CN101558398A - 基于被引用资源的概率分析检测不想要的电子邮件消息 - Google Patents

基于被引用资源的概率分析检测不想要的电子邮件消息 Download PDF

Info

Publication number
CN101558398A
CN101558398A CNA2006800194833A CN200680019483A CN101558398A CN 101558398 A CN101558398 A CN 101558398A CN A2006800194833 A CNA2006800194833 A CN A2006800194833A CN 200680019483 A CN200680019483 A CN 200680019483A CN 101558398 A CN101558398 A CN 101558398A
Authority
CN
China
Prior art keywords
network resource
resource identifier
message
blacklist
network
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CNA2006800194833A
Other languages
English (en)
Other versions
CN101558398B (zh
Inventor
丹尼尔·昆兰
詹森·克尔
杰弗里·韦斯科特
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Cisco IronPort Systems Inc
Original Assignee
IronPort Systems Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by IronPort Systems Inc filed Critical IronPort Systems Inc
Publication of CN101558398A publication Critical patent/CN101558398A/zh
Application granted granted Critical
Publication of CN101558398B publication Critical patent/CN101558398B/zh
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/21—Monitoring or handling of messages
    • H04L51/212—Monitoring or handling of messages using filtering or selective blocking
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/10—Office automation; Time management
    • G06Q10/107—Computer-aided management of electronic mailing [e-mailing]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/21—Monitoring or handling of messages
    • H04L51/234—Monitoring or handling of messages for tracking messages
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]

Abstract

在一个实施例中，基于被引用资源的概率分析检测不想要的电子邮件消息包括：接收白名单和阻止列表，其各自包括多个已经出现在在先消息中的网络资源标识符；取得特定的网络资源标识符；生成针对该特定网络资源标识符的属性列表；使用属性训练概率过滤器；以及针对白名单和阻止列表中的所有网络资源标识符重复上述取得、生成和训练步骤。随后，当接收到电子邮件消息并且其包含URL或其他网络资源标识符时，可以通过利用经训练的概率过滤器测试网络资源标识符的属性来生成针对该消息的垃圾邮件得分或威胁得分。

