Fraudulent message detection

• US 7,451,487 B2
• Filed: 10/02/2003
• Issued: 11/11/2008
• Est. Priority Date: 09/08/2003
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Eikenberry, Scott D., Oliver, Jonathan, Kim, Bryan, Budman, Gleb
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US10/678,965
• Publication Number:
  US 20070101423A1
• Time in Patent Office: 1,867 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A technique for classifying a message is disclosed. In some embodiments, the technique comprises extracting a plurality of reference points, classifying the plurality of reference points, and detecting that the message is a phish message based on the classified reference points. In some embodiments, the technique comprises identifying a plurality of fraud indicators in the message, applying a statistical analysis on the plurality of fraud indicators; and determining whether the message is a fraudulent message based on the analysis.

Claims

1. A method for classifying a message, comprising:

extracting a plurality of reference points from a body of the message, each reference point being information used to contact a referenced entity;

classifying each of the plurality of reference points based on a source associated with each reference point;

determining whether the message is a fraudulent message appearing to be from a legitimate source based on the classified reference points; and

processing the message based on the determination of whether the message is a fraudulent message appearing to be from a legitimate source.

2. The method of claim 1, wherein classifying the plurality of reference points includes looking up the plurality of reference points in a database.

3. The method of claim 1, wherein detecting that the message is a fraudulent message appearing to be from a legitimate source includes determining that the message includes divergent reference points.

4. The method of claim 1, wherein detecting that the message is a fraudulent message appearing to be from a legitimate source includes determining that the plurality of reference points includes a first reference point to a first source and a second reference point to a second source.

5. The method of claim 1, wherein detecting that the message is a fraudulent message appearing to be from a legitimate source includes determining that the plurality of reference points includes a first reference point to a legitimate source and a second reference point to a questionable search.

6. The method of claim 1, wherein detecting that the message is a fraudulent message appearing to be from a legitimate source includes determining that the plurality of reference points includes a first reference point to a first source and a second reference point to a second source, and the second reference point is intended to appear as a reference to the first source.

7. The method of claim 1, further comprising computing a thumbprint of the message and storing the thumbprint to a database.

8. The method of claim 1, further comprising computing a thumbprint of the message and storing the thumbprint to a database;

wherein the database is shared.

9. The method of claim 1, further comprising identifying a plurality of fraud indicators and applying a statistical analysis on the plurality of fraud indicators.

10. The method of claim 1, further comprising quarantining the message.

11. The method of claim 1, further comprising deleting the message.

12. The method of claim 1, further comprising providing an alert to a recipient of the message.

13. The method of claim 1, further comprising providing an alert to a recipient indicating that the message is a fraudulent message appearing to be from a legitimate source.

14. The method of claim 1, further comprising providing an explanation of the fraudulent message appearing to be from a legitimate source to a recipient.

15. A computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for classifying a message, the method comprising:

extracting a plurality of reference points from a body of the message;

classifying the plurality of reference points;

determining whether the message is a fraudulent message appearing to be from a legitimate source based on the classified reference points; and

processing the message based on the determination of whether the message is a fraudulent message appearing to be from a legitimate source.