Method of determining network addresses of senders of electronic mail messages

• US 7,548,544 B2
• Filed: 05/05/2006
• Issued: 06/16/2009
• Est. Priority Date: 05/05/2005
• Status: Active Grant

• Current Assignee: Ironport Systems (Cisco Systems, Inc.)
• Original Assignee: Ironport Systems (Cisco Systems, Inc.)
• Inventors: Quinlan, Daniel, Wescott, Jeffrey
• Primary Examiner(s): Kizou; Hassan
• Assistant Examiner(s): O CONNOR, BRIAN T
• Application Number:
  US11/429,474
• Publication Number:
  US 20070070921A1
• Time in Patent Office: 1,138 Days
• Field of Search: 370/252, 370/389, 370/392, 370/401, 709/204, 709/205, 709/206, 709/223, 709/225, 707/3, 707/6, 713/188, 726/2, 726/3, 726/11, 726/21, 726/22, 726/23, 726/24
• US Class Current: 370/392
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

In one embodiment, a method comprises computer-implemented steps of receiving a plurality of electronic mail messages containing sender address information that is non-trusted. For each electronic mail message, information about the message is stored, and one or more receiving node identifiers in association with respective connected node identifiers is created, wherein the receiving node identifier identifies receiving mail server that received the particular message and the connected node identifier identifies a connected mail server that directly connected to the receiving node identifier to send the particular message directly to the receiving mail server. For each electronic mail message a receiving node identifier that has a largest number of connected node identifiers associated therewith is selected, and a connected node identifier that is associated with the one particular receiving node identifier that sent the particular message to the associated receiving node is selected and stored.

Claims

1. A method, comprising the computer-implemented steps of:

receiving a plurality of electronic mail messages containing sender address information that is non-trusted;

for each particular one of the electronic mail messages;

storing information about the particular message in a database record;

creating and storing one or more receiving node identifiers in association with respective connected node identifiers,

wherein the receiving node identifier identifies a receiving mail server that received the particular message and the connected node identifier identifies a connected mail server that directly connected to the receiving mail server to send the particular message directly to the receiving mail server;

based on the associations between the receiving node identifiers and the respective connected node identifiers, selecting one particular receiving node identifier that has a largest number of directly connected node identifiers associated therewith;

selecting one particular connected node identifier that is associated with the one particular receiving node identifier that has the largest number of the associated connected node identifiers;

storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.

2. The method of claim 1, wherein the receiving node identifiers and connected node identifiers are IP addresses.

3. The method of claim 1, wherein the receiving node identifiers and connected node identifiers are stored in a logical tree data structure that represents a network topology that includes the receiving nodes and the connected nodes.

4. The method of claim 3, wherein nodes in the tree represent network elements involved in sending, receiving or forwarding the electronic mail messages and branches in the tree represent mail transfer protocol connections that were established between the network elements.

5. The method of claim 1, further comprising:

retrieving the database record;

determining whether a value of the sender field is found in a blacklist;

creating and storing a poor reputation score value when the value of the sender field is found in the blacklist and creating and storing another reputation score value indicating a reputation other than a good reputation when the value of the sender field is not found in the blacklist.

6. A computer-readable tangible storage medium storing one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform:

receiving a plurality of electronic mail messages containing sender address information that is non-trusted;

for each particular one of the electronic mail messages;

storing information about the particular message in a database record;

creating and storing one or more receiving node identifiers in association with respective connected node identifiers,

wherein the receiving node identifier identifies a receiving mail server that received the particular message and the connected node identifier identifies a connected mail server that directly connected to the receiving mail server to send the particular message directly to the receiving mail server;

based on the associations between the receiving node identifiers and the respective connected node identifiers, selecting one particular receiving node identifier that has a largest number of directly connected node identifiers associated therewith;

selecting one particular connected node identifier that is associated with the one particular receiving node identifier that has the largest number of the associated connected node identifiers;

storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.

7. The computer-readable storage medium of claim 6, wherein the receiving node identifiers and connected node identifiers are IP addresses.

