Systems and methods for classification of messaging entities

• US 8,621,638 B2
• Filed: 05/16/2011
• Issued: 12/31/2013
• Est. Priority Date: 05/14/2010
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Judge, Paul, Moyer, Matt, Rajan, Guru, Alperovitch, Dmitri
• Primary Examiner(s): Pearson, David
• Assistant Examiner(s): Jeudy, Josnel
• Application Number:
  US13/108,529
• Publication Number:
  US 20120110672A1
• Time in Patent Office: 960 Days
• Field of Search: 726 22- 25, 713187-188, 713192-193
• US Class Current: 726/25
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Methods and systems for operation upon one or more data processors for biasing a reputation score. A communication having data that identifies a plurality of biasing characteristics related to a messaging entity associated with the communication is received. The identified plurality of biasing characteristics related to the messaging entity associated with the communication based upon a plurality of criteria are analyzed, and a reputation score associated with the messaging entity is biased based upon the analysis of the identified plurality of biasing characteristics related to the messaging entity associated with the communication.

Claims

1. A computer-implemented method to assign a reputation to a messaging entity, comprising:

receiving a query comprising data that identifies a plurality of biasing characteristics related to a messaging entity associated with the communication;

analyzing, using at least one processor device, the identified plurality of biasing characteristics related to the messaging entity associated with the communication based upon a plurality of criteria;

determining a reputation score associated with the messaging entity based upon the analysis of the identified plurality of biasing characteristics related to the messaging entity associated with the communication;

encoding the reputation score based at least in part on a communication protocol, wherein the reputation score is encoded in at least a portion of an IP address; and

transmitting the encoded reputation score as a response to the query.

2. The method of claim 1, further comprising distributing the reputation score to one or more computer systems for use in filtering communications.

3. The method of claim 1, wherein the reputation scores is indicative numeric, textual or categorical reputations that are assigned to messaging entities based on characteristics of the messaging entities and their behavior, and wherein the numeric reputations comprise a continuous spectrum of reputable and non-reputable classifications.

4. The method of claim 1, further comprising:

determining reputation indicative probabilities based upon characteristics of the messaging entity; and

aggregating the reputation indicative probabilities to identify the reputation score;

wherein a reputation indicative probability indicates reputability of a messaging entity based upon extent to which a characteristic of the entity correlates to one or more reputation-related criteria.

5. The method of claim 1 further comprising:

identifying a set of criteria for use in discriminating between reputable and non-reputable classifications, wherein the criteria include non-reputable criteria and reputable criteria;

using statistical sampling to estimate a conditional probability that a messaging entity includes each criteria;

computing a reputation for each messaging entity, comprising;

calculating a reputable probability that a messaging entity has a reputable reputation by computing an estimate of joint conditional probability that the messaging entity is reputable, given the set of reputable criteria to which the messaging entity correlates;

calculating a non-reputable probability that the messaging entity have a negative reputation by computing an estimate of joint conditional probability that the messaging entity is non-reputable, given the set of non-reputable criteria to which the messaging entity correlates; and

combining the reputable probability and the non-reputable probability to determine a combined reputation for a messaging entity.

6. The method of claim 5, wherein determining a reputation score associated with the messaging entity based upon the analysis of the identified plurality of biasing characteristics comprises hash vault profiling messages from the messaging entity.

7. The method of claim 5, wherein determining a reputation score associated with the messaging entity based upon the analysis of the identified plurality of biasing characteristics comprises verifying a bounce address tag of a message from the messaging entity.

16. The method of claim 1, wherein the communication protocol comprises domain name service (DNS).

17. The method of claim 1, wherein the IP address includes an extension to the reputations score.

18. The method of claim 17, wherein the extension identifies at least one of:

an age of the reputation score, and input data used in determination of the score.

19. The method of claim 1, wherein the IP address comprises four bytes and is encoded such that a dotted-decimal value of a first one of the bytes identifies whether the reputation score is generally negative or generally positive, and the reputation score is capable of being derived at least in part from a dotted-decimal value of a second one of the bytes.

