication originates from a system connected to the communications network with a destination address external to the communications network.

26. The system of claim 1, wherein the received communication is directed to a system connected to the communications network.

27. The system of claim 1, wherein the received communication originates from a system connected to the communications network.

28. The system of claim 1, wherein the system processor further forwards the received communication to its destination.

29. The system of claim 28, wherein the system processor further determines the communication'"'"'s destination based upon the communication.

30. The system of claim 1, wherein the system processor further outputs an overall indicator signal responsive to one or more assessment indicators respectively output from the plurality of interrogation engines.

31. The system of claim 1, wherein the system processor further takes a corrective measure responsive to one or more assessment indicators respectively output from the plurality of interrogation engines.

32. The system of claim 31, wherein the corrective measure comprises conveying a notification to an administrator, refusing acceptance of further communications from the source of the received communication, quarantine of the received communication, stripping the received communication of identified content, or throttling excessive numbers of incoming connections per second to manageable levels for the communication network.

33. A method for interrogation of a communication transmitted over a communication network, the method comprising the steps of:

a) receiving a communication transmitted over a communication network;

b) assigning a selected index to the received communication;

c) executing a plurality of interrogation engines, wherein each of the interrogation engines has a test type and has an index queue associated with it, and wherein each of the interrogation engines performs the steps comprising of;

i) monitoring its associated index queue for a placed index;

ii) assessing the communication associated with the placed index against a set of one or more criteria related to the interrogation engine'"'"'s type; and

iii) outputting an assessment indicator indicating results of assessing the communication associated with the placed index with respect to the set of one or more criteria;

d) placing the selected index into the index queue associated with a first interrogation engine, wherein the first interrogation engines has a first test type; and

e) responsive to the assessment indicator output by the first interrogation engine, placing the selected index into the index queue associated with a second interrogation engine,

wherein the second interrogation engine has a second test type that differs from the first test type.

34. The method of claim 33, wherein the received communication comprises an e-mail communication, an HTTP communication, an FTP communication, a WAIS communication, a telnet communication or a Gopher communication.

35. The method of claim 34, wherein the received communication is an e-mail communication.

36. The method of claim 33, wherein the plurality of interrogation engines comprises one or more further interrogation engines each having a type differing from any interrogation engine that previously assessed the communication associated with the selected index and further comprising the step of placing the selected index in an index queue associated with a subsequent interrogation engine having a type differing from any interrogation engine that previously assessed the communication associated with the selected index responsive to an assessment indicator output by an interrogation engine that previously assessed the communication.

37. The method of claim 33, wherein each of the plurality of interrogation engines comprises intrusion detection, virus detection, spam detection or policy violation detection.

38. The method of claim 33, and further comprising the step of adding an interrogation engine to the plurality of interrogation engines based upon the received communication.

39. The method of claim 33, and further comprising the step of adding an interrogation engine to the plurality of interrogation engines based upon loading of existing interrogation engines in the plurality of interrogation engines.

40. The method of claim 33, wherein the assessment indicator output by each interrogation engine is output only if the interrogation engine'"'"'s assessment of the received communication with respect to the set of one or more criteria determines that the received communication meets a threshold risk level.

41. The method of claim 40, wherein the assessment indicator signal comprises a notification conveyed to an administrator.

42. The method of claim 33, and further comprising the step of deleting an interrogation engine from the plurality of interrogation engines based upon loading of existing interrogation engines in the plurality of interrogation engines.

43. The method of claim 33, and further comprising the step of taking a corrective measure responsive to one or more assessment indicators respectively output from the plurality of interrogation engines.

44. The method of claim 43, wherein the corrective measure comprises conveying a notification to an administrator, refusing acceptance of further communications from the source of the received communication, quarantine of the received communication, stripping the received communication of identified content, or throttling excessive numbers of incoming connections per second to manageable levels for the communication network.

45. Computer readable storage media storing instructions that upon execution by a system processor cause the system processor to interrogate a communication transmitted over a communication network, the media having stored instruction that cause the system processor to perform the steps comprising of:

a) receiving a communication transmitted over a communication network;

b) assigning a selected index to the received communication;

c) executing a plurality of interrogation engines, wherein each of the interrogation engines has a test type and has an index queue associated with it, and wherein each of the interrogation engines performs the steps comprising of;

i) monitoring its associated index queue for a placed index;

ii) assessing the communication associated with the placed index against a set of one or more criteria related to the interrogation engine'"'"'s type; and

iii) outputting an assessment indicator indicating results of assessing the communication associated with the placed index with respect to the set of one or more criteria;

d) placing the selected index into the index queue associated with a first interrogation engine, wherein the first interrogation engines has a first test type; and

e) responsive to the assessment indicator output by the first interrogation engine, placing the selected index into the index queue associated with a second interrogation engine,

wherein the second interrogation engine has a second test type that differs from the first test type.

46. The media of claim 45, wherein the instructions causing the system processor to receive the communication comprise instructions causing the system processor to receive an e-mail communication.

47. The media of claim 45, wherein the plurality of interrogation engines comprises one or more further interrogation engines each having a type differing from any interrogation engine that previously assessed the communication associated with the selected index and further comprising instructions causing the system processor to perform the step of placing the selected index in an index queue associated with a subsequent interrogation engine having a type differing from any interrogation engine that previously assessed the communication associated with the selected index responsive to an assessment indicator output by an interrogation engine that previously assessed the communication.

48. The media of claim 45, wherein each of the plurality of interrogation engines comprises intrusion detection, virus detection, spam detection or policy violation detection.

49. The media of claim 45, and further comprising instructions causing the system processor to perform the step of adding an interrogation engine to the plurality of interrogation engines based upon loading of existing interrogation engines in the plurality of interrogation engines.

50. The media of claim 45, wherein the assessment indicator output by each interrogation engine is output only if the interrogation engine'"'"'s assessment of the received communication with respect to the set of one or more criteria determines that the received communication meets a threshold risk level.

51. The media of claim 45, and further comprising instructions causing the system processor to perform the step of deleting an interrogation engine from the plurality of interrogation engines based upon loading of existing interrogation engines in the plurality of interrogation engines.

52. The media of claim 45, and further comprising instructions causing the system processor to perform the step of taking a corrective measure responsive to one or more assessment indicators respectively output from the plurality of interrogation engines.