8. The computer-readable storage medium of claim 6, wherein the receiving node identifiers and connected node identifiers are stored in a logical tree data structure that represents a network topology that includes the receiving nodes and the connected nodes.

9. The computer-readable storage medium of claim 8, wherein nodes in the tree represent network elements involved in sending, receiving or forwarding the electronic mail messages and branches in the tree represent mail transfer protocol connections that were established between the network elements.

10. The computer-readable storage medium of claim 6, further comprising:

retrieving the database record;

determining whether a value of the sender field is found in a blacklist;

creating and storing a poor reputation score value when the value of the sender field is found in the blacklist and creating and storing another reputation score value indicating a reputation other than a good reputation when the value of the sender field is not found in the blacklist.

11. An apparatus, comprising:

means for receiving a plurality of electronic mail messages containing sender address information that is non-trusted;

means for storing information about each particular one of the electronic mail messages in a database record;

means for creating and storing one or more receiving node identifiers in association with respective connected node identifiers,

wherein the receiving node identifier identifies a receiving mail server that received the particular message and the connected node identifier identifies a connected mail server that directly connected to the receiving mail server to send the particular message directly to the receiving mail server;

means for selecting one particular receiving node identifier that has a largest number of directly connected node identifiers associated therewith, based on the associations between the receiving node identifiers and the respective connected node identifiers;

means for selecting one particular connected node identifier that is associated with the one particular receiving node identifier that has the largest number of the associated connected node identifiers;

means for storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.

12. The apparatus of claim 11, wherein the receiving node identifiers and connected node identifiers are IP addresses.

13. The apparatus of claim 11, wherein the receiving node identifiers and connected node identifiers are stored in a logical tree data structure that represents a network topology that includes the receiving nodes and the connected nodes.

14. The apparatus of claim 13, wherein nodes in the tree represent network elements involved in sending, receiving or forwarding the electronic mail messages and branches in the tree represent mail transfer protocol connections that were established between the network elements.

15. The apparatus of claim 11, further comprising:

means for retrieving the database record;

means for determining whether a value of the sender field is found in a blacklist;

means for creating and storing a poor reputation score value when the value of the sender field is found in the blacklist and creating and storing another reputation score value indicating a reputation other than a good reputation when the value of the sender field is not found in the blacklist.

16. An apparatus, comprising:

one or more processors coupled to a network interface;

a computer-readable tangible storage medium coupled to the one or more processors and carrying one or more sequences of instructions which, when executed by the processors, cause the one or more processors to perform;

receiving a plurality of electronic mail messages containing sender address information that is non-trusted;

for each particular one of the electronic mail messages;

storing information about the particular message in a database record;

creating and storing one or more receiving node identifiers in association with respective connected node identifiers,

wherein the receiving node identifier identifies a receiving mail server that received the particular message and the connected node identifier identifies a connected mail server that directly connected to the receiving mail server to send the particular message directly to the receiving mail server;

based on the associations between the receiving node identifiers and the respective connected node identifiers, selecting one particular receiving node identifier that has a largest number of directly connected node identifiers associated therewith;

selecting one particular connected node identifier that is associated with the one particular receiving node identifier that has the largest number of the associated connected node identifiers;

storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.

17. The apparatus of claim 16, wherein the receiving node identifiers and connected node identifiers are IP addresses.

18. The apparatus of claim 16, wherein the receiving node identifiers and connected node identifiers are stored in a logical tree data structure that represents a network topology that includes the receiving nodes and the connected nodes.

19. The apparatus of claim 18, wherein nodes in the tree represent network elements involved in sending, receiving or forwarding the electronic mail messages and branches in the tree represent mail transfer protocol connections that were established between the network elements.

20. The apparatus of claim 16, further comprising sequences of instructions which, when executed by the processors, cause the one or more processors to perform:

retrieving the database record;

determining whether a value of the sender field is found in a blacklist;

creating and storing a poor reputation score value when the value of the sender field is found in the blacklist and creating and storing another reputation score value indicating a reputation other than a good reputation when the value of the sender field is not found in the blacklist.