Processing a message based on a boundary IP address and decay variable

• US 9,100,335 B2
• Filed: 02/15/2008
• Issued: 08/04/2015
• Est. Priority Date: 02/10/2004
• Status: Expired due to Term

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Oliver, Jonathan J., Koblas, David A.
• Primary Examiner(s): HENDERSON, ESTHER BENOIT
• Application Number:
  US12/070,164
• Publication Number:
  US 20080147857A1
• Time in Patent Office: 2,727 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/40 using split connections
• CPC Class Codes: H04L 49/15 Interconnection of switching modules
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A technique for determining a boundary IP address is disclosed. The technique includes processing a header to extract candidate IP address, locating a gateway IP address, and selecting the boundary IP address based on the location of the gateway IP address.

Claims

1. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a computer to perform a method of processing an electronic mail message based on a determined boundary IP address and decaying classification variable, the method comprising:

processing the header of an electronic-mail message to extract a plurality of candidate IP addresses and corresponding domains;

storing each extracted domain and IP address in an array;

locating a gateway IP address from the extracted candidate IP addresses stored in the array;

selecting the boundary IP address based on a pattern identified in a series of previously received electronic-mail messages;

looking up the boundary IP address and corresponding domain in a reputation table, wherein the corresponding domain is from a different hop along a path of the electronic-mail message than the boundary IP address and the presence of the boundary IP address and corresponding domain in the reputation table is included in a classification of the electronic mail-message, the reputation table including a decaying classification variable that reduces the effect of an older classification;

classifying the electronic-mail message and

processing the electronic-mail message in accordance with the classification of the electronic-mail message.

2. The non-transitory computer-readable storage medium of claim 1, wherein the domain and IP address are extracted from each ‘

received;

from’

line in the electronic-mail message header.

3. The non-transitory computer-readable storage medium of claim 1, wherein the gateway IP address is a known IP address within a trusted user network.

4. The non-transitory computer-readable storage medium of claim 1, wherein the gateway IP address is located by marching down the array.

5. The non-transitory computer-readable storage medium of claim 4, wherein a comparison is performed at each step of marching down the array.

6. The non-transitory computer-readable storage medium of claim 1, wherein the boundary IP address is the IP address located after the gateway IP address.

7. The non-transitory computer-readable storage medium of claim 1, wherein the boundary IP address is the IP address located last in the header of the electronic-mail message.

8. The non-transitory computer-readable storage medium of claim 1, the method further comprising analyzing reverse domain information, wherein the results of the reverse domain analysis is also included in the classification of the electronic-mail message.

9. The non-transitory computer-readable storage medium of claim 8, wherein analysis of the reverse domain information includes verifying that the domain is the same domain, the verification reflecting that the domain and associated IP address are trusted.

10. The non-transitory computer-readable storage medium of claim 1, wherein the classification of the electronic-mail message is that the electronic-mail message involves spoofing of sender information.

11. The non-transitory computer-readable storage medium of claim 1, wherein the classification of the electronic-mail message is that the message is spam.

12. The non-transitory computer-readable storage medium of claim 1, wherein the classification of the electronic-mail message is that the message is not spam.

13. The non-transitory computer-readable storage medium of claim 1, wherein the classification of the electronic-mail message is that the message is likely spam.

14. The non-transitory computer-readable storage medium of claim 1, the method further comprising overriding a white list based on the classification of the electronic-mail message.

15. The non-transitory computer-readable storage medium of claim 1, the method further comprising overriding a black list based on the classification of the electronic-mail message.

16. The non-transitory computer-readable storage medium of claim 1, wherein decay of the classification variable is linear.

17. The non-transitory computer-readable storage medium of claim 1, wherein decay of the classification variable is exponential.

18. The non-transitory computer-readable storage medium of claim 1, wherein decay of the classification variable periodically occurs.

19. The non-transitory computer-readable storage medium of claim 1, wherein decay of the classification variable occurs immediately prior to incrementing the variable.