Description

基于被引用资源的概率分析检测不想要的电子邮件消息
技术领域
本发明一般地涉及网络数据通信。更具体而言，本发明涉及对不想要的电子邮件消息或与垃圾邮件(spam)、病毒(virus)或其他威胁(threat)相关的电子邮件消息的处理。
背景技术
在本部分中描述的方法可以是已经实现的，但不一定是先前已经设想到或实现的方法。因此，除非另外指示，否则本部分中描述的方法不是针对本申请权利要求的现有技术，并且不因包括在本部分中而被承认是现有技术。
作为不想要的或者不请自来的电子邮件消息(“垃圾邮件”)或者包含病毒或诸如“网络钓鱼(phishing)”攻击之类的其他威胁的电子邮件消息的发送者通常使用某些手段来掩盖该消息是不想要的或不请自来的或包含病毒或其他威胁的事实。消息可以具有主题行、发送者名称(“From：”值)，以及看起来合法的其他元素。另外，消息可能设法使电子系统难以确定消息的意图。但是，消息可以包含超级链接、统一资源指示符(URI)、统一资源定位符(URL)或与垃圾邮件、病毒或其他威胁相关联的其他网络资源标识符。当用户选择(“点击”)这种消息中的超级链接时，用户的浏览器将用户定向到递送病毒、广告软件或间谍软件的有害的或不合需要的网页，或者尝试引导用户公开个人信息或金融信息，或者导向到不合需要的内容，例如广告或色情内容。
其他时间，URL访问向垃圾邮件引擎回报垃圾邮件消息“成功”递送的可执行代码或脚本。再另外的时间，URL旨在用于垃圾邮件所涉及的任何商品的点入式营销(click-through marketing)。
因此，当消息被接收时，基于对消息内容的典型分析，威胁检测系统和其他分析工具通常无法判定消息是否是垃圾邮件或者与威胁相关联。
附图说明
本发明在附图中以示例方式而非限制方式示出，在附图中，相似标号指示相似元件，其中：
图1是示出可被用于实现实施例的示例性网络布置的框图；
图2A是示出基于接收到的消息中的网络资源标识符来训练概率过滤器(probabilistic filter)的一个实施例的高级概况的流程图；
图2B是示出测试接收到的消息是否是垃圾邮件或与威胁相关联的一个实施例的高级概况的流程图；
图2C是示出判定是否将网络资源标识符添加到阻止列表(block list)的一个实施例的高级概况的流程图；
图2D是示出将阻止列表传送到消息传递网关并使用阻止列表来过滤消息的一个实施例的高级概况的流程图；
图3是示出域名系统(DNS)服务器中的记录的框图；以及
图4是示出可以在其上实现实施例的计算机系统的框图。
具体实施方式
用于基于对被引用资源的概率分析来检测不合需要的电子邮件消息的方法和装置被描述。在以下描述中，出于说明的目的而提出多个特定细节，以便对本发明提供全面理解。但是，本领域技术人员显而易见，本发明在没有这些特定细节的情况下也可以实现。在其他实例中，公知的结构和设备以框图形式示出，以免不必要地模糊本发明。
这里根据以下大纲来描述实施例：
1.0总体概述
2.0结构和功能概述
2.1示例性结构布置
2.2功能概述
3.0实现机制——硬件概述
4.0扩展和替代
1.0总体概述
在前面“背景技术”中提及的需求以及将从以下描述中显现出来的其他需求和目的被本发明所实现，在一个方面中，本发明包括通过下述操作来基于对被引用资源的概率分析检测不想要的电子邮件消息的方法：取得白名单，该白名单包括已被包括在过去的电子邮件消息中的多个第一网络资源标识符；从白名单取得特定的第一网络资源标识符；生成针对该特定第一网络资源标识符的第一属性列表；使用所述属性来训练概率过滤器；针对白名单中的所有第一网络资源标识符重复提取、取得和训练操作；取得阻止列表，该阻止列表包括已被包括在与垃圾邮件或威胁相关联的过去的电子邮件消息中的多个第二网络资源标识符；从阻止列表取得特定的第二网络资源标识符；生成针对该特定的第二网络资源标识符的第二属性列表；使用所述属性来训练概率过滤器；针对阻止列表中的所有第二网络资源标识符重复提取、取得和训练操作。
在一个特征中，该方法还包括接收第三网络资源标识符；使用经训练的概率过滤器来测试第三网络资源标识符并接收指示第三网络资源标识符与垃圾邮件或威胁相关联的概率的概率输出；当概率输出大于第一指定阈值时，将第三网络资源标识符添加到黑名单。
在另一特征中，生成第二属性列表的操作包括：提取出第二网络资源标识符的域部分；从域名系统取得与提取出的域部分相关联的一个或多个邮件交换记录；从域名系统取得在邮件交换记录中标识的每个邮件服务器的每个地址记录；取得与每个地址记录的网络地址相关联的声誉得分值；当平均声誉得分值小于指定阈值时，将该网络资源标识符添加到黑名单。
在又一特征中，网络资源标识符是统一资源定位符(URL)。
在又一特征中，生成第二属性列表的操作包括：提取出第二网络资源标识符的域部分；从域名系统取得与提取出的域部分相关联的一个或多个名称服务器记录；从域名系统取得在名称服务器记录中标识的每个邮件服务器的每个地址记录；取得与每个地址记录的网络地址相关联的声誉得分值；当平均声誉得分值小于指定阈值时，将该网络资源标识符添加到黑名单。
在又一特征中，该方法还包括将黑名单发送到耦合到网络的多个消息传递网关设备。
在另一特征中，黑名单与先前识别出的阻止列表相分离。
在又一特征中，该方法还包括在消息传递网关处接收黑名单的拷贝；在消息传递网关处，接收包含统一资源定位符(URL)的电子邮件消息；提取出URL并判定该URL是否在黑名单的拷贝中；当URL在黑名单的拷贝中时，修改与该电子邮件消息相关联的威胁得分值。
在本描述中，威胁可以包括病毒、网络钓鱼攻击和网址嫁接(pharming)攻击中的任何一种。在此上下文中，“网络钓鱼攻击”指的是由以下行为表征的犯罪行为形式：通过在明显官方的电子通信(例如电子邮件)中化妆成值得信任的人或企业来企图骗取敏感信息，例如密码或信用卡细节。该术语是由于使用越来越先进的诱饵来“钓取”用户的金融信息和密码而得名的。“网址嫁接”指的是非法利用DNS服务器软件的脆弱性，所述DNS服务器软件允许计算机用户获取站点的域名或将例如该网站的流量重定向到另一网站。
在其他方面中，本发明包括被配置用于执行上述步骤的电子邮件服务器、其他计算机装置和计算机可读介质。
2.0结构和功能概述
2.1示例性结构布置
图1是可被用来实现实施例的示例性网络布置的框图。出于说明清晰示例的目的，这里的部分描述提到了垃圾邮件消息。但是，其他实施例可以用于包含任何形式的消息承载的威胁或问题或与这样的威胁或问题相关的消息，例如垃圾邮件或不请自来的消息、包含“网络钓鱼”攻击或其他欺骗性或有害内容的消息。因此，这里的宽泛方法不局限于对垃圾邮件起作用的系统。此外，实施例可以测试“正常邮件(ham)”消息并提供指示这些消息不是垃圾邮件或不与威胁相关联的输出。
现在参考图1，威胁发送者100的身份和位置通常是未知的，该威胁发送者100被直接或间接耦合到公共网络102，并通常在电子消息或电子邮件中将消息发送到公共网络。消息被寻址到多个接收者或目的地，例如私有网络110中的计算机120A、120B、120C的用户的账户、威胁信息源104和威胁陷阱(trap)106。消息包括垃圾邮件，其包含诸如病毒之类的威胁，或包含呈现垃圾邮件内容或恶毒或有害的网络资源的网络标识符。
威胁信息源104包括消息签名的网络可访问源、黑名单、白名单或标识作为垃圾邮件或有害的消息或其发送者的其他信息。作为附加或替换，威胁信息源104可以包括在万维网上的域“spamcop.net”可访问的SpamCop信息服务，或SpamCop服务的用户。SpamCop包括用于跟踪与垃圾邮件、正常邮件和概率得分相关联的URL、主机名和IP地址的数据库。
威胁信息源104可以包括由一个或多个因特网服务提供商或其他大量邮件接收者拥有、操作或管理的服务或数据库。
在另一替换实施例中，作为对这里的自动方法的补充，威胁信息源104可以包括对由信息服务顾问或分析员或外部源获得的数据的手动审查。例如，在大多数情况下，监视来自防垃圾邮件供应商、防病毒供应商、第三方供应商、防垃圾邮件列表或防病毒邮件列表、垃圾邮件陷阱(spamtrap)或威胁陷阱数据和其他源的警告的人类管理员可以在对防垃圾邮件软件或处理规则的更新被发布之前检测到垃圾邮件。
威胁陷阱106是专用于收集关于包含垃圾邮件或与威胁相关的电子邮件消息的信息的电子邮件地址、账户或邮箱。为了说明简单示例，图1仅以威胁信息源104和威胁陷阱106的形式示出两个目的地，但是在实际实施例中，可能存在任何数目的这样的垃圾邮件信息源。
威胁发送者100可以获得来自公共来源、购买的电子邮件地址列表、在线张贴等的威胁陷阱106和计算机120A、120B、120C的网络地址。
威胁信息处理器108可通信地耦合到公共网络102，并且可以从威胁信息源104和威胁陷阱106接收信息。威胁信息处理器108实现这里进一步描述的某些功能，包括从威胁信息源104和威胁陷阱106收集垃圾邮件和威胁信息、生成垃圾邮件和威胁发作信息，并且将发作信息存储在数据库112中。
网络资源150和网站152被耦合到公共网络102。网络资源150可以包括网络可访问的可执行计算机程序代码、脚本或其他软件元件。网络资源150还可以包括网站152、文件服务器或任何其他网络可访问的信息资源。在各种实施例中，可能存在任何数目的耦合到网络102的网络资源150和网站152。在本描述中，术语“网络资源标识符”泛指标识任何种类的网络资源的任何数据；因此，“网络资源标识符”可以是URL、URI、超级链接、域名、主机名等等。
一个或多个域名服务(DNS)服务器160被耦合到公共网络102。每个DNS服务器160存储DNS记录，所述DNS记录可被用于将域名解析成网络地址，例如IP地址、与域名相关联的邮件交换(MX)服务器的名称、名称服务器记录等等。
现有的公共URI阻止列表140被耦合到公共网络102。阻止列表140一般包括已经在垃圾邮件消息中广告的统一资源定位符(URI)的列表。在实施例中，阻止列表140包括其他都针对在垃圾邮件消息中找到的域的阻止列表的集合。在阻止列表140中的信息可以使用DNS查找来访问，所述DNS查找需要连通因特网并且需要相对较长的等待时间才能获得结果。在实施例中，因为阻止列表140包括列表的集合，因此来自阻止列表140的每个输出条目被标注以一个位掩码，其标识该域出现在哪个或哪些列表上。
消息传递网关107被直接或通过防火墙111或其他网络元件间接耦合在公共网络102和私有网络110之间，所述私有网络110包括多个末端站120A、120B、120C。消息传递网关107可以与邮件传送代理109集成在一起，该邮件传送代109处理针对私有网络110的邮件，或者该邮件传送代理可以被单独部署。例如，诸如商业上可从加州San Bruno的IronPort Systems公司获得的C60、C30、C10、X1000型等等的IronPort消息传递网关设备(MGA)可以实现邮件传送代理109、防火墙111和这里针对消息传递网关107描述的功能。