20. The method of claim 19, wherein the IP address is of a form IP=a.b.c.d, wherein each of a, b, c, and d comprise a respective dotted-decimal value, b comprises the first byte, c comprises the second byte, and the reputation score, rep, is to be encoded such that:

b=((rep−

|rep|)/(2*rep)

c=|rep|div 256; and

d=|rep|mod 256.

21. The method of claim 20, wherein the reputation score is derivable from the dotted-decimal values of c and d.

8. One or more non-transitory computer readable media for filtering communications stored on one or more computer systems, the one or more computer readable media being operable to cause one or more data processors associated with the one or more computer systems to perform operations comprising:

receiving a query comprising data that identifies a plurality of biasing characteristics related to a messaging entity associated with the communication;

analyzing the identified plurality of biasing characteristics related to the messaging entity associated with the communication based upon a plurality of criteria;

determining a reputation score associated with the messaging entity based upon the analysis of the identified plurality of biasing characteristics related to the messaging entity associated with the communication;

encoding the reputation score based at least in part on a communication protocol, wherein the reputation score is encoded in at least a portion of an IP address; and

transmitting the encoded reputation score as a response to the query.

9. The computer readable media of claim 8, the computer readable media being further operable to cause the processor to perform an operation comprising distributing the reputation score to one or more computer systems for use in filtering communications.

10. The computer readable media of claim 8, wherein the reputation scores is indicative numeric, textual or categorical reputations that are assigned to messaging entities based on characteristics of the messaging entities and their behavior, and wherein the numeric reputations comprise a continuous spectrum of reputable and non-reputable classifications.

11. The computer readable media of claim 8, the computer readable media being further operable to cause the processor to perform operations comprising:

determining reputation indicative probabilities based upon characteristics of the messaging entity; and

aggregating the reputation indicative probabilities to identify the reputation score;

wherein a reputation indicative probability indicates reputability of a messaging entity based upon extent to which a characteristic of the entity correlates to one or more reputation-related criteria.

12. The computer readable media of claim 8, the computer readable media being further operable to cause the processor to perform the operations comprising:

identifying a set of criteria for use in discriminating between reputable and non-reputable classifications, wherein the criteria include non-reputable criteria and reputable criteria;

using statistical sampling to estimate a conditional probability that a messaging entity includes each criteria;

computing a reputation for each messaging entity, comprising;

calculating a reputable probability that a messaging entity has a reputable reputation by computing an estimate of joint conditional probability that the messaging entity is reputable, given the set of reputable criteria to which the messaging entity correlates;

calculating a non-reputable probability that the messaging entity have a negative reputation by computing an estimate of joint conditional probability that the messaging entity is non-reputable, given the set of non-reputable criteria to which the messaging entity correlates; and

combining the reputable probability and the non-reputable probability to determine a combined reputation for a messaging entity.

13. The computer readable media of claim 8, wherein determining a reputation score associated with the messaging entity based upon the analysis of the identified plurality of biasing characteristics comprises hash vault profiling messages from the messaging entity.

14. The computer readable media of claim 8, wherein determining a reputation score associated with the messaging entity based upon the analysis of the identified plurality of biasing characteristics comprises verifying a bounce address tag of a message from the messaging entity.

15. A security system comprising:

at least one communication interface communicatively coupling the security system to one or more server systems;

a system data store capable of storing an electronic communication and accumulated data associated with received electronic communications; and

a system processor in communication with the system data store and the at least one communication interface, wherein the system processor comprises one or more processing elements and wherein the system processor performs operations comprising;

receiving a query comprising data that identifies a plurality of biasing characteristics related to a messaging entity associated with the communication;

analyzing the identified plurality of biasing characteristics related to the messaging entity associated with the communication based upon a plurality of criteria;

determining a reputation score associated with the messaging entity based upon the analysis of the identified plurality of biasing characteristics related to the messaging entity associated with the communication;

encoding the reputation score based at least in part on a communication protocol, wherein the reputation score is encoded in at least a portion of an IP address; and

transmitting the encoded reputation score as a response to the query.