Stopping and remediating outbound messaging abuse

• US 7,953,814 B1
• Filed: 02/28/2006
• Issued: 05/31/2011
• Est. Priority Date: 02/28/2005
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Lin, Wei, Chasin, C. Scott, Kincaid-Smith, Paul
• Primary Examiner(s): Gauthier; Gerald
• Assistant Examiner(s): ISLAM, MOHAMMAD K
• Application Number:
  US11/365,130
• Time in Patent Office: 1,918 Days
• Field of Search: 709206-207
• US Class Current: 709/207
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Systems and methods are provided for allowing subscriber message sending profiles to be maintained and used in conjunction with behavior-based anomaly detection techniques and traditional content-based spam signature filtering to enable application of appropriate message disposition policies to outbound subscriber message traffic. According to one embodiment, subscriber profiles are constructed for multiple subscriber accounts associated with a service provider based on outbound message flow originated from the subscriber accounts. Then, possible subscriber account misuse may be discovered by performing behavior-based anomaly detection, including a comparison of a subscriber profile associated with the subscriber account with recent subscriber account usage information, to identify one or more behavioral anomalies in outbound message flow originated from a subscriber account, the behavior-based anomaly detection.

Claims

1. A method comprising:

extracting behavior data of at least one subscriber account from outbound messages originated by said at least one subscriber account using a Sender Reputation Gateway (SRG) running on a computer system, said behavior data of said at least one subscriber account being attributes of said at least one subscriber account that are indicative of spam, virus, or worm related activity of said at least one subscriber account;

building a profile for said at least one subscriber account based on said behavior data extracted from said outbound messages originated by said at least one subscriber on said SRG running on said computer system;

tracking said behavior data extracted from said outbound messages originated by said at least one subscriber account using said SRG running on said computer system;

detecting behavior-based anomalies for said outbound messages originated by said at least one subscriber account using said SRG running on said computer system by comparing recent outbound messages originated by said at least one subscriber account with said profile of said at least one subscriber account to detect changes in said recent outbound messages originated by said at least one subscriber account in comparison to said profile of said at least one subscriber account;

determining reputation data for said at least one subscriber account based on said detected behavior-based anomalies using said SRG computer system, wherein the reputation data is added to the profile to determine a reputation score, and wherein if the reputation score falls below a threshold, then any subsequent outbound messages from the subscriber account are redirected to a server and prohibited from reaching their intended destination, and wherein the redirection to the server activity is designated for a specific time interval.

2. The method of claim 1 wherein said behavior data comprises at least one of a group consisting of:

metrics relating to a size of said messages originated by said at least one subscriber account, metrics relating to a number of recipients specified by said messages originated by said at least one subscriber account, metrics relating to presence of attachments to said messages originated by said at least one subscriber account, metrics relating to timing of said messages originated by said at least one subscriber account, a total number of said messages originated by said at least one subscriber account, a total number of said messages originated by said at least one subscriber account suspected of being spam, a total number of said messages originated by said at least one subscriber account suspected of containing a virus, an average number of said messages originated by said at least one subscriber account, an average size of said messages originated by said at least one subscriber account, a largest size of said messages originated by said at least one subscriber account, a maximum size permitted for said messages originated by said at least one subscriber account, an average number of recipients for said messages originated by said at least one subscriber account, a largest number of recipients for said messages originated by said at least one subscriber account, a maximum number of recipients permitted for said messages originated by said at least one subscriber account, a frequency of repetition of recipients for said messages originated by said at least one subscriber account, an address format employed for said messages originated by said at least one subscriber account, an average number of message header lines for said messages originated by said at least one subscriber account, an average Bayesian spam filter score for said messages originated by said at least one subscriber account, a number of messages originated with attachments for said messages originated by said at least one subscriber account, a number of messages originated with particular attachment types for said messages originated by said at least one subscriber account, a number of messages originated by a particular mailer for said messages originated by said at least one subscriber account, a number of messages containing a particular character set for said messages originated by said at least one subscriber account, and standard deviations of various measurements of said messages originated by said at least one subscriber account behavior.

3. The method of claim 1 further comprising alerting a network operations analyst of said service provider of potential subscriber account misuse based on said detected behavior-based anomalies from said SRG running on said computer system.

