Time zero detection of infectious messages
AssigneeSonicWALL, Inc.
InventorsJennifer Rihn, Jonathan J. Oliver
Life of this patent
Estimating the term…
Abstract
Detecting infectious messages comprises performing an individual characteristic analysis of a message to determine whether the message is suspicious, determining whether a similar message has been noted previously in the event that the message is determined to be suspicious, classifying the message according to its individual characteristics and its similarity to the noted message in the event that a similar message has been noted previously.
Claims19
A method of detecting infectious messages, the method comprising:
- generating a first probability of infection based on an individual characteristic analysis of a message, wherein the individual characteristic analysis includes comparing the individual characteristics of the message to individual characteristics of a previously received message;
- generating a second probability of infection based on a traffic analysis of the message for identifying a spike in a number of previously received messages similar to the message, the previously received messages having been classified as suspicious;
- determining an overall probability of infection based on the first probability and the second probability;
- and
- classifying the message as legitimate based on the overall probability meeting a threshold associated with legitimate messages, wherein the message is classified as suspicious based on failure of the overall probability to meet the threshold.
A system of detecting infectious messages, the system comprising:
- a processor that executes:
- a testing module stored in memory, wherein the testing module is executable to:
- generate a first probability of infection based on an individual characteristic analysis of a message, wherein the individual characteristic analysis includes comparing the individual characteristics of the message to individual characteristics of a previously received message, and
- generate a second probability of infection based on a traffic analysis of the message for identifying a spike in a number of previously received messages similar to the message, the previously received messages having been classified as suspicious;
- instructions stored in memory, wherein the instructions are executable to determine an overall probability of infection based on the first probability and the second probability;
- and
- a message classifier stored in memory, wherein the message classifier is executable to classify the message as legitimate based on the overall probability meeting a threshold associated with legitimate messages, wherein the message is classified as suspicious based on failure of the overall probability to meet the threshold.
A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method of detecting infectious messages, the method comprising:
- generating a first probability of infection based on an individual characteristic analysis of a message, wherein the individual characteristic analysis includes comparing the individual characteristics of the message to individual characteristics of a previously received message;
- generating a second probability of infection based on a traffic analysis of the message for identifying a spike in a number of previously received messages similar to the message, the previously received messages having been classified as suspicious;
- determining an overall probability of infection based on the first probability and the second probability;
- and
- classifying the message as legitimate based on the overall probability meeting a threshold associated with legitimate messages, wherein the message is classified as suspicious based on failure of the overall probability to meet the threshold.
Dependencies are inferred from the claim text.