Back to results
US 8,301,712 B1Granted
System and method for protecting mail servers from mail flood attacks
AssigneeEngate Technology Corporation
InventorsHaw-minn Lu, Richard Paul White
Life of this patent
Estimating the term…
Abstract
Most unsolicited commercial email (UCE) countermeasures call for a message by message analysis. However, some UCE attacks occur when a single sender of UCE floods a mail transfer agent (MTA) with a number of copies of a UCE, in a mail flood attack. The attacks rarely rise to the level of denial of service attacks but are significant enough to place a strain on MTAs and anti-UCE countermeasures. The anti-mail flood methodology disclosed herein provides a system and method for protecting mail systems from such mail flood attacks enabling anti-UCE countermeasures to work more efficiently.
Claims20
A method for controlling electronic mail flood attacks comprising:
- when an email request originated from a suspicious address class contained in a set of suspicious address classes, wherein the address class comprises a collection of at least one IP address,
- determining a count of active connections originating from the suspicious address class,
- determining a first interval of time since the count of connections has reached the predetermined number, and
- determining a second interval of time since a temporary failure was last issued to an email message originating from the suspicious address class;
- and
- when at least one of a set of at least one failure criteria is met, issuing a temporary failure message to the email request,
- wherein the set of at least one failure criteria comprises a first criterion which is met when the count of active connections reaches a predetermined maximum number, a second criterion which is met when the first interval is less than a first predetermined interval of time, and a third criterion which is met when the second interval is less than a second predetermined interval of time.
4 more elements
A system for controlling electronic mail flood attacks comprising:
- a means for determining a count of active connections originating from a suspicious address class when an email request originated from a suspicious address class contained in a set of suspicious address classes, wherein the address class comprises a collection of at least one IP address;
- a means for determining a first interval of time since the count of connections has reached the predetermined number;
- a means for determining a second interval of time since a temporary failure was last issued to an email message originating from the suspicious address class;
- and a means for issuing a temporary failure message to the email request;
- wherein the temporary failure message is issued when the email request originated from a suspicious address class and when at least one of a set of at least one failure criteria is met, issuing a temporary failure message to the email request,
- said set of at least one failure criteria comprises a first criterion which is met when the count of active connections reaches a predetermined maximum number, a second criterion which is met when the first interval is less than a first predetermined interval of time, and a third criterion which is met when the second interval is less than a second predetermined interval of time.
3 more elements
An network appliance comprising:
- a module selected from the group consisting of a content filter, anti-virus means, anti-UCE means, anti-phishing means, POP server, IMAP server, webmail server and any combination thereof;
- and
- an anti-mail flood attack system comprising:
- a means for determining a count of active connections originating from a suspicious address class when an email request originated from a suspicious address class contained in a set of suspicious address classes, wherein the address class comprises a collection of at least one IP address;
- a means for determining a first interval of time since the count of connections has reached the predetermined number;
- a means for determining a second interval of time since a temporary failure was last issued to an email message originating from the suspicious address class;
- and
- a means for issuing a temporary failure message to the email request;
- wherein the temporary failure message is issued when the email request originated from a suspicious address class and when at least one of a set of at least one failure criteria is met, issuing a temporary failure message to the email request,
- said set of at least one failure criteria comprises a first criterion which is met when the count of active connections reaches a predetermined maximum number, a second criterion which is met when the first interval is less than a first predetermined interval of time, and a third criterion which is met when the second interval is less than a second predetermined interval of time.
7 more elements
Dependencies are inferred from the claim text.