4. The method of claim 1 comprising applying a predetermined set of message disposition policies to said messages originated by said at least one subscriber account based upon said determined reputation data for said at least one subscriber account using said SRG running on said computer system.

5. The method of claim 1 further comprising:

combining said reputation data determined based on said detected behavior-based anomalies for said at least one subscriber account with traditional content-based spam filtering reputation data for said at least one subscriber account to construct combined reputation data for said at least one subscriber account using said SRG running on said computer system;

taking an immediate action with regard to a particular message originated by said at least one subscriber account using said SRG running on said computer system in response to said combined reputation data; and

taking a long term action with regard to said at least one subscriber account using said SRG running on said computer system in response to said combined reputation data.

6. The method of claim 1 wherein said outbound communication medium is the Internet.

7. The method of claim 1 wherein said building of said profile for said at least one subscriber account is performed until there is sufficient behavior data to identify anomalies prior to said detecting of said behavior-based anomalies.

8. A sender reputation gateway system, comprising:

a service and response system that services and responds to requests from at least one subscriber account;

a behavior data extraction system that extracts behavior data of said at least one subscriber account from outbound messages originated by said at least one subscriber account, said behavior data of said at least one subscriber account being attributes of said at least one subscriber account that are indicative of spam, virus, or worm related activity;

a profile builder system that builds a profile for said at least one subscriber account based on said behavior data extracted from said outbound messages originated by said at least one subscriber;

a tracking system that tracks said behavior data extracted from said outbound messages originated by said at least one subscriber account;

an anomaly detection system that detects behavior-based anomalies for said outbound messages originated by said at least one subscriber account by comparing recent outbound messages originated by said at least one subscriber account with said profile of said at least one subscriber account to detect changes in said recent outbound messages originated by said at least one subscriber account in comparison to said profile of said at least one subscriber account; and

a reputation data determination system that determines reputation data for said at least one subscriber account based on said detected behavior-based anomalies, wherein the reputation data is added to the profile to determine a reputation score, and wherein if the reputation score falls below a threshold, then any subsequent outbound messages from the subscriber account are redirected to a server and prohibited from reaching their intended destination, and wherein the redirection to the server activity is designated for a specific time interval.

9. The sender reputation gateway system of claim 8 wherein said behavior data comprises at least one of a group consisting of:

metrics relating to a size of said messages originated by said at least one subscriber account, metrics relating to a number of recipients specified by said messages originated by said at least one subscriber account, metrics relating to presence of attachments to said messages originated by said at least one subscriber account, metrics relating to timing of said messages originated by said at least one subscriber account, a total number of said messages originated by said at least one subscriber account, a total number of said messages originated by said at least one subscriber account suspected of being spam, a total number of said messages originated by said at least one subscriber account suspected of containing a virus, an average number of said messages originated by said at least one subscriber account, an average size of said messages originated by said at least one subscriber account, a largest size of said messages originated by said at least one subscriber account, a maximum size permitted for said messages originated by said at least one subscriber account, an average number of recipients for said messages originated by said at least one subscriber account, a largest number of recipients for said messages originated by said at least one subscriber account, a maximum number of recipients permitted for said messages originated by said at least one subscriber account, a frequency of repetition of recipients for said messages originated by said at least one subscriber account, an address format employed for said messages originated by said at least one subscriber account, an average number of message header lines for said messages originated by said at least one subscriber account, an average Bayesian spam filter score for said messages originated by said at least one subscriber account, a number of messages originated with attachments for said messages originated by said at least one subscriber account, a number of messages originated with particular attachment types for said messages originated by said at least one subscriber account, a number of messages originated by a particular mailer for said messages originated by said at least one subscriber account, a number of messages containing a particular character set for said messages originated by said at least one subscriber account, and standard deviations of various measurements of said messages originated by said at least one subscriber account behavior.

10. The sender reputation gateway system of claim 8 further comprising an alert system that alerts a network operations analyst of said service provider of potential subscriber account misuse based on said detected behavior-based anomalies.

11. The sender reputation gateway system of claim 8 further comprising a disposition policy system that applies a predetermined set of message disposition policies to said messages originated by said at least one subscriber account based upon said determined reputation data for said at least one subscriber account.