在实施例中，消息传递网关107包括病毒信息逻辑114，其用于获得来自威胁信息处理器108的病毒发作信息，并根据在消息传递网关处设置的策略来处理以末端站120A、120B、120C为目的地的消息。这种病毒信息逻辑可以与消息传递网关107的内容过滤功能集成在一起。
消息传递网关107还可以包括防病毒检查器116(例如ClamAV)、内容过滤器118和防垃圾邮件逻辑119(例如SpamAssassin模块)。防病毒检查器116可以例如包括Sophos防病毒软件。内容过滤器118提供用于限制在消息主题或消息主体中包含根据与私有网络110相关联的策略不可接受的内容的消息的递送或接受。防垃圾邮件逻辑119扫描进入消息以根据邮件接受策略(例如进入消息是否是不请自来的商业邮件)来判定它们是否是不想要的消息，并且防垃圾邮件逻辑119应用策略来限制对任何不想要的消息的递送，重定向或拒绝接受不想要的消息。防垃圾邮件逻辑可以与本地黑名单通信，所述本地黑名单标识已经在垃圾邮件消息中广告的网络资源(例如网络资源150、网站152)的标识符或被禁止的发送者。
这里使用的术语“邮件服务器”包括消息传递网关107、邮件传送代理、邮件交换和接收并转发电子邮件消息的任何其他数据处理单元、服务器、软件或系统。
私有网络110可以是与商业企业相关联的企业网络或需要增强安全性或保护的任何其他形式的网络。公共网络102和私有网络110可以使用开放标准协议(例如TCP/IP)进行通信。
威胁信息源104可以包括消息传递网关107的另一实例，其介于公共网络102和另一私有网络(为了清晰而未示出)之间以保护该另一私有网络。在一个实施例中，威胁信息源104是IronPort MGA。
威胁陷阱106与一个或多个电子邮件地址或电子邮件邮箱相关联，这一个或多个电子邮件地址或电子邮件邮箱与一个或多个域相关联。威胁陷阱106被建立以用于接收不请自来的电子邮件消息或“垃圾邮件”以供分析或报告，并且威胁陷阱106通常不用于传统的电子邮件通信。例如，垃圾邮件陷阱可以是诸如dummyaccountforspam@mycompany.com之类的电子邮件地址，或者垃圾邮件陷阱可以是被组成MX型DNS记录(接收到的电子邮件信息被提供给该记录)的电子邮件地址的集合。邮件传送代理109或另一IronPort MGA的邮件传送代理可以容宿威胁陷阱106。
在实施例中，威胁信息源104生成并提供信息到威胁信息处理器108以用于管理计算机病毒发作，并且威胁信息处理器108可以从威胁陷阱106获得信息以用于相同目的。例如，威胁信息源104生成接收到的具有可疑附件的消息的计数，并将该计数提供到威胁信息处理器108，或者允许外部进程取得该计数并将它们存储在专门数据库中。消息传递网关107也可以通过以下操作来充当病毒信息源：检测具有与病毒相关或在其他方面可疑的指示的消息；创建在特定时间段内接收的可疑消息的计数；并且周期性地将该计数提供到威胁信息处理器108。
作为特定示例，这里描述的功能可被实现为全面消息数据收集部件或报告设施(例如来自IronPort Systems公司的SenderBase服务)的一部分。在本实施例中，威胁信息处理器108可以从威胁信息源104和威胁陷阱106取得或接收信息，生成针对由防垃圾邮件逻辑119确定为垃圾邮件或具有可疑附件或被防病毒检查器116指示为具有病毒指示符的消息的发送者的声誉得分，并利用声誉得分更新数据库112，以供消息传递网关107的防垃圾邮件逻辑119和病毒信息逻辑114以后取得和使用。
威胁信息处理器108包括一个或多个分析消息并生成信息的服务器、系统或服务，所述信息可以被消息传递网关107和部署在私有网络中或耦合到公共网络102的其他消息传递网关所使用。威胁信息处理器108可以包括或可通信地耦合到威胁操作中心(TOC)、接收病毒得分(RVS)处理器或其两者。TOC和RVS处理器可以与威胁信息处理器108分离开，但被可通信地耦合到数据库112和公共网络102。TOC可以实现为每日24小时、每周7日都有人员可用的职员中心，用于监视威胁信息处理器108收集的被存储在数据库112中的信息。操作TOC的人员可以采取手工动作，例如分析来自威胁信息源104的新信息、审查在威胁陷阱106处接收的消息、创建防垃圾邮件规则、创建防病毒规则、发布病毒发作警告、更新存储在数据库112中的信息、公布病毒发作信息，从而消息传递网关107可以访问病毒发作信息，并手动发起病毒发作信息到该消息传递网关和其他消息传递网关的发送。
在实施例中，威胁信息处理器108包括网络标识符分析逻辑130，其包括实现这里结合图2A-图3描述的功能的一个或多个计算机程序或其它软件元件。
在实施例中，威胁信息处理器108包括或从一个或多个受信黑名单接收信息，所述受信黑名单编辑了已知包含垃圾邮件或已知承载威胁的消息的拷贝或属性。威胁信息处理器108可以容宿黑名单、查询外部黑名单，或通过消息传递协议获得黑名单信息。
在某些实施例中，数据库112被称作“全集(corpus)”，并且包括威胁信息处理器108的一个数据库，该数据库包含已被明确归类为垃圾邮件与否、包含病毒与否或以其他方式针对其他特定威胁分类的消息。因此，全集代表可被用于确定指示未来消息是否是垃圾邮件或包含威胁的规则或其他标准的历史消息信息的受信库。消息从自动源(例如威胁陷阱106)和从来自消息传递网关107的报告进入全集。消息还从人类分类系统进入；因此，分析员可以接收消息或URL并确定该消息或URL应该被添加到数据库112中的白名单还是黑名单。全集还可以使用“化身(avatar)”进入公共网络102并获得用于分类的消息。
在实施例中，数据库112可以存储消息的以下属性值：
  属性   源   注释
  源   头部
  日期   头部
  发送者   头部
  来自   头部
  接收者/去往   头部
  抄送(cc)   头部
  回复到   头部
  主题   头部
  内容类型   头部
  消息id   头部   消息ID头部的值
  邮件代理   头部
  附件   头部/主体
  sbrs得分   经查询   用于连接IP地址的SBRS得分是在使用连接IP地址进行消息插入期间被查询的。
  sbrs得分   经计算   在为获取得分而查询SBRS时设置
  时间戳
  sbrs规则集   经计算  哪些SBRS规则(从位掩码反向生成)对声誉得分有贡献
  连接ip   经计算  从X-Spam-Untrusted-Relays头部获得。该头部是通过回看“跳”直到遇到网络边界而计算出的。如果这样不起作用，则使用接收到的头部中的第一“不受信”IP地址。
  校验和   经计算  用于唯一性确定。利用SHA1从消息主体的前N字节计算出，其中N＝min(1024，消息主体长度/2)
  连接ip国家   经查询  从X-Spam-RBL头部获得。该头部从TXT记录查询直接获得。
  疑似类别   经计算  使用X-Spam-Status和X-ClamAV-Status头部计算出。如果ClamAV报告消息为病毒，则它是“病毒”。如果SpamAssassin得分小于针对给定源配置的疑似正常邮件阈值，则该消息是“正常邮件”(不被看作垃圾邮件的消息，但不一定完全受信)。如果SpamAssassin得分大于针对给定源配置的疑似垃圾邮件阈值，则它是“垃圾邮件”。如果对于给定源不存在特定阈值，则使用默认阈值。否则，它是“未知的”。
  类别   设置/经计算  如果消息与一个类别一起手工提交，则该类别被使用。否则，使用与疑似类别相同的算法来计算，但是使用可配置的针对“正常邮件”和“垃圾邮件”的阈值，而非“疑似正常邮件”和“疑似垃圾邮件”阈值
  后压(blowback)   设置  全集管理员必须手工设置该属性。其默认为假(False)。
  弹回(bounce)   设置  全集管理员必须手工设置该属性。其默认为假。
  网络钓鱼   设置/经计算  如果X-ClamAV-Status头部确定消息是网络钓鱼攻击，则其为真(True)。否则，全集管理员可手工设置该值。其默认为假。
  病毒重扫描   经计算  如果消息的病毒状态为未知，则设置为真。否则，设置为假。
  病毒得分   经计算  使用ClamAV来计算。
  病毒得分时间戳   经计算  在每次使用ClamAV(重)扫描消息时计算。
  病毒规则集   经计算  哪些病毒被找到。
  垃圾邮件重扫描   经计算  如果消息的垃圾邮件状态为未知或者如果其他关键属性所需的任何X-Spam头部在上次扫描期间没有出
 现，则设置为真。
  垃圾邮件得分   经计算  使用stock SpamAssassin来计算。
  垃圾邮件得分时间戳   经计算  在每次使用ClamAV(重)扫描消息时计算。
  垃圾邮件规则集   经计算  哪些垃圾邮件规则对“垃圾邮件性(spaminess)”得分有贡献
  语言   经计算  使用SpamAssassin语言检测功能来计算
  审计   经计算  每次任何消息属性改变时设置。跟踪什么属性改变，何时改变以及谁对此负责。
在实施例中，威胁信息处理器108包括阻止列表142。在一个实施例中，阻止列表142可以是本地管理的拷贝或者是公共发送者URI阻止列表140的镜像。对阻止列表140执行镜像确保了威胁信息处理器108即使在阻止列表140经历网络中断(outage)或故障时也能够连续获得URI阻止列表信息。在实施例中，阻止列表142可被集成到数据库112中。
在实施例中，威胁信息处理器108包括HTTP服务132，其可以发布HTTP请求以获得网络资源150的拷贝、来自网站152的信息或存储在HTTP服务器中的其他网络可访问信息。
在实施例中，威胁信息处理器108包括声誉得分服务136，其可以确定存储在数据库112中的消息的声誉得分值，并在接收到新消息时利用得分值动态更新数据库。声誉得分值代表基于已知某发送者已经发送的过去的消息或者基于包含某消息元素的过去的消息，该消息发送者或消息元素是否与垃圾邮件消息或包含威胁的消息相关联。在一个实施例中，声誉得分值的范围从(-10)到(+10)，其中(-10)指示差声誉或者频繁或一贯发送垃圾邮件或带有威胁的消息，而(+10)指示好声誉。
在实施例中，威胁信息处理器108包括以软件组件实现的一个或多个训练数据库或概率过滤器134。作为附加或替换，网络标识符分析逻辑130和概率过滤器134可被实现为消息传递网关107中的防垃圾邮件逻辑119的一部分，或以消息传递网关的防垃圾邮件逻辑的插件(plug-in)软件组件的形式实现。概率过滤器134可以是贝叶斯过滤器。概率过滤器134的使用在以下部分进一步描述。
2.2功能概述
一般地，处理电子消息的方法的一个实施例包括接收消息，识别消息中的一个或多个网络资源标识符，建立到网络资源标识符所引用的资源的网络连接，取得被引用的资源，评价被引用的资源，并且基于被引用的资源判定消息是否包含威胁或代表垃圾邮件。
在一个实施例中，对资源进行概率分析(例如贝叶斯分析)以判定它们是否与垃圾邮件发送者相关联。一般而言，贝叶斯分析是一种统计程序，其致力于基于观察到的分布来评估潜在分布的参数。分析开始于“先验分布”，其可以基于任何相关数据，包括对参数的相对似然(likelihood)或非贝叶斯观察的结果的评价。实践中，常见的做法是假设适当范围的值上的统一分布作为先验分布。
