Time zero classification of messages

• US 9,516,047 B2
• Filed: 04/20/2016
• Issued: 12/06/2016
• Est. Priority Date: 07/13/2004
• Status: Active Grant

• Current Assignee: SonicWALL US Holdings, Inc. (SonicWall Holdings Ltd.)
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Rihn, Jennifer, Oliver, Jonathan J.
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US15/133,824
• Publication Number:
  US 20160234233A1
• Time in Patent Office: 230 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Detecting infectious messages comprises performing an individual characteristic analysis of a message to determine whether the message is suspicious, determining whether a similar message has been noted previously in the event that the message is determined to be suspicious, classifying the message according to its individual characteristics and its similarity to the noted message in the event that a similar message has been noted previously.

Claims

1. A method of re-classifying messages, the method comprising:

classifying one or more previously received messages, wherein the classification is based on intrinsic characteristics and traffic information associated with the one or more previously received message;

receiving a new message, wherein the new message has not yet been classified;

executing instructions stored in memory, wherein execution of the instructions by a processor;

analyzes intrinsic characteristics of the new message, wherein the intrinsic characteristic analysis yields a first probability that the received message is infectious, and wherein the intrinsic characteristics identifies that the new message is similar to one or more of the previously received messages that have been classified as being legitimate,

analyzes traffic information associated with the new message, wherein the traffic information analysis yields a second probability that the new message is infectious,

identifies the one or more previously received messages that were previously classified and identified as similar to the new message, and

reclassifies the one or more previously received messages as being infectious.

2. The method of claim 1, wherein messages classified as legitimate are forwarded for the user to view.

3. The method of claim 1, wherein messages classified as infectious are quarantined or deleted.

4. The method of claim 1, wherein reclassification of a previously legitimate message as infectious prompts notification of the reclassification of the previously received messages to the recipient or system administrator.

5. The method of claim 4, wherein the notification includes warnings or log messages.

6. The method of claim 1, wherein reclassification of a previously legitimate message as infectious prompts instructions directing that the reclassified messages be dropped if the previously received messages are still in a send queue to be forwarded to the recipient.

7. A system of reclassifying messages, the system comprising:

a message forwarding device that receives new messages, wherein the new messages have not yet been classified; and

a detection mechanism that includes instructions stored in memory to be executed by a processor, wherein the instructions are executed by the processor to;

classify one or more previously received messages, wherein the classification is based on intrinsic characteristics and traffic information associated with the one or more previously received message,

analyze intrinsic characteristics of the new message, wherein the intrinsic characteristic analysis yields a first probability that the received message is infectious, and wherein the intrinsic characteristics identifies that the new message is similar to one or more of the previously received messages that have been classified as being legitimate,

analyze traffic information associated with the new message, wherein the traffic information analysis yields a second probability that the new message is infectious,

identify the one or more previously received messages that were previously classified and identified as similar to the new message, and

reclassify the one or more previously received messages as being infectious.

8. The system of claim 7, wherein the message forwarding device forwards the received message when the received message is classified as legitimate.

9. The system of claim 7, wherein the message forwarding device quarantines or deletes the received message when the received message is classified as suspicious.

10. The system of claim 7, wherein reclassification of a previously legitimate message as infectious prompts notification of the reclassification of the previously received messages to the recipient or system administrator.

11. The system of claim 10, wherein the notification includes warnings or log messages.

12. The system of claim 10, wherein reclassification of a previously legitimate message as being infectious prompts instructions directing that the reclassified messages be dropped if the previously received messages are still in a send queue to be forwarded to the recipient.

13. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method of re-classifying messages, the method comprising:

classifying one or more previously received messages, wherein the classification is based on intrinsic characteristics and traffic information associated with the one or more previously received message;

receiving a new message, wherein the new message has not yet been classified;

analyzing intrinsic characteristics of the new message, wherein the intrinsic characteristic analysis yields a first probability that the received message is infectious, and wherein the intrinsic characteristics identifies that the new message is similar to one or more of the previously received messages that have been classified as being legitimate;

analyzing traffic information associated with the new message, wherein the traffic information analysis yields a second probability that the new message is infectious;

identifying the one or more previously received messages that were previously classified and identified as similar to the new message; and

reclassifying the one or more previously received messages as being infectious.

14. The non-transitory computer readable storage medium of claim 13, further comprising executable instructions for forwarding messages classified as legitimate.

15. The non-transitory computer readable storage medium of claim 13, further comprising executable instructions for quarantining or deleting messages classified as infectious.

16. The non-transitory computer readable storage medium of claim 13, wherein reclassification of a previously legitimate message as infectious prompts notification of the reclassification of the previously received messages to the recipient or system administrator.

17. The non-transitory computer readable storage medium of claim 16, wherein the notification includes warnings or log messages.

18. The non-transitory computer readable storage medium of claim 13, wherein reclassification of a previously legitimate message as being infectious prompts instructions directing that the reclassified messages be dropped if the previously received messages are still in a send queue to be forwarded to the recipient.