Time zero classification of messages

• US 9,325,724 B2
• Filed: 08/28/2014
• Issued: 04/26/2016
• Est. Priority Date: 07/13/2004
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Rihn, Jennifer, Oliver, Jonathan J.
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US14/472,026
• Publication Number:
  US 20140373149A1
• Time in Patent Office: 607 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Detecting infectious messages comprises performing an individual characteristic analysis of a message to determine whether the message is suspicious, determining whether a similar message has been noted previously in the event that the message is determined to be suspicious, classifying the message according to its individual characteristics and its similarity to the noted message in the event that a similar message has been noted previously.

Claims

1. A method of classifying messages, the method comprising:

performing an individual characteristic analysis of a message, wherein the individual characteristic analysis includes comparing the individual characteristics of the message to individual characteristics of a previously received message, wherein the individual characteristic analysis yields a first probability of infection;

performing a traffic analysis of the message for identifying a spike in a number of previously received messages similar to the message, the previously received messages having been classified as suspicious, wherein the traffic analysis yields a second probability of infection;

determining an overall probability of infection based on the first probability and the second probability;

classifying the message as legitimate when the overall probability meets a threshold associated with legitimate messages, wherein the message is classified as suspicious or infectious when the overall probability fails to meet the threshold; and

processing the message in accordance with the classification, wherein the message is delivered when classified as legitimate or suspicious, and wherein the message is removed from a message queue when classified as infectious.

2. The method of claim 1, further comprising updating the overall probability and subsequently classifying the suspicious message as legitimate when the updated overall probability meets the threshold.

3. The method of claim 1, further comprising updating the overall probability and subsequently classifying the suspicious message as infectious when the updated overall probability meets another threshold associated with infectiousness.

4. The method of claim 1, wherein the individual characteristic analysis comprises a set of one or more tests.

5. The method of claim 4, wherein test results from the set of tests are weighted to determine the first probability.

6. The method of claim 4, wherein the tests are applied in a predetermined order.

7. The method of claim 4, wherein the set of tests for the received message is different than a set of tests selected for another received message.

8. The method of claim 1, wherein the traffic analysis pertains to one of a global network, a local network, or a subnet of the local network.

9. The method of claim 1, wherein the traffic analysis pertains to any combination of a global network, a local network, or a subnet of the local network.

10. A system of classifying messages, the system comprising:

a processor that executes;

a testing module stored in memory, wherein the testing module is executable to;

perform an individual characteristic analysis of a message, wherein the individual characteristic analysis includes comparing the individual characteristics of the message to individual characteristics of a previously received message, wherein the individual characteristic analysis yields a first probability of infection, and

perform a traffic analysis of the message for identifying a spike in a number of previously received messages similar to the message, the previously received messages having been classified as suspicious, wherein the traffic analysis yields a second probability of infection;

instructions stored in memory, wherein the instructions are executable to determine an overall probability of infection based on the first probability and the second probability;

a message classifier stored in memory, wherein the message classifier is executable to classify the message as legitimate when the overall probability meets a threshold associated with legitimate messages, wherein the message is classified as suspicious or infectious when the overall probability fails to meet the threshold; and

a message forwarding device that processes the message in accordance with the classification, wherein the message is delivered when classified as legitimate or suspicious, and wherein the message is removed from a message queue when classified as infectious.

11. The system of claim 10, wherein the processor executes further instructions to update the overall probability and to subsequently classify the suspicious message as legitimate when the updated overall probability meets the threshold.

12. The system of claim 10, wherein the processor executes further instructions to update the overall probability and to subsequently classify the suspicious message as infectious when the updated overall probability meets another threshold associated with infectiousness.

13. The system of claim 10, wherein the individual characteristic analysis comprises a set of one or more tests.

14. The system of claim 13, wherein test results from the set of tests are weighted to determine the first probability.

15. The system of claim 13, wherein the tests are applied in a predetermined order.

16. The system of claim 13, wherein the set of tests for the received message is different than a set of tests selected for another received message.

17. The system of claim 10, wherein the traffic analysis pertains to one of a global network, a local network, or a subnet of the local network.

18. The system of claim 10, wherein the traffic analysis pertains to any combination of a global network, a local network, or a subnet of the local network.

19. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method of classifying messages, the method comprising:

performing an individual characteristic analysis of a message, wherein the individual characteristic analysis includes comparing the individual characteristics of the message to individual characteristics of a previously received message, wherein the individual characteristic analysis yields a first probability of infection;

performing a traffic analysis of the message for identifying a spike in a number of previously received messages similar to the message, the previously received messages having been classified as suspicious, wherein the traffic analysis yields a second probability of infection;

determining an overall probability of infection based on the first probability and the second probability;

classifying the message as legitimate when the overall probability meets a threshold associated with legitimate messages, wherein the message is classified as suspicious when the overall probability fails to meet the threshold; and

processing the message in accordance with the classification, wherein the message is delivered when classified as legitimate or suspicious, and wherein the message is removed from a message queue when classified as infectious.