给定先验分布，进程收集数据以获得观察分布。然后，该进程计算观察分布作为参数值的函数的似然，将该似然函数乘以先验分布，并归一化结果以获得所有可能值上的单位概率(称之为后验分布)。分布的模式于是成为参数估计，并且“概率间隔”(对信任间隔的贝叶斯模拟)可以使用标准程序来计算出。在贝叶斯分析中，结果的有效性取决于先验分布的有效性，该先验分布的有效性无法从统计上评估。
在另一方法中，利用例如DNS查找将电子邮件消息中的主机名引用解析为IP地址。这些方法都可被用于识别应该被添加到在数据库12中维护的黑名单或者被更新到阻止列表142中的网络地址(例如IP地址)。
在另一方法中，从消息主体中的URL中提取出的主机名被映射到IP地址(例如使用DNS)。所产生的IP地址在一个或多个黑名单中被查找。同时，声誉得分被生成，并且低声誉得分与表明IP地址在黑名单中的指示的组合被用于判定相关URL是否也应该被放入黑名单。
该方法可被应用于全集中的所有消息，无论该消息是否先前已经被确定为垃圾邮件。
在这里的另一方法中，消息被接收并存储在全集中。消息被手工审查并被标记为正常邮件或垃圾邮件。在消息中引用的一个或多个URL被识别并且一个或多个主机名被从URL中提取出。代理取得针对消息主体中的URL的网页。代理可以针对域查找域名寄存器“whois”记录，并且可以取得在提取出的域名处的根网页。可以采取预防措施(precaution)以避免经常取得相同网页，这可以告知web服务器的拥有者或操作者它正在被防垃圾邮件服务所调查。
取得的数据被加注令牌(token)，令牌用于训练概率垃圾邮件检测引擎或过滤器。作为结果，概率过滤器接受训练以基于某些令牌的存在而识别哪些消息代表垃圾邮件。例如，垃圾邮件发送者可能在重复的垃圾邮件活动中使用类似的出现的域名，或者网页取得操作将产生HTTP 404错误(网页未找到)，这可以发生在垃圾邮件发送者发送假URL或尚未在指示的URL处建立网页时，或者网页中的内容可能正在尝试广告已知与垃圾邮件源相关联的产品。
在训练阶段之后，新接收的消息被概率过滤器处理，并且与产生高概率得分的那些消息相关联的IP地址被放入黑名单。
在一个实施例中，消息传递网关107周期性地查询威胁信息处理器108以请求用于防垃圾邮件逻辑119中的防垃圾邮件更新。威胁信息处理器108创建URL黑名单，该URL黑名单是从阻止列表142形成的，并且作为在数据库112中管理的内部白名单和黑名单。所产生的URL黑名单被单独或与针对消息传递网关的其他元件的其他更新一起发送到消息传递网关107。
在一个实施例中，URL黑名单被发送到消息传递网关107，作为包含(主机名、位掩码)形式的元组(tuple)列表的Perl SDBM文件。该列表包含尚未被放入白名单的主机名。在使用中，任何作为针对其他列表条目的“通配符”白名单条目的列表条目将胜过该条目。例如，假设foo.bar.com被放入黑名单，而“*.bar.com”被放入白名单。结果，foo.bar.com将不会出现在发送到消息传递网关107的最终黑名单中。如果只有“bar.com”被放入白名单，也发生同样的结果。
现在参考图2A、图2B、图2C和图2D来描述功能示例。图2A是示出基于接收到的消息中的网络资源标识符来训练概率过滤器的一个实施例的高级概况的流程图；图2B是示出测试接收到的消息是否是垃圾邮件或与威胁相关联的一个实施例的高级概况的流程图；图2C是示出判定是否将网络资源标识符添加到阻止列表的一个实施例的高级概况的流程图；并且图2D是示出将阻止列表传送到消息传递网关并使用阻止列表来过滤消息的一个实施例的高级概况的流程图。
首先参考图2A，部分(1)，在步骤202中，第一网络资源标识符的白名单的内容被取得。在实施例中，威胁信息处理器108创建并管理URI白名单。可替换地，公共URI白名单可以被使用。步骤202的白名单以及随后将描述的步骤210的阻止列表可以由机器生成或者由人为生成。为了正确地执行随后的过滤操作，白名单和黑名单应该高度准确。在此上下文中，“白名单”指的是一般尚未与垃圾邮件或威胁相关联的网络地址、IP地址、域名或其他网络资源标识符的列表。
在步骤204中，从白名单取得特定第一网络资源标识符。
在步骤206中，用于取得的第一网络资源标识符的属性或令牌列表被生成。在此上下文中，网络资源标识符的“属性”示例可以包括：基于网络资源标识符从DNS查询获得的信息，例如名称、IP地址、服务器等等；网页；网络资源标识符正在使用的服务器软件；基于包含在网络资源标识符中的域名的域名拥有者和网络块拥有者两者而从“whois”查询获得信息；以及从URI和/或域名提取出的单词(例如针对域名“bluepillorders.com”，提取出的单词可以包括“blue”、“pill”和“orders”)。
在实施例中，步骤206包括取得由特定网络资源标识符标识的网页或其他网络资源的拷贝。例如，威胁信息处理器108的HTTP服务132创建和发布HTTP GET请求以下载上述提取出的URL处的资源。假设提取出的URL标识活动的在线网站152或其他网络资源150，则响应于HTTPGET请求接收网页或其他资源的拷贝。
与网络资源标识符相关联的属性被转换成令牌表或流，其中每个令牌是一个单独的属性部分。例如，令牌可以包含字符串、单词、文本块、图形图像、URL、框或其他页面元素。将拷贝转换成令牌可以包括扫描存储的拷贝以及标识各种类型的定界符(delimiter)。
在步骤208中，利用令牌来训练由训练数据库218代表的概率过滤器。例如，概率过滤器134被提供以令牌和指示令牌与“已知好的”网络资源标识符相关联的信息。在训练期间，威胁信息处理器的管理员或其他受信用户指示概率过滤器134关于特定网络资源和属性是否实际上与垃圾邮件或消息威胁相关联。可替换地，步骤208可以包括训练概率过滤器，该概率过滤器仅被用于生成一组其他网络资源标识符属性指示“好的”或者不与垃圾邮件或消息威胁相关联的网络资源标识符的概率。
图2A的部分(2)中示出的步骤210到216(包括步骤216)对应于步骤202到208，但是步骤210到216基于出现在第二网络资源标识符的阻止列表中的网络资源标识符来训练概率过滤器(例如训练数据库218)。例如，出现在阻止列表140中的URI可被用于在步骤210到216中的训练。图2A的部分(1)和(2)可以独立运行，但是两者通常训练同样的训练数据库或概率过滤器。结果，概率过滤器被训练以准确地生成随后获得的另一网络资源标识符可能与垃圾邮件或消息威胁相关联的概率。
因此，不同于现有方法，概率过滤器在出现在阻止列表和白名单中并且可以在消息中引用的网络资源的内容上被训练，而不是在出现在消息头部或主体中的单词上被训练。结果，概率过滤器134获取存储的以下信息：该信息指示出现在网络资源中的特定文本、图像、图形或其他文档元素在包含或递送基于计算机的威胁的垃圾邮件消息或网络资源中被引用的概率。
因此，当新消息随后被接收但是包含指向已用来训练过概率过滤器的类似内容的不同URL时，概率过滤器将正确地识别新消息为垃圾邮件或与威胁相关联。该方法十分有用，因为垃圾邮件的发送者可能快速改变它们的域名，但是它们的域递送的内容不会改变。因此，这里提出的对内容的概率分析允许系统确定没有列入黑名单的URL与垃圾邮件或威胁相关联的可能性。
在另一实施例中，在概率过滤器内，概率值被与网络资源标识符以及标识在消息中引用的网络资源的令牌或其他内容元素的信息两者相关联地存储。在该方法中，随后的测试或过滤可以包括仅将网络资源标识符呈现给概率过滤器，以及接收指示网络资源标识符是否与垃圾邮件或威胁相关联的相应概率值。结果，每个随后的测试或过滤不一定需要取得网络资源的另一拷贝。
此外，由于概率过滤器134是基于在消息中引用的网络资源的内容而非消息本身被训练的，因此概率过滤器不太可能在过滤具有无害的文本但是包含嵌入的递送“网络钓鱼”攻击或威胁的超级链接的消息时失败。
步骤202-208可以针对出现在白名单中的任何数目的网络资源标识符被重复。类似地，步骤210-216可以针对出现在阻止列表中的任何数目的网络资源标识符被重复。
现在参考图2B，在步骤210中，关于第三网络资源标识符的信息被接收。在实施例中，在步骤210中，威胁信息处理器108从消息传递网关107接收指示消息传递网关接收到包含特定网络资源标识符的一个或多个消息的通信。例如，该通信可能通过对在威胁信息处理器108中维护的服务器的DNS查询而发生。作为附加或替换，威胁信息处理器108在“SenderBase网络参与”协议下被链接到消息传递网关107，通过所述“SenderBase网络参与”协议，消息传递网关可以周期性地报告消息传递网关处理的数据。
可替换地，步骤210可以包括实际上接收包含一个或多个网络资源标识符的消息。出于说明清晰示例的目的，假设接收到的消息的主体包含表1所示文本。
表1-示例性接收消息
为了向您提供可能的最好服务，我们Online Payment Services需要您与我们核实您的账户信息。如果您不核实您的账户信息，我们则将禁用您的账户。为了提供您的账户细节，请点击：http://onlinepayment.phishingscam.com，谢谢！
不管消息的外观怎样，该消息没有被Online Payment Services授权，并且消息中的URL(http://onlinepayment.phishingscam.com)访问出于欺骗或恶毒目的而收集用户账户数据的服务器。出于说明清晰示例的目的，表1的消息包括一个URL，但是各自包含任何数目的URL或其他网络资源标识符的任何数目的消息可以在这里描述的方法中被使用。
步骤210通常在概率过滤器134被训练之后的某一时刻被执行。因此，图2B假设概率过滤器已经用在消息中引用的网络资源内容是垃圾邮件或与威胁相关联的概率训练过。
在步骤211中，针对第三网络资源标识符生成属性列表。基于以上针对步骤206描述的相同类型的信息，属性可以包含令牌。
在步骤212中，第三网络资源标识符的属性利用训练的概率过滤器被测试，并且在步骤214中，概率输出值被接收。
在步骤216中，概率值被测试以判定其是否大于指示垃圾邮件或威胁的阈值。如果接收的概率大于阈值，则在步骤218中，第三网络资源标识符被添加到阻止列表。在实施例中，为了防止“反馈循环”效应，步骤218包括将网络资源标识符添加到阻止列表但不是在图2A的步骤210-216中用于训练的阻止列表。单独的本地阻止列表、阻止列表142或数据库112中的私有黑名单中的任何一个可以被使用。随后，当阻止列表被发送到消息传递网关107时，消息传递网关可以阻止包含相同网络资源标识符的消息的递送，如下面针对图2D将进一步描述的。
步骤218可以包括向外部信息服务(例如威胁信息源104或阻止列表140)报告网络资源标识符与垃圾邮件或威胁相关联。
在图2A、图2B中处理的属性可以包括基于声誉的信息。现在参考图2C，在一种方法中，当第三网络资源标识符在步骤217处被接收时，第三网络资源标识符的域名部分在步骤219处被提取出。如果网络资源标识符是“http://onlinepayment.phishingscam.com”，则在步骤219中，域名部分“phishingscam.com”被提取出。
