Classifying a message based on likelihood of spoofing

• US 9,860,167 B2
• Filed: 08/03/2015
• Issued: 01/02/2018
• Est. Priority Date: 02/10/2004
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan J., Koblas, David A.
• Primary Examiner(s): Ton, Dang
• Application Number:
  US14/816,900
• Publication Number:
  US 20150341264A1
• Time in Patent Office: 883 Days
• Field of Search: 370339
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/40 using split connections
• CPC Class Codes: H04L 49/15 Interconnection of switching modules
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A technique for determining a boundary IP address is disclosed. The technique includes processing a header to extract candidate IP address, locating a gateway IP address, and selecting the boundary IP address based on the location of the gateway IP address.

Claims

1. A method of classifying a message transmitted over a network, the method comprising:

receiving the message transmitted over the network and addressed to a recipient; and

executing instructions stored in a non-transitory computer readable storage medium to;

identify one or more domains from which the received message is purported to have traversed,

identify that the identified domains appear on a whitelist associated with the recipient,

identify whether at least one domain of the one or more domains has been spoofed based on whether a common classification appears across a plurality of IP addresses associated with the one or more domains, wherein;

the one or more domains are identified not to be spoofed when the one or more domains are in the whitelist and have the common classification appearing across the plurality of IP addresses, and

the at least one domain of the one or more domains is identified to be spoofed when the one or more domains are in the whitelist and have different classifications associated with the plurality of IP addresses, and

classify the received message based on the identification that the at least one domain of the one or more domains has been or has not been spoofed.

2. The method of claim 1, wherein identifying that the one or more domains from which the received message is purported to have traversed includes identifying a stated sender domain associated with the received message.

3. The method of claim 1, wherein classifying the received message comprises assigning a score to the received message based on the identifying that the at least one domain has been spoofed.

4. The method of claim 3, wherein assigning the score is further based on one or more classification variables.

5. The method of claim 4, further comprising weighting the classification variables based on a source of the classification.

6. The method of claim 4, further comprising decaying the classification variables over time, wherein decaying the classification variables reduces the effect of older classifications over time.

7. The method of claim 3, wherein assigning the score includes identifying a spam ratio.

8. The method of claim 3, wherein assigning the score includes identifying a spam rate.

9. The method of claim 3, wherein assigning the score includes identifying an estimated instantaneous spam rate.

10. A system of classifying a message transmitted over a network, the system comprising:

a communication interface that receives the message transmitted over the network and addressed to a recipient; and

a processor that executes instructions stored in a non-transitory computer readable storage medium to;

identify one or more associated domains from which the received message is purported to have traversed,

identify that the identified domains appear on a whitelist associated with the recipient,

identify whether at least one domain of the one or more domains has been spoofed based on whether a common classification appears across a plurality of IP addresses associated with the one or more domains, wherein;

the one or more domains are identified as not to be spoofed when the one or more domains are in the whitelist and have the common classification appearing across the plurality of IP addresses, and

the at least one domain of the one or more domains is identified to be spoofed when the one or domains are in the whitelist and have different classifications associated with the plurality of IP addresses, and

classify the received message based on the identification that the at least one domain of the one or more domains has has been or has not been spoofed.

11. The system of claim 10, wherein the processor identifies that the one or more domains from which the received message is purported to have traversed by identifying a stated sender domain associated with the received message.

12. The system of claim 10, wherein the processor classifies the received message by assigning a score to the received message based on the identification that the domain has been spoofed.

13. The system of claim 12, wherein assigning the score is further based on one or more classification variables.

14. The system of claim 13, wherein the classification variables are weighted based on a source of the classification.

15. The system of claim 13, wherein the classification variables decay over time.

16. The system of claim 12, wherein assigning the score includes identifying a spam ratio.

17. The system of claim 12, wherein assigning the score includes identifying a spam rate.

18. The system of claim 12, wherein assigning the score includes identifying an estimated instantaneous spam rate.

19. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for classifying a message transmitted over a network, the method comprising:

receiving the message transmitted over the network and addressed to a recipient;

identifying one or more associated domains from which the received message is purported to have traversed;

identifying that the one or more identified domains determined domain appears in a whitelist associated with the recipient;

identifying whether at least one domain of the one or more domains have been spoofed based on whether a common classification appears across a plurality of IP addresses associated with the one or more domains, wherein;

the one or more domains are identified as not to be spoofed when the one or more domains are in whitelist and have the common classification appearing across the plurality of IP addresses, and

the at least one domain is of the one or more domains are identified to be spoofed when the received message is on the whitelist but have different classifications appearing across the plurality of IP addresses; and

classifying the received message based on the identification that the one or more domains has been or has not been spoofed.

20. The non-transitory computer-readable storage medium of claim 19, wherein the identifying that the one or more domains from which the received message is purported to have traversed includes identifying a stated sender domain associated with the received message.