Real-time classification of email message traffic
AssigneeReturn Path, Inc.
InventorsBryan P. Dreller, Gregory J. Colburn, George M. Bilbrey
Life of this patent
Estimating the term…
Abstract
A classification system has a classification server that receives data for an email and determines if the email message is suspicious, legitimate but failing authentication, forwarded or fully authenticated and legitimate when the domains are owned, or not owned, by the domain owner. Email messages are categorized and presented in a report that enables the email sender to identify and fix a network, malicious traffic, and legitimate messages that have failed authentication beyond control. It also highlights where everything is going well.
Claims18
A classification system comprising:
- a classification processing device configured to receive aggregate level data for email messages and message level data for the email messages, the email messages each associated with a domain owned by a domain owner, wherein said classification processing device is configured to determine for each one of the email messages a category selected from suspicious, legitimate but failing authentication, forwarded, or legitimate based on the aggregate level data and the message level data, when the domain for the one of the email messages is known to be owned by the domain owner, wherein the aggregate level data is received directly from an interne service provider and includes Domain-based Message Authentication, Reporting and Conformance (DMARC) aggregate data.
A method of classification, the method comprising:
- receiving at a classification processing device, aggregate level data and message level data for email messages, the aggregate level data received directly from an internet service provider and including Domain-based Message Authentication, Reporting and Conformance (DMARC) aggregate data;
- and
- determining, at the classification processing device based on the aggregate and message level data, a category for each of the email messages, the categories including that the email message is suspicious, legitimate but failing authentication, forwarded, or legitimate when the domains are owned by the domain owner.
A classification system comprising:
- a classification processing device configured to receive aggregate level data and message level data for email messages each associated with a domain owner, the aggregate level data received directly from an internet service provider and including Domain-based Message Authentication, Reporting and Conformance (DMARC) aggregate data, and to determine if one of the email messages is suspicious based on the received aggregate level data and message level data;
- and,
- a phish detection processing device configured to determine that the suspicious email message is phishing if the email message is from a domain not owned by the domain owner.
Dependencies are inferred from the claim text.