在步骤220中，用于域名的MX或NS记录被从DNS系统取得。例如，威胁信息处理器108的网络标识符分析逻辑130向DNS服务器160发布DNS查询以获得用于提取出的域名的MX记录。如图3所示，DNS服务器160存储MX记录集合162、NS记录集合164和A记录集合166。特定域名可以在零、一种、两种或所有三种记录中找到。所有有效的注册的域名具有至少一个映射关联的IP地址的A记录。管理邮件交换或邮件服务器的域将具有MX记录。管理名称服务器的域将具有NS记录。
DNS服务器160返回MX记录的拷贝或指示没有找到MX记录的响应。如果没有找到MX记录，则用于域名的A(地址)记录被请求。可替换地，名称服务器(NS)记录被请求。
接收的MX记录和NS记录标识服务器名称。在步骤222处，对于每个接收的记录，地址记录被取得。例如，另一DNS查询被发布以针对在每个MX记录或NS记录中给定的名称获得一个A记录。结果，威胁信息处理器108获取与提取出的域名部分相关联的网络地址(例如IP地址)。
在步骤224中，与地址记录中的每个地址相关联的声誉得分或阻止列表被确定。在实施例中，包含来自地址记录的IP地址的查询被发布到声誉得分服务136，其回复以与该IP地址相关联的声誉得分值。针对与域相关联的多个IP地址的多个查询可以被发送。针对与在同一消息中被引用的多个域中的所有域相关联的多个IP地址的多个查询可以被发送。所产生的声誉得分值可以例如通过计算平均值来组合。可替换地，步骤224包括对照阻止列表检查地址。
如果平均声誉得分低于特定阈值，或者如果在步骤226处测试出地址被阻止，则在步骤228中，网络资源标识符被添加到阻止列表。对于步骤219，可以使用单独的阻止列表来防止反馈效应。可替换地，控制返回步骤230以进行其他消息处理或动作。
因此，图2C的方法使得能够集成从声誉服务获得的信息以基于与在消息中找到的网络资源标识符相关联的声誉值来判定特定消息是否可能是垃圾邮件或与威胁相关联。
基于引用的网络资源标识符，消息传递网关107或邮件服务器可以使用在前述方法中开发的信息来过滤、阻止或应用策略到垃圾邮件或与威胁相关的消息。现在参考图2D，在步骤240中，从消息传递网关接收对于更新的阻止列表的查询。因此，在一个实施例中，消息传递网关107周期性地查询威胁信息处理器108关于是否可获得更新的阻止列表。在步骤242中，更新的阻止列表被发送到消息传递网关。步骤242可以包括基于数据库112和/或阻止列表142的内容创建阻止列表。
在步骤244中，更新的阻止列表在本地存储。例如，消息传递网关107基于接收到的更新的阻止列表来存储本地黑名单117。
在步骤246中，包含网络资源标识符的新电子邮件消息例如在消息传递网关107处被接收。该消息被提供到防垃圾邮件逻辑119。在步骤248处，从消息中提取出一个或多个网络资源标识符。防垃圾邮件逻辑119可以执行提取。在步骤250处，执行测试以判定提取出的网络资源标识符是否在阻止列表中被找到。
如果是，则在步骤252中，消息传递网关107基于测试250的真实结果来修改威胁得分值。因此，当图2D在防垃圾邮件扫描的上下文中被实现时，步骤252可以包括增大垃圾邮件得分值以指示步骤246中的消息可能是“垃圾邮件”。
如果提取出的网络资源标识符没有在阻止列表中找到，则在步骤254中，消息传递网关107可以执行其他消息处理，例如防病毒扫描、内容过滤、策略增强等等。
2.3插件实施例
在一个实施例中，这里的方法被实现在用于消息传递网关107的防垃圾邮件逻辑119的软件插件中。一般而言，这样的本地URI阻止列表插件使用利用防垃圾邮件逻辑119从消息中提取出的数据来找到消息中的网络资源标识符并对照URI阻止列表来测试它们。
在实施例中，插件通过在消息主体中搜索网络资源标识符而为每个消息返回一个肯定结果。作为附加或替换，肯定和否定结果值可以针对在消息中找到的所有网络资源标识符来创建。
在一个实施例中，插件支持写入规则以指定应该为肯定的源列表以及它们的得分权重。规则使得管理员或消息传递网关107的其他用户能够指定引用一个或多个列表的位掩码以对照其进行测试。利用这种方法，可以在已知尤其可靠或不可靠的特定列表或源上设置额外的得分权重。
测试可以对照阻止列表140、阻止列表142或本地存储在消息传递网关107中的另一阻止列表来执行。因此，出于图1的目的，本地黑名单117可以代表这样的本地阻止列表。阻止列表可以存储在本地数据库或文件中，以允许Perl脚本和Python程序连接到该文件并将该文件视为包含散列值。在一个实施例中，本地数据库或文件中的条目包含(关键字→值)组合，其中每个关键字是一个域值，每个相关的值是一个源位掩码。例如，一个条目可以包括(foo.bar＝＞0.0.68)，其中“0.0.68”是代表IronPort、第三方阻止列表等等的位掩码。
4.0实现机制——硬件概述
图4是示出可以在其上实现本发明的实施例的计算机系统400的框图。优选实施例是使用运行在诸如路由器设备之类网络元件上的一个或多个计算机程序来实现的。因此，在该实施例中，计算机系统400是路由器。
计算机系统400包括用于传输信息的总线402或其他通信机制，以及与总线402耦合以用于处理信息的处理器404。计算机系统400还包括耦合到总线402的用于存储信息和将被处理器404执行的指令的主存储器406，例如随机访问存储器(RAM)、闪存或其他动态存储设备。主存储器406还可以用于在执行将被处理器404执行的指令期间存储临时变量或其他中间信息。计算机系统400还包括耦合到总线402的只读存储器(ROM)408或其他静态存储设备，用于存储用于处理器404的静态信息和指令。存储设备410(例如磁盘、闪存或光盘)被提供并耦合到总线402，以用于存储信息和指令。
通信接口418可被耦合到总线402，用于向处理器404传输信息和命令选择。接口418是传统的串行接口，例如RS-232或RS-422接口。外部终端412或其他计算机系统连接到计算机系统400并使用接口414向其提供命令。运行在计算机系统400中的固件或软件提供终端接口或基于字符的命令接口，以使得外部命令可以被提供到该计算机系统。
交换系统416被耦合到总线402并且具有到一个或多个外部网络元件的输入接口414和输出接口419。外部网络元件可以包括耦合到一个或多个主机424的本地网络422或具有一个或多个服务器430的全球网络(例如因特网428)。交换系统416根据预先确定的公知的协议和规范将到达输入接口414的信息流量交换到输出接口419。例如，交换系统416与处理器404合作可以确定到达输入接口414的数据分组的目的地并利用输出接口419将其发送到正确的目的地。目的地可以包括在本地网络422或因特网428中的主机424、服务器430、其他末端站或其他路由和交换设备。
本发明涉及用于基于对引用资源的概率分析来检测不想要的电子邮件消息的计算机系统400的使用。根据本发明一个实施例，基于对引用资源的概率分析来检测不想要的电子邮件消息是由计算机系统400响应于处理器404执行包含在主存储器406中的一个或多个指令的一个或多个序列而提供的。这些指令可以从另一计算机可读介质(例如存储设备410)读入到主存储器406中。包含在主存储器406中的指令序列的执行使得处理器404执行这里描述的进程步骤。在多处理布置中的一个或多个处理器也可以被采用以执行包含在主存储器406中的指令序列。在替换实施例中，可以使用硬连线电路来取代软件指令或与软件指令相结合来实现本发明。因此，本发明的实施例不局限于硬件电路和软件的任何特定组合。
这里使用的术语“计算机可读介质”指的是参与提供指令到处理器404以供执行的任何介质。这种介质可以采取很多形式，包括但不局限于，非易失性介质、易失性介质和传输介质。非易失性介质例如包括光盘或磁盘，例如存储设备410。易失性介质包括动态存储器，例如主存储器406。传输介质包括同轴线缆、铜线和光纤，包括包含总线402在内的电线。传输介质还可以采取声波或光波的形式，例如在无线电波和红外数据通信期间生成的那些。
计算机可读介质的常见形式例如包括软盘、柔性盘、硬盘、磁带或任何其他磁介质、CD-ROM、任何其他光介质、打孔卡、纸带、任何其他具有孔状图样的物理介质、RAM、PROM和EPROM、FLASH-EPROM、任何其他存储器芯片或卡带、下文将描述的载波或者计算机可以读取的任何其他介质。
在运载一个或多个指令的一个或多个序列到处理器404以供执行时可以涉及各种形式的计算机可读介质。例如，指令最初可以在远程计算机的磁盘上运载。远程计算机可以将指令加载到其动态存储器中并利用调制解调器通过电话线将指令发送出去。位于计算机系统400本地的调制解调器可以在电话线上接收数据并使用红外发射器将数据转换成红外信号。耦合到总线402的红外检测器可以接收在红外信号中运载的数据并将数据放在总线402上。总线402将数据运载到主存储器406，处理器404从主存储器406取得并执行指令。由主存储器406接收的指令可以在被处理器404执行之前或之后被可选地存储在存储设备410上。
通信接口418还提供到网络链路420的双向数据通信耦合，所述网络链路420连接到本地网络422。例如，通信接口418可以是综合服务数字网络(ISDN)卡或调制解调器，以提供到相应类型的电话线的数据通信连接。作为另一示例，通信接口418可以是本地局域网(LAN)卡，以提供到可兼容的LAN的数据通信连接。无线链路也可以被实现。在任何这样的实现方式中，通信接口418发送和接收运载代表各种信息的数字数据流的电信号、电磁信号或光信号。
网络链路420通常通过一个或多个网络向其他数据设备提供数据通信。例如，网络链路420可以通过本地网络422提供到主机计算机424或到由因特网服务提供商(ISP)426操作的数据设备的连接。ISP 426进而通过全球分组数据通信网络(现在一般称之为“因特网”)428提供数据通信服务。本地网络422和因特网428都使用运载数字数据流的电、磁或光信号。运载数字数据到计算机系统400并且从计算机系统400接收数字数据的通过各种网络的信号和在网络链路420上并且通过通信接口418的信号具有示例性的传输信息的载波形式。
计算机系统400可以通过网络、网络链路420和通信接口418来发送消息和接收数据，包括程序代码。在因特网示例中，服务器430可能通过因特网428、ISP 426、本地网络422和通信接口418来发送针对应用程序请求的代码。根据本发明，如这里所述，一个这样的下载的应用用于基于对引用的资源的概率分析来检测不想要的电子邮件消息。
接收的代码可以在其被接收时被处理器404执行和/或被存储在存储设备410或其他非易失性存储设备中以供随后执行。以这种方式，计算机系统400可以获得载波形式的应用代码。
5.0扩展和替代
在以上说明书中，已经参考本发明的特定实施例描述了本发明。但是，显而易见，在不脱离本发明的更广阔精神和范围的情况下，可以对其进行各种修改和改变。因此，说明书和附图被视为示例性的而非限制性的。

