# US 2014/0157409 A1 · Classifying a message based on fraud indicators > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157409 A1 - Document ID: US20140157409A1 - Status: Published application - Kind: A1 - Application number: 14/175,599 - Filed: 2014-02-07 - Published: 2014-06-05 - Earliest claimed: 2003-09-08 - Assignees: SonicWALL, Inc. - Applicants: SonicWALL, Inc. - Inventors: Jonathan Oliver; Scott D. Eikenberry; Gleb Budman; Brian Kim - Web page: https://patentgrep.com/patent/US20140157409A1 ## CPC - H04L 63/123: {received data contents, e.g. message integrity} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, methods, and media for classifying messages are disclosed. A plurality of fraud indicators are identified in the message. A signature of the message is generated. The generated signature of the message is compared to a stored signature. The stored signature is based on a statistical analysis of fraud indicators in a second message associated with the stored signature. A determination as to whether the message is fraudulent is made based on the comparison. The message is processed based on the determination that the message is a fraudulent message. ## Claims ### Claim 1 A system for classifying a message, comprising: a memory; a communications interface, wherein the communications interface receives the message over a communications network; and a processor, wherein the processor executes instructions stored in memory to: maintain a database for storing a plurality of signatures, identify a plurality of fraud indicators in the message, generate a signature for the message, compare the generated signature to a signature stored in the database, the stored signature based on a statistical analysis of fraud indicators in a second message associated with the stored signature; determine that the message is fraudulent based on the comparison; and process the message based on the determination that the message is a fraudulent message. ### Claim 2 (depends on 1) The system of claim 1, wherein the processor executes instructions stored in memory to determine whether the message is fraudulent by identifying a match between the stored signature and the generated signature. ### Claim 3 (depends on 1) The method of claim 1, wherein the processor executes instructions stored in memory to identify divergent reference points in the plurality of fraud indicators by identifying at least one good reference point in the message and at least one questionable reference point in the message. ### Claim 4 (depends on 1) The system of claim 1, wherein the processor executes instructions stored in memory to identify a plurality of fraud indicators in the message by searching a second database, and wherein the processor stores information concerning legitimate reference points. ### Claim 5 (depends on 3) The system of claim 3, wherein the processor executes instructions stored in memory to extract the fraud indicators from the message, and stores the fraud indicators in association with a message classification. ### Claim 6 (depends on 3) The system of claim 3, wherein the processor executes instructions stored in memory to extract the fraud indicators from the message, and stores the fraud indicators in association with the stored signature. ### Claim 7 (depends on 1) The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying at least one reference point for contacting an illegitimate source. ### Claim 8 (depends on 1) The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying a raw Internet Protocol (IP) address. ### Claim 9 (depends on 1) The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying a link with an embedded user name. ### Claim 10 (depends on 1) The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying a form in the message. ### Claim 11 (depends on 10) The system of claim 10, wherein the form includes a request for personal information from the user. ### Claim 12 (depends on 1) The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying non-standard encoding in the message. ### Claim 13 (depends on 1) The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying a link including a reference to an entity but not linking to the entity. ### Claim 14 (depends on 1) The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying a mismatched link name, the mismatched link name displaying a uniform resource locator (URL) but linking to a different URL. ### Claim 15 (depends on 1) The system of claim 1, wherein the processor executes instructions stored in memory to identify the plurality of fraud indicators by identifying content known to be associated with fraudulent messages. ### Claim 16 (depends on 1) The system of claim 1, wherein the database is shared among a plurality of users in a network. ### Claim 17 (depends on 1) The system of claim 1, wherein the processor executes instructions stored in memory to generate the signature of the message by applying a hash function to the content of the message. ### Claim 18 A system for classifying a message, comprising: a memory; a communications interface, wherein the communications interface receives the message over a communications network; a processor, wherein the processor executes instructions stored in memory to: extract a plurality of reference points from a body of the message, each reference point being information used to contact a referenced entity; classify each of the plurality of reference points based on a source associated with each reference point; determine whether the message is a fraudulent message appearing to be from a legitimate source based on the classified reference points; and process the message based on the determination of whether the message is a fraudulent message appearing to be from a legitimate source. ### Claim 19 (depends on 18) The system of claim 18, wherein the processor executes instructions stored in memory to classify the plurality of reference points by looking up the plurality of reference points in a database. ### Claim 20 (depends on 18) The system of claim 18, wherein the processor executes instructions stored in memory to: detect that the message is a fraudulent message appearing to be from a legitimate source by determining that the message includes divergent reference points, detect that the message is a fraudulent message appearing to be from a legitimate source by determining that the plurality of reference points includes a first reference point to a first source and a second reference point to a second source, detect that the message is a fraudulent message appearing to be from a legitimate source by determining that the plurality of reference points includes a first reference point to a legitimate source and a second reference point to a questionable source, detect that the message is a fraudulent message appearing to be from a legitimate source by determining that the plurality of reference points includes a first reference point to a first source and a second reference point to a second source, and the second reference point is intended to appear as a reference to the first source, compute a thumbprint of the message and stores the thumbprint to a database, compute a thumbprint of the message and storing the thumbprint to a shared database, identify a plurality of fraud indicators and applies a statistical analysis on the plurality of fraud indicators, quarantine the message, delete the message, provide an alert to a recipient of the message, provide an alert to a recipient of the message indicating that the message is a fraudulent message appearing to be from a legitimate source, or provide an explanation of the fraudulent message appearing to be from a legitimate source to a recipient.