12. The sender reputation gateway system of claim 8 wherein said reputation data determination system further combines said reputation data determined based on said detected behavior-based anomalies for said at least one subscriber account with traditional content-based spam filtering reputation data for said at least one subscriber account to construct combined reputation data for said at least one subscriber account;

takes an immediate action with regard to a particular message originated by said at least one subscriber account in response to said combined reputation data; and

takes a long term action with regard to said at least one subscriber account in response to said combined reputation data.

13. The sender reputation gateway system of claim 8 wherein said outbound communication medium is the Internet.

14. The sender reputation gateway system of claim 8 wherein said profile builder system operates until there is sufficient behavior data to identify anomalies prior to operating said anomaly detection system.

15. A machine-readable medium that stores instructions for a computer system to perform sender reputation gateway processes, comprising:

extracting behavior data of at least one subscriber account from outbound messages originated by said at least one subscriber account, said behavior data of said at least one subscriber account being attributes of said at least one subscriber account that are indicative of spam, virus, or worm related activity of said at least one subscriber account that results in outbound message abuse of the service provider;

building a profile for said at least one subscriber account based on said behavior data extracted from said outbound messages originated by said at least one subscriber;

tracking said behavior data extracted from said outbound messages originated by said at least one subscriber account;

detecting behavior-based anomalies for said outbound messages originated by said at least one subscriber account by comparing recent outbound messages originated by said at least one subscriber account with said profile of said at least one subscriber account to detect changes in said recent outbound messages originated by said at least one subscriber account in comparison to said profile of said at least one subscriber account;

determining reputation data for said at least one subscriber account based on said detected behavior-based anomalies, wherein the reputation data is added to the profile to determine a reputation score, and wherein if the reputation score falls below a threshold, then any subsequent outbound messages from the subscriber account are redirected to a server and prohibited from reaching their intended destination, and wherein the redirection to the server activity is designated for a specific time interval.

16. The machine-readable medium of claim 15 wherein said behavior data comprises at least one of a group consisting of:

metrics relating to a size of said messages originated by said at least one subscriber account, metrics relating to a number of recipients specified by said messages originated by said at least one subscriber account, metrics relating to presence of attachments to said messages originated by said at least one subscriber account, metrics relating to timing of said messages originated by said at least one subscriber account, a total number of said messages originated by said at least one subscriber account, a total number of said messages originated by said at least one subscriber account suspected of being spam, a total number of said messages originated by said at least one subscriber account suspected of containing a virus, an average number of said messages originated by said at least one subscriber account, an average size of said messages originated by said at least one subscriber account, a largest size of said messages originated by said at least one subscriber account, a maximum size permitted for said messages originated by said at least one subscriber account, an average number of recipients for said messages originated by said at least one subscriber account, a largest number of recipients for said messages originated by said at least one subscriber account, a maximum number of recipients permitted for said messages originated by said at least one subscriber account, a frequency of repetition of recipients for said messages originated by said at least one subscriber account, an address format employed for said messages originated by said at least one subscriber account, an average number of message header lines for said messages originated by said at least one subscriber account, an average Bayesian spam filter score for said messages originated by said at least one subscriber account, a number of messages originated with attachments for said messages originated by said at least one subscriber account, a number of messages originated with particular attachment types for said messages originated by said at least one subscriber account, a number of messages originated by a particular mailer for said messages originated by said at least one subscriber account, a number of messages containing a particular character set for said messages originated by said at least one subscriber account, and standard deviations of various measurements of said messages originated by said at least one subscriber account behavior.

17. The machine-readable medium of claim 15 further comprising alerting a network operations analyst of said service provider of potential subscriber account misuse based on said detected behavior-based anomalies.

18. The machine-readable medium of claim 15 further comprising applying a predetermined set of message disposition policies to said messages originated by said at least one subscriber account based upon said determined reputation data for said at least one subscriber account.

19. The machine-readable medium of claim 15 further comprising:

combining said reputation data determined based on said detected behavior-based anomalies for said at least one subscriber account with traditional content-based spam filtering reputation data for said at least one subscriber account to construct combined reputation data for said at least one subscriber account;

taking an immediate action with regard to a particular message originated by said at least one subscriber account in response to said combined reputation data; and

taking a long term action with regard to said at least one subscriber account in response to said combined reputation data.