Claims (39)

1.一种方法，包括：
取得包含多个已被包括在过去的电子邮件消息中的第一网络资源标识符的白名单；
从所述白名单取得特定第一网络资源标识符；
生成针对所述特定第一网络资源标识符的第一属性列表；
使用所述属性来训练概率过滤器；
针对所述白名单中的所有第一网络资源标识符重复所述提取、取得和训练步骤；
取得包含多个已被包括在与垃圾邮件或威胁相关联的过去的电子邮件消息中的第二网络资源标识符的阻止列表；
从所述阻止列表取得特定第二网络资源标识符；
生成针对所述特定第二网络资源标识符的第二属性列表；
使用所述属性来训练所述概率过滤器；
针对所述阻止列表中的所有第二网络资源标识符重复所述提取、取得和训练步骤。
2.如权利要求1所述的方法，还包括：
接收第三网络资源标识符；
使用所述经训练的概率过滤器来测试所述第三网络资源标识符，并且接收指示所述第三网络资源标识符与垃圾邮件或威胁相关联的概率的概率输出；
当所述概率输出大于第一指定阈值时，将所述第三网络资源标识符添加到黑名单。
3.如权利要求1所述的方法，其中生成所述第二属性列表包括：
提取所述第二网络资源标识符的域部分；
从域名系统取得与所述提取出的域部分相关联的一个或多个邮件交换记录；
从所述域名系统取得针对在所述邮件交换记录中标识的每个邮件服务器的每个地址记录；
取得与每个所述地址记录的网络地址相关联的声誉得分值；
当平均声誉得分值小于指定阈值时，将所述网络资源标识符添加到所述黑名单。
4.如权利要求1所述的方法，其中所述网络资源标识符是统一资源定位符(URL)。
5.如权利要求1所述的方法，其中生成所述第二属性列表包括：
提取所述第二网络资源标识符的域部分；
从域名系统取得与所述提取出的域部分相关联的一个或多个名称服务器记录；
从所述域名系统取得针对在所述名称服务器记录中标识的每个邮件服务器的每个地址记录；
取得与每个所述地址记录的网络地址相关联的声誉得分值；
当平均声誉得分值小于指定阈值时，将所述网络资源标识符添加到所述黑名单。
6.如权利要求3或5所述的方法，还包括将所述黑名单发送到耦合到所述网络的多个消息传递网关设备。
7.如权利要求3或5所述的方法，其中所述黑名单与权利要求1提及的所述阻止列表相分离。
8.如权利要求3或5所述的方法，还包括：
在消息传递网关处接收所述黑名单的拷贝；
在所述消息传递网关处，接收包含统一资源定位符(URL)的电子邮件消息；
提取所述URL并判定所述URL是否在所述黑名单的拷贝中；
当所述URL在所述黑名单的拷贝中时，修改与所述电子邮件消息相关联的威胁得分值。
9.如权利要求1所述的方法，其中所述威胁包括病毒、网络钓鱼攻击和网址嫁接攻击中的任何一种。
10.一种运载一个或多个指令序列的计算机可读有形存储介质，当所述一个或多个指令序列被一个或多个处理器执行时，致使所述一个或多个处理器执行：
取得包含多个已被包括在过去的电子邮件消息中的第一网络资源标识符的白名单；
从所述白名单取得特定第一网络资源标识符；
生成针对所述特定第一网络资源标识符的第一属性列表；
使用所述属性来训练概率过滤器；
针对所述白名单中的所有第一网络资源标识符重复所述提取、取得和训练步骤；
取得包含多个已被包括在与垃圾邮件或威胁相关联的过去的电子邮件消息中的第二网络资源标识符的阻止列表；
从所述阻止列表取得特定第二网络资源标识符；
生成针对所述特定第二网络资源标识符的第二属性列表；
使用所述属性来训练所述概率过滤器；
针对所述阻止列表中的所有第二网络资源标识符重复所述提取、取得和训练步骤。
11.如权利要求10所述的计算机可读介质，还包括：
接收第三网络资源标识符；
使用所述经训练的概率过滤器来测试所述第三网络资源标识符，并且接收指示所述第三网络资源标识符与垃圾邮件或威胁相关联的概率的概率输出；
当所述概率输出大于第一指定阈值时，将所述第三网络资源标识符添加到黑名单。
12.如权利要求10所述的计算机可读介质，其中生成所述第二属性列表包括：
提取所述第二网络资源标识符的域部分；
从域名系统取得与所述提取出的域部分相关联的一个或多个邮件交换记录；
从所述域名系统取得针对在所述邮件交换记录中标识的每个邮件服务器的每个地址记录；
取得与每个所述地址记录的网络地址相关联的声誉得分值；
当平均声誉得分值小于指定阈值时，将所述网络资源标识符添加到所述黑名单。
13.如权利要求10所述的计算机可读介质，其中所述网络资源标识符是统一资源定位符(URL)。
14.如权利要求10所述的计算机可读介质，其中生成所述第二属性列表包括：
提取所述第二网络资源标识符的域部分；
从域名系统取得与所述提取出的域部分相关联的一个或多个名称服务器记录；
从所述域名系统取得针对在所述名称服务器记录中标识的每个邮件服务器的每个地址记录；
取得与每个所述地址记录的网络地址相关联的声誉得分值；
当平均声誉得分值小于指定阈值时，将所述网络资源标识符添加到所述黑名单。
15.如权利要求12或14所述的计算机可读介质，还包括将所述黑名单发送到耦合到所述网络的多个消息传递网关设备。
16.如权利要求12或14所述的计算机可读介质，其中所述黑名单与权利要求10提及的所述阻止列表相分离。
17.如权利要求12或14所述的计算机可读介质，还包括：
在消息传递网关处接收所述黑名单的拷贝；
在所述消息传递网关处，接收包含统一资源定位符(URL)的电子邮件消息；
提取所述URL并判定所述URL是否在所述黑名单的拷贝中；
当所述URL在所述黑名单的拷贝中时，修改与所述电子邮件消息相关联的威胁得分值。
18.如权利要求10所述的计算机可读介质，其中所述威胁包括病毒、网络钓鱼攻击和网址嫁接攻击中的任何一种。
19.一种装置，包括：
用于取得包含多个已被包括在过去的电子邮件消息中的第一网络资源标识符的白名单的装置；
用于从所述白名单取得特定第一网络资源标识符的装置；
用于生成针对所述特定第一网络资源标识符的第一属性列表的装置；
用于使用所述属性来训练概率过滤器的装置；
用于针对所述白名单中的所有第一网络资源标识符重复所述提取、取得和训练装置的执行的装置；
用于取得包含多个已被包括在与垃圾邮件或威胁相关联的过去的电子邮件消息中的第二网络资源标识符的阻止列表的装置；
用于从所述阻止列表取得特定第二网络资源标识符的装置；
用于生成针对所述特定第二网络资源标识符的第二属性列表的装置；
用于使用所述属性来训练所述概率过滤器的装置；
用于针对所述阻止列表中的所有第二网络资源标识符重复所述提取、取得和训练步骤的装置。
20.如权利要求19所述的装置，还包括：
用于接收第三网络资源标识符的装置；
用于使用所述经训练的概率过滤器来测试所述第三网络资源标识符，并且用于接收指示所述第三网络资源标识符与垃圾邮件或威胁相关联的概率的概率输出的装置；
用于当所述概率输出大于第一指定阈值时，将所述第三网络资源标识符添加到黑名单的装置。
21.如权利要求19所述的装置，其中生成所述第二属性列表包括：
用于提取所述第二网络资源标识符的域部分的装置；
用于从域名系统取得与所述提取出的域部分相关联的一个或多个邮件交换记录的装置；
用于从所述域名系统取得针对在所述邮件交换记录中标识的每个邮件服务器的每个地址记录的装置；
用于取得与每个所述地址记录的网络地址相关联的声誉得分值的装置；
用于当平均声誉得分值小于指定阈值时，将所述网络资源标识符添加到所述黑名单的装置。
22.如权利要求19所述的装置，其中所述网络资源标识符是统一资源定位符(URL)。
23.如权利要求19所述的装置，其中生成所述第二属性列表包括：
提取所述第二网络资源标识符的域部分；
从域名系统取得与所述提取出的域部分相关联的一个或多个名称服务器记录；
从所述域名系统取得针对在所述名称服务器记录中标识的每个邮件服务器的每个地址记录；
取得与每个所述地址记录的网络地址相关联的声誉得分值；
当平均声誉得分值小于指定阈值时，将所述网络资源标识符添加到所述黑名单。
24.如权利要求21或23所述的装置，还包括用于将所述黑名单发送到耦合到所述网络的多个消息传递网关设备的装置。
25.如权利要求21或23所述的装置，其中所述黑名单与权利要求19提及的所述阻止列表相分离。
26.如权利要求21或23所述的装置，还包括：
用于在消息传递网关处接收所述黑名单的拷贝的装置；
用于在所述消息传递网关处，接收包含统一资源定位符(URL)的电子邮件消息的装置；
用于提取所述URL并判定所述URL是否在所述黑名单的拷贝中的装置；
用于当所述URL在所述黑名单的拷贝中时，修改与所述电子邮件消息相关联的威胁得分值的装置。
27.如权利要求19所述的装置，其中所述威胁包括病毒、网络钓鱼攻击和网址嫁接攻击中的任何一种。
28.一种电子邮件服务器，包括：
一个或多个处理器；
被编码在一个或多个介质中以用于执行的逻辑，当所述逻辑被执行时可操作用于致使所述一个或多个处理器执行：
取得包含多个已被包括在过去的电子邮件消息中的第一网络资源标识符的白名单；
从所述白名单取得特定第一网络资源标识符；
生成针对所述特定第一网络资源标识符的第一属性列表；
使用所述属性来训练概率过滤器；
针对所述白名单中的所有第一网络资源标识符重复所述提取、取得和训练步骤；
取得包含多个已被包括在与垃圾邮件或威胁相关联的过去的电子邮件消息中的第二网络资源标识符的阻止列表；
从所述阻止列表取得特定第二网络资源标识符；
生成针对所述特定第二网络资源标识符的第二属性列表；
使用所述属性来训练所述概率过滤器；
针对所述阻止列表中的所有第二网络资源标识符重复所述提取、取得和训练步骤。
29.如权利要求28所述的装置，其中所述逻辑在被执行时还可操作用于执行：
接收第三网络资源标识符；
使用所述经训练的概率过滤器来测试所述第三网络资源标识符，并且接收指示所述第三网络资源标识符与垃圾邮件或威胁相关联的概率的概率输出；
当所述概率输出大于第一指定阈值时，将所述第三网络资源标识符添加到黑名单。
30.如权利要求28所述的装置，其中用于生成所述第二属性列表的逻辑还包括在执行时可操作用于执行以下操作的逻辑：
提取所述第二网络资源标识符的域部分；
从域名系统取得与所述提取出的域部分相关联的一个或多个邮件交换记录；
从所述域名系统取得针对在所述邮件交换记录中标识的每个邮件服务器的每个地址记录；
取得与每个所述地址记录的网络地址相关联的声誉得分值；
当平均声誉得分值小于指定阈值时，将所述网络资源标识符添加到所述黑名单。
31.如权利要求28所述的装置，其中所述网络资源标识符是统一资源定位符(URL)。
32.如权利要求28所述的装置，其中用于生成所述第二属性列表的逻辑还包括在执行时可操作用于执行以下操作的逻辑：
提取所述第二网络资源标识符的域部分；
从域名系统取得与所述提取出的域部分相关联的一个或多个名称服务器记录；
从所述域名系统取得针对在所述名称服务器记录中标识的每个邮件服务器的每个地址记录；
取得与每个所述地址记录的网络地址相关联的声誉得分值；
当平均声誉得分值小于指定阈值时，将所述网络资源标识符添加到所述黑名单。
33.如权利要求30或32所述的装置，还包括将所述黑名单发送到耦合到所述网络的多个消息传递网关设备。
34.如权利要求30或32所述的装置，其中所述黑名单与权利要求37提及的所述阻止列表相分离。
35.如权利要求30或32所述的装置，还包括：
在消息传递网关处接收所述黑名单的拷贝；
在所述消息传递网关处，接收包含统一资源定位符(URL)的电子邮件消息；
提取所述URL并判定所述URL是否在所述黑名单的拷贝中；
当所述URL在所述黑名单的拷贝中时，修改与所述电子邮件消息相关联的威胁得分值。
36.如权利要求28所述的装置，其中所述威胁包括病毒、网络钓鱼攻击和网址嫁接攻击中的任何一种。
37.如权利要求1所述的方法，其中所述属性包括以下各项中的任何一个：基于所述特定第一或第二网络资源标识符从DNS查询获得的信息，包括名称、IP地址和服务器中的任何一种；网页；所述特定第一或第二网络资源标识符使用的服务器软件；基于针对包含在所述特定第一或第二网络资源标识符中的域名的域名拥有者和网络块拥有者两者从“whois”查询获得的信息；以及从所述特定第一或第二网络资源标识符提取出的单词。
38.如权利要求19或28所述的装置，其中所述属性包括以下各项中的任何一个：基于所述特定第一或第二网络资源标识符从DNS查询获得的信息，包括名称、IP地址和服务器中的任何一种；网页；所述特定第一或第二网络资源标识符使用的服务器软件；基于针对包含在所述特定第一或第二网络资源标识符中的域名的域名拥有者和网络块拥有者两者从“whois”查询获得的信息；以及从所述特定第一或第二网络资源标识符提取出的单词。
39.如权利要求10所述的计算机可读介质，其中所述属性包括以下各项中的任何一个：基于所述特定第一或第二网络资源标识符从DNS查询获得的信息，包括名称、IP地址和服务器中的任何一种；网页；所述特定第一或第二网络资源标识符使用的服务器软件；基于针对包含在所述特定第一或第二网络资源标识符中的域名的域名拥有者和网络块拥有者两者从“whois”查询获得的信息；以及从所述特定第一或第二网络资源标识符提取出的单词。
CN2006800194833A 2005-05-05 2006-05-05 基于被引用资源的概率分析检测不想要的电子邮件消息 Active CN101558398B (zh)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US67839105P 2005-05-05 2005-05-05
US60/678,391 2005-05-05
PCT/US2006/017782 WO2006119508A2 (en) 2005-05-05 2006-05-05 Detecting unwanted electronic mail messages based on probabilistic analysis of referenced resources

