Electronic message source reputation information system

• US 7,668,951 B2
• Filed: 05/25/2005
• Issued: 02/23/2010
• Est. Priority Date: 05/25/2004
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Lund, Peter K., Petry, Scott M., Okumura, Kenneth K., Carroll, Dorion A., Croteau, Craig S.
• Primary Examiner(s): Vaughn, Jr.; William C
• Assistant Examiner(s): PEREZ, CARLOS R
• Application Number:
  US11/137,110
• Publication Number:
  US 20060031483A1
• Time in Patent Office: 1,735 Days
• Field of Search: 709/206, 709/203, 709/204, 709/205, 709/207, 709223-226
• US Class Current: 709/223
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Disclosed herein are filtering systems and methods that employ an electronic message source reputation system. The source reputation system maintains a pool of source Internet Protocol (IP) address information, in the form of a Real-Time Threat Identification Network (“RTIN”) database, which can provide the reputation of source IP addresses, which can be used by customers for filtering network traffic. The source reputation system provides for multiple avenues of access to the source reputation information. Examples of such avenues can include Domain Name Server (DNS)-type queries, servicing routers with router-table data, or other avenues.

Claims

1. A network traffic filtering system for filtering a flow of electronic messages across a computer network, the system comprising:

one or more computing devices;

an engine associated with a centralized server installed on the one or more computing devices, the engine executing instructions stored in a memory of the one or more computing devices, the execution of the instructions configured to;

generate reputation data and new reputation data for sources of messages by evaluating messages after being sent from a sending server and before being received by a targeted receiving server;

generate a source reputation profile for a source of a message by evaluating reputation data associated with that source of that message, wherein this evaluation comprises generating a reputation score for the source, the reputation score indicating a likelihood that electronic messages from the source are wanted or unwanted, and

update the source reputation profile by evaluating new reputation data associated with the source, wherein this evaluation comprises generating an updated reputation score for the source, and wherein an updated reputation score different than the reputation score indicates a change in the likelihood that electronic messages from the source are unwanted;

a profile database associated with the engine for storing the reputation data, the reputation score, the updated reputation score, and the source reputation profile; and

the centralized server connected to the profile database and external to the receiving server and a terminal connected thereto for receiving incoming messages from the receiving server, and the centralized server configured to provide the source reputation profile to an external local system including the receiving mail server, the source reputation profile for filtering incoming electronic messages received by the receiving mail server.

2. A system according to claim 1, wherein the updated reputation data is provided in real-time.

3. A system according to claim 1, wherein the source reputation profile comprises a list having at least one item of reputation data.

4. A system according to claim 1, wherein the reputation data comprises at least one selected from the group consisting of:

the number of messages considered spam sent from the source;

the number of messages considered legitimate from the source;

the number of recipients on a message sent from the source;

the number of connection attempts from the source;

the number of connection successes from the source;

the number of connection failures from the source;

the number of connection currently open from the source;

the number of 400-class errors caused by messaging attempts by the source;

the number of 500-class errors caused by messaging attempts by the source;

the average message size in bytes sent from the source;

the average connection duration from the source;

the number of messages containing viruses sent from the source;

the number of message delivered from the source; and

an overall number of messages sent from the source.

5. A system according to claim 1, wherein the engine is configured to additionally receive reputation data from a data source comprising a two-strikes system.

6. A system according to claim 1, wherein the engine is configured to additionally receive reputation data from a data source comprising a system identifying message sources by detecting messages sent to a deliberately established invalid destination address.

7. A system according to claim 1, wherein the engine is configured to additionally receive reputation data from a data source comprising a system determining whether a predetermined amount of time has elapsed since a first suspect message was sent from a particular source when a second suspect message is detected being sent from that source.

8. A system according to claim 1, wherein the engine is configured to additionally receive reputation data from a data source comprising a customer system, and the reputation data additionally comprises at least one list selected from the group consisting of blacklists, blocked senders lists, and gray-lists.

9. A system according to claim 1, wherein the engine is configured to additionally receive reputation data from a data source comprising approved senders selected using a business-based heuristics selection technique.

10. A system according to claim 1, wherein the engine is configured to provide the reputation profile via the server to the external system in response to a query received from the external system by the server.

11. A system according to claim 10, wherein the query comprises a DNS query corresponding to a source IP address of the source.

12. A system according to claim 1, wherein the updated reputation score replaces the reputation score on the database.

13. A system according to claim 1, wherein the server provides the reputation profile to an external system in the form of electronic message path data for use in a network router table of a router associated with the customer system to redirect electronic messages from the source.

14. A system according to claim 1, wherein the system further comprises a reputation data database associated with the engine and configured to store the reputation data.

15. A system according to claim 1, wherein the system further comprises a controller associated with the engine and the server, wherein the controller is configured to query a data source for reputation data, receive reputation data from a data source, evaluate the received reputation data to develop the source reputation profile, update the profile database, and the server is configured to distribute the source reputation profile or reputation data to external systems.

16. A system according to claim 1, wherein the external system is a customer system subscribing to use the filtering system.

17. A system according to claim 1, wherein the source comprises a source IP address.

18. A method of filtering a flow of electronic messages across a computer network, the method comprising:

generating with an engine in a centralized server reputation data for sources of the electronic messages, the reputation data generated by evaluating messages after being sent from a sending server and before being received by a receiving server, the centralized server external to the receiving server and terminals connected thereto for receiving incoming messages from the receiving server;

evaluating the generated reputation data;

generating a reputation score for a source of a message based on the evaluation of reputation data for that source, the reputation score indicating a likelihood that electronic messages from the source are wanted or unwanted;

providing a source reputation profile based on the reputation score from the centralized server to an external local system including the receiving mail server for filtering incoming electronic messages received by the receiving mail server;

generating with the engine in the centralized server new reputation data for the source of the message, the new reputation data generated by further evaluation of messages being sent from a sending server at the source and before being received by the targeted receiving server;

evaluating the generated new reputation data;

generating an updated reputation score for the source, wherein an updated reputation score different than the reputation score indicates a change in the likelihood that electronic messages from the source are unwanted;

updating the source reputation profile based on the updated reputation score; and

providing the updated source reputation profile from the centralized server to the external local system.

