Methods and systems for exposing messaging reputation to an end user

• US 7,870,203 B2
• Filed: 06/09/2006
• Issued: 01/11/2011
• Est. Priority Date: 03/08/2002
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hernandez, Alejandro Manuel, Krasser, Sven, Alperovitch, Dmitri, Caracciolo, Joel Joseph, Schneck, Phyllis Adele, Judge, Paul
• Primary Examiner(s): Bayard; Djenane M
• Application Number:
  US11/423,329
• Publication Number:
  US 20070027992A1
• Time in Patent Office: 1,677 Days
• Field of Search: 709/206, 709/227, 709/201
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements

Abstract

Systems and methods for providing message reputation to an end user.

Claims

1. A method for providing a reputation associated with a message to an end user, wherein the end user comprises a messaging client, the method implemented at a filtering system and comprising:

receiving a message, the message being generated by a message originator, and being received from an originating messaging system via a network, the message including a message header comprising originator and recipient information, and a message body comprising content;

retrieving reputation information for the message based on the originating messaging system or originating information associated with the message;

associating a reputation indicator with the message, the reputation indicator being based upon the retrieved reputation information; and

passing the message, along with the associated reputation indicator, to a receiving system associated with a recipient of the message based upon the recipient information included in the message header;

wherein;

the reputation associated with the message is operable to be displayed to the recipient;

the reputation includes a global reputation and a local reputation, the local reputation associated with a user and the global reputation being associated with a plurality of users;

the reputation indicator causes a recipient device to display the reputation of the message in a toolbar on the recipient device, the displaying including displaying of the global reputation and the local reputation for the message in the toolbar; and

the local reputation and the global reputation are stored in separate data structures on a remote server, and a user configuration determines which reputation to display in the toolbar.

2. The method of claim 1, wherein the message comprises a messaging stream.

3. The method of claim 1, wherein the reputation information is based upon information about the message originator stored in a local data store.

4. The method of claim 3, wherein the reputation information is based upon information about the message originator stored in a remote data store.

5. The method of claim 1, wherein the reputation information is based upon a combination and analysis of local information and remote information.

6. The method of claim 1, wherein the reputation indicator includes modifying a font associated with the message to alert the recipient to the reputation information associated with the message.

7. The method of claim 6, wherein the reputation indicator includes modifying the font by changing the color associated with one or more of the message header or message body.

8. The method of claim 1, further comprising scoring the message based upon a plurality of tests, the tests being configured to compare the message content to previously received messages, wherein the previously received messages include content associated with a known classification, and wherein reputation information comprises the message score.

9. The method of claim 8, wherein the reputation indicator includes modifying a header associated with the message based upon the score associated with the message.

10. The method of claim 8, the scoring comprising:

using a plurality of message classification techniques to classify the communication; and

combining outputs of the message classification techniques to generate a message profile score;

wherein the message profile score is used in decoding what action is to be taken with respect to the message.

11. The method of claim 1, wherein the message is an e-mail, SMS, an instant messaging, a VoIP, a hypertext transfer protocol, or a file transfer protocol communication.

12. The method of claim 1, wherein the message reputation is displayed using a graphical notation, a text notation, an audio notation, or combinations thereof.

13. The method of claim 12, wherein the graphical notation comprises a representation for a bad reputation, a representation for a good reputation or a representation for an undetermined reputation.

14. The method of claim 1, wherein the recipient device allows the recipient to update a local or global, whitelist or blacklist via the toolbar, wherein the local whitelist or blacklist is maintained by a local client, and wherein the global whitelist or blacklist is stored on a server and is updated with information collected from a plurality of sensor devices.

15. The method of claim 1, wherein the local client receives configuration information from a user, and is operable to override a global reputation based on a local whitelist or blacklist and the configuration information.

16. The method of claim 1, wherein the local reputation is shared with a server storing the global reputation, and the server uses the local reputation as a criterion for adjusting the global reputation.

17. The method of claim 1, further comprising:

receiving feedback from the user regarding the classification of the message;

using the feedback to update reputation information in at least one of a global reputation system or a local reputation system.

18. The method of claim 17, wherein the feedback is used to update reputation information only for the user providing the feedback.

19. The method of claim 17, wherein the feedback is used to update reputation information for a plurality of users, including the user that provided the feedback.

20. The method of claim 1, further comprising:

determining the originator of the message by inspecting the header, wherein the header includes a plurality of intermediate internet protocol address corresponding to a plurality of nodes through which the message was transferred; and

selecting one of the internet protocol address contained in the header using an origination algorithm.

21. The method of claim 20, wherein the origination algorithm comprises selecting an internet protocol address associated with the last node the message was transferred across before entering a gateway associated with the recipient.

31. The method of claim 1, wherein associating a reputation indicator with the message comprises modifying the message.

22. A system configured to provide a reputation associated with a message to an end user, wherein the end user comprises a messaging client device, the system comprising:

a messaging client device configured to receive a message, along with a reputation for the message, from a reputation assignment module configured to assign a reputation to a message, the messaging client device including a computer memory;

a graphical or audio user interface module stored in the computer memory and coupled to the reputation assignment module by data signals and configured to display to a recipient of the message a graphical or audio representation indicating the reputation associated with the message;

wherein the reputation of a message is derived based upon a score assigned to the message based upon a plurality of tests, the tests being configured to compare the message content to previously received messages, wherein the previously received messages include content associated with a known classification, and wherein reputation comprises the message score; and

the reputation associated with the message is operable to be displayed to the recipient by the messaging client device;

the reputation specifies a global reputation and a local reputation, the local reputation associated with a user and the global reputation being associated with a plurality of users;

the messaging client device displays the reputation of the message in a toolbar, the displaying including displaying both the global reputation and the local reputation for the message in the toolbar; and

the local reputation and the global reputation are stored in separate data structures on a remote server, and a user configuration determines which reputation to display in the toolbar.

23. The system of claim 22, wherein the reputation is based upon an IP address associated with the originating information.

24. The system of claim 22, further comprising:

a message scoring module configured to generate a score associated with a message to identify how closely the message matches any previously received messages having a known classification.

25. The system of claim 24, wherein the message scoring module is located remotely from the recipient on a reputation server associated with a messaging server, and the message scoring module classifies a plurality of messages passing through the messaging server, the messages being sent to a plurality of recipients.

26. The system of claim 24, wherein the message scoring module is located on a local computer associated with the recipient of the message, and the message scoring module only classifies messages intended for the recipient.

27. The system of claim 22, further comprising:

receiving feedback from the recipient regarding the classification of the message; and

using the feedback to adjust message scoring of the reputation assignment module.

28. The system of claim 27, wherein the feedback is received by a central reputation system and is used to adjust the global reputation of the characteristics associated with the message.

29. The system of claim 28, further comprising a plurality of reputation servers configured to retrieve the reputation information retained by the central reputation system to score messages transmitted via messaging servers associated with the reputation servers.

30. The system of claim 26, wherein the feedback is used to adjust the local reputation of the characteristics associated with the message.