Publications (2)

Publication Number Publication Date
CN101558398A true CN101558398A (zh) 2009-10-14
CN101558398B CN101558398B (zh) 2012-11-28

Family

ID=37308748

Family Applications (2)

Application Number Title Priority Date Filing Date
CN200680019314XA Active CN101495969B (zh) 2005-05-05 2006-05-05 识别电子消息中的威胁
CN2006800194833A Active CN101558398B (zh) 2005-05-05 2006-05-05 基于被引用资源的概率分析检测不想要的电子邮件消息

Family Applications Before (1)

Application Number Title Priority Date Filing Date
CN200680019314XA Active CN101495969B (zh) 2005-05-05 2006-05-05 识别电子消息中的威胁

Country Status (6)

Country Link
US (6) US7548544B2 (zh)
EP (2) EP1877905B1 (zh)
JP (2) JP5118020B2 (zh)
CN (2) CN101495969B (zh)
CA (2) CA2607005C (zh)
WO (4) WO2006122055A2 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102713853A (zh) * 2009-10-26 2012-10-03 赛门铁克公司 使用文件流行程度通知行为试探的攻击性
CN103823761A (zh) * 2014-03-09 2014-05-28 林虎 一种提升终端黑名单容量和检索速度的方法
CN105743876A (zh) * 2015-08-28 2016-07-06 哈尔滨安天科技股份有限公司 一种基于邮件源数据发现针对性攻击的方法及系统
CN104137501B (zh) * 2012-01-26 2017-10-20 惠普发展公司，有限责任合伙企业 用于识别推送通信模式的系统和方法
CN108431792A (zh) * 2015-12-21 2018-08-21 电子湾有限公司 检测与被伪造的元数据不匹配的隐藏的链接
US10686817B2 (en) 2015-09-21 2020-06-16 Hewlett Packard Enterprise Development Lp Identification of a DNS packet as malicious based on a value