19. A method according to claim 18, wherein updating the source reputation profile occurs in real-time.

20. A method according to claim 18, wherein providing the source reputation profile or providing the updated source reputation profile comprises providing a list having at least one item of reputation data.

21. A method according to claim 18, wherein the reputation data comprises at least one selected from the group consisting of:

the number of messages considered spam sent from the source;

the number of messages considered legitimate from the source;

the number of recipients on a message sent from the source;

the number of connection attempts from the source;

the number of connection successes from the source;

the number of connection failures from the source;

the number of connection currently open from the source;

the number of 400-class errors caused by messaging attempts by the source;

the number of 500-class errors caused by messaging attempts by the source;

the average message size in bytes sent from the source;

the average connection duration from the source;

the number of messages containing viruses sent from the source;

the number of message delivered from the source; and

an overall number of messages sent from the source.

22. A method according to claim 18, wherein receiving reputation data further comprises receiving reputation data from a two-strikes system.

23. A method according to claim 18, wherein receiving reputation data further comprises receiving reputation data from a data source comprising a system identifying message sources by detecting messages sent to a deliberately established invalid destination address.

24. A method according to claim 18, wherein receiving reputation data further comprises receiving reputation data from a data source comprising a system determining whether a predetermined amount of time has elapsed since a first suspect message was sent from a particular source when a second suspect message is detected being sent from that source.

25. A method according to claim 18, wherein receiving reputation data further comprises receiving reputation data from a customer system, and the reputation data comprises at least one list selected from the group consisting of blacklists, blocked senders lists, and gray-lists.

26. A method according to claim 18, wherein receiving reputation data further comprises receiving reputation data comprising approved senders selected using an business-based heuristics selection technique.

27. A method according to claim 18, wherein providing further comprises providing the source reputation profile or the updated source reputation profile to a customer system in response to a query received from the customer system.

28. A method according to claim 27, wherein the query comprises a DNS query corresponding to a source IP address of the source.

29. A method according to claim 18, the method further comprising storing the reputation score in a database associated with the centralized server, and replacing the reputation score with the updated reputation score.

30. A method according to claim 18, wherein providing further comprises providing the source reputation profile or the updated source reputation profile to a customer system in the form of electronic message path data for use in a network router table of a router associated with the customer system to redirect electronic messages from the source.

31. A method according to claim 30, wherein the electronic messages are redirected to a black hole in the network.

32. A method according to claim 18, wherein providing comprises providing the source reputation profile or the updated source reputation profile to a customer system subscribing to use the filtering method.

33. A method according to claim 18, the method further comprising storing the reputation data, the reputation score, the updated reputation score, and the source reputation profile.

34. A method according to claim 18, wherein the source comprises a source IP address.

35. A computer-readable medium comprising program code for filtering a flow of electronic messages across a computer network, program code executable by a computer to perform the steps of:

generating with an engine in a centralized server reputation data for sources of the electronic messages, the reputation data generated by evaluating messages after being sent from a sending server and before being received by a receiving server, the centralized server external to the receiving server and terminals connected thereto for receiving incoming messages from the receiving server;

evaluating the generated reputation data;

generating a reputation score for a source of a message based on the evaluation of reputation data for that source, the reputation score indicating a likelihood that electronic messages from the source are wanted or unwanted;

providing a source reputation profile based on the reputation score from the centralized server to an external local system including the receiving mail server for filtering incoming electronic messages received by the receiving mail server;

generating with the engine in the centralized server new reputation data for the source of the message, the new reputation data generated by further evaluation of messages being sent from a sending server at the source and before being received by the targeted receiving server;

evaluating the generated new reputation data;

generating an updated reputation score for the source, wherein an updated reputation score different than the reputation score indicates a change in the likelihood that electronic messages from the source are unwanted;

updating the source reputation profile based on the updated reputation score; and

providing the updated source reputation profile from the centralized server to the external local system.

36. A computer readable medium according to claim 35, wherein providing the source reputation profile or providing the updated source reputation profile comprises providing a list having at least one item of reputation data selected from the group consisting of:

the number of messages considered spam sent from the source;

the number of messages considered legitimate from the source;

the number of recipients on a message sent from the source;

the number of connection attempts from the source;

the number of connection successes from the source;

the number of connection failures from the source;

the number of connection currently open from the source;

the number of 400-class errors caused by messaging attempts by the source;

the number of 500-class errors caused by messaging attempts by the source;

the average message size in bytes sent from the source;

the average connection duration from the source;

the number of messages containing viruses sent from the source;

the number of message delivered from the source; and

an overall number of messages sent from the source.

37. A computer readable medium according to claim 35, wherein receiving reputation data further comprises receiving reputation data from:

a two-strikes system;

a data source comprising a system identifying message sources by detecting messages sent to a deliberately established invalid destination address;

a data source comprising a system determining whether a predetermined amount of time has elapsed since a first suspect message was sent from a particular source when a second suspect message is detected being sent from that source;

a customer system, and the reputation data comprises at least one list selected from the group consisting of blacklists, blocked senders lists, and gray-lists;

or

a data source comprising a list of one or more approved senders selected using an business-based heuristics selection technique.

38. A computer readable medium according to claim 35, wherein the source comprises a source IP address.