Families Citing this family (659)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030097654A1 (en) * 1998-06-05 2003-05-22 Franken Kenneth A. System and method of geographic authorization for television and radio programming distributed by multiple delivery mechanisms
US8010981B2 (en) 2001-02-08 2011-08-30 Decisionmark Corp. Method and system for creating television programming guide
US8219620B2 (en) * 2001-02-20 2012-07-10 Mcafee, Inc. Unwanted e-mail filtering system including voting feedback
US7913287B1 (en) 2001-06-15 2011-03-22 Decisionmark Corp. System and method for delivering data over an HDTV digital television spectrum
US8359650B2 (en) * 2002-10-01 2013-01-22 Skybox Secutiry Inc. System, method and computer readable medium for evaluating potential attacks of worms
US8407798B1 (en) 2002-10-01 2013-03-26 Skybox Secutiry Inc. Method for simulation aided security event management
US8195714B2 (en) * 2002-12-11 2012-06-05 Leaper Technologies, Inc. Context instantiated application protocol
US7984175B2 (en) 2003-12-10 2011-07-19 Mcafee, Inc. Method and apparatus for data capture and analysis system
US8548170B2 (en) 2003-12-10 2013-10-01 Mcafee, Inc. Document de-registration
US8656039B2 (en) 2003-12-10 2014-02-18 Mcafee, Inc. Rule parser
US8214438B2 (en) 2004-03-01 2012-07-03 Microsoft Corporation (More) advanced spam detection features
US8793787B2 (en) 2004-04-01 2014-07-29 Fireeye, Inc. Detecting malicious network content using virtual environment components
US8171553B2 (en) 2004-04-01 2012-05-01 Fireeye, Inc. Heuristic based capture with replay to virtual machine
US8549638B2 (en) 2004-06-14 2013-10-01 Fireeye, Inc. System and method of containing computer worms
US8881282B1 (en) 2004-04-01 2014-11-04 Fireeye, Inc. Systems and methods for malware attack detection and identification
US8584239B2 (en) 2004-04-01 2013-11-12 Fireeye, Inc. Virtual machine with dynamic data flow analysis
US9106694B2 (en) 2004-04-01 2015-08-11 Fireeye, Inc. Electronic message analysis for malware detection
US8898788B1 (en) 2004-04-01 2014-11-25 Fireeye, Inc. Systems and methods for malware attack prevention
US7587537B1 (en) 2007-11-30 2009-09-08 Altera Corporation Serializer-deserializer circuits formed from input-output circuit registers
US8528086B1 (en) 2004-04-01 2013-09-03 Fireeye, Inc. System and method of detecting computer worms
US8566946B1 (en) 2006-04-20 2013-10-22 Fireeye, Inc. Malware containment on connection
US8560534B2 (en) 2004-08-23 2013-10-15 Mcafee, Inc. Database for a capture system
US7949849B2 (en) 2004-08-24 2011-05-24 Mcafee, Inc. File system for a capture system
US20060200528A1 (en) * 2005-01-25 2006-09-07 Krishna Pathiyal Method and system for processing data messages
US7860006B1 (en) * 2005-04-27 2010-12-28 Extreme Networks, Inc. Integrated methods of performing network switch functions
US7822620B2 (en) * 2005-05-03 2010-10-26 Mcafee, Inc. Determining website reputations using automatic testing
US7765481B2 (en) * 2005-05-03 2010-07-27 Mcafee, Inc. Indicating website reputations during an electronic commerce transaction
US20060253582A1 (en) * 2005-05-03 2006-11-09 Dixon Christopher J Indicating website reputations within search results
US7562304B2 (en) * 2005-05-03 2009-07-14 Mcafee, Inc. Indicating website reputations during website manipulation of user information
US9384345B2 (en) * 2005-05-03 2016-07-05 Mcafee, Inc. Providing alternative web content based on website reputation assessment
US8438499B2 (en) 2005-05-03 2013-05-07 Mcafee, Inc. Indicating website reputations during user interactions
US8566726B2 (en) 2005-05-03 2013-10-22 Mcafee, Inc. Indicating website reputations based on website handling of personal information
US20060253584A1 (en) * 2005-05-03 2006-11-09 Dixon Christopher J Reputation of an entity associated with a content item
US20060277259A1 (en) * 2005-06-07 2006-12-07 Microsoft Corporation Distributed sender reputations
GB2427048A (en) 2005-06-09 2006-12-13 Avecho Group Ltd Detection of unwanted code or data in electronic mail
WO2006135798A2 (en) * 2005-06-09 2006-12-21 Boma Systems, Incorporated Personal notification and broadcasting
US8522347B2 (en) * 2009-03-16 2013-08-27 Sonicwall, Inc. Real-time network updates for malicious content
US7636734B2 (en) * 2005-06-23 2009-12-22 Microsoft Corporation Method for probabilistic analysis of most frequently occurring electronic message addresses within personal store (.PST) files to determine owner with confidence factor based on relative weight and set of user-specified factors
US20090144826A2 (en) * 2005-06-30 2009-06-04 Webroot Software, Inc. Systems and Methods for Identifying Malware Distribution
US8560413B1 (en) * 2005-07-14 2013-10-15 John S. Quarterman Method and system for detecting distributed internet crime
US9282081B2 (en) 2005-07-28 2016-03-08 Vaporstream Incorporated Reduced traceability electronic message system and method
US7610345B2 (en) 2005-07-28 2009-10-27 Vaporstream Incorporated Reduced traceability electronic message system and method
US7565358B2 (en) 2005-08-08 2009-07-21 Google Inc. Agent rank
US7907608B2 (en) 2005-08-12 2011-03-15 Mcafee, Inc. High speed packet capture
US8296846B2 (en) * 2005-08-19 2012-10-23 Cpacket Networks, Inc. Apparatus and method for associating categorization information with network traffic to facilitate application level processing
US8346918B2 (en) * 2005-08-19 2013-01-01 Cpacket Networks, Inc. Apparatus and method for biased and weighted sampling of network traffic to facilitate network monitoring
US8024799B2 (en) * 2005-08-19 2011-09-20 Cpacket Networks, Inc. Apparatus and method for facilitating network security with granular traffic modifications
US8665868B2 (en) * 2005-08-19 2014-03-04 Cpacket Networks, Inc. Apparatus and method for enhancing forwarding and classification of network traffic with prioritized matching and categorization
US8769663B2 (en) 2005-08-24 2014-07-01 Fortinet, Inc. Systems and methods for detecting undesirable network traffic content
US8204974B1 (en) * 2005-08-30 2012-06-19 Sprint Communications Company L.P. Identifying significant behaviors within network traffic
US8028337B1 (en) 2005-08-30 2011-09-27 Sprint Communications Company L.P. Profile-aware filtering of network traffic
US7818326B2 (en) 2005-08-31 2010-10-19 Mcafee, Inc. System and method for word indexing in a capture system and querying thereof
US20070061402A1 (en) * 2005-09-15 2007-03-15 Microsoft Corporation Multipurpose internet mail extension (MIME) analysis
US7925786B2 (en) * 2005-09-16 2011-04-12 Microsoft Corp. Hosting of network-based services
US7730011B1 (en) 2005-10-19 2010-06-01 Mcafee, Inc. Attributes of captured objects in a capture system
US20070129999A1 (en) * 2005-11-18 2007-06-07 Jie Zhou Fraud detection in web-based advertising
US20070124500A1 (en) * 2005-11-30 2007-05-31 Bedingfield James C Sr Automatic substitute uniform resource locator (URL) generation
US8595325B2 (en) * 2005-11-30 2013-11-26 At&T Intellectual Property I, L.P. Substitute uniform resource locator (URL) form
US8255480B2 (en) 2005-11-30 2012-08-28 At&T Intellectual Property I, L.P. Substitute uniform resource locator (URL) generation
US8255996B2 (en) 2005-12-30 2012-08-28 Extreme Networks, Inc. Network threat detection and mitigation
US8185741B1 (en) * 2006-01-30 2012-05-22 Adobe Systems Incorporated Converting transport level transactional security into a persistent document signature
US8601160B1 (en) 2006-02-09 2013-12-03 Mcafee, Inc. System, method and computer program product for gathering information relating to electronic content utilizing a DNS server
US9392009B2 (en) * 2006-03-02 2016-07-12 International Business Machines Corporation Operating a network monitoring entity
US8504537B2 (en) 2006-03-24 2013-08-06 Mcafee, Inc. Signature distribution in a document registration system
US8701196B2 (en) 2006-03-31 2014-04-15 Mcafee, Inc. System, method and computer program product for obtaining a reputation associated with a file
US7854006B1 (en) 2006-03-31 2010-12-14 Emc Corporation Differential virus scan
US8443445B1 (en) * 2006-03-31 2013-05-14 Emc Corporation Risk-aware scanning of objects
US8205261B1 (en) 2006-03-31 2012-06-19 Emc Corporation Incremental virus scan
US7752274B2 (en) * 2006-04-03 2010-07-06 International Business Machines Corporation Apparatus and method for filtering and selectively inspecting e-mail
US7849502B1 (en) 2006-04-29 2010-12-07 Ironport Systems, Inc. Apparatus for monitoring network traffic
US8849760B2 (en) * 2006-05-02 2014-09-30 International Business Machines Corporation Determining whether predefined data controlled by a server is replicated to a client machine
US8706470B2 (en) 2006-05-08 2014-04-22 David T. Lorenzen Methods of offering guidance on common language usage utilizing a hashing function consisting of a hash triplet
US7603350B1 (en) 2006-05-09 2009-10-13 Google Inc. Search result ranking based on trust
US20070282770A1 (en) * 2006-05-15 2007-12-06 Nortel Networks Limited System and methods for filtering electronic communications
US7921063B1 (en) 2006-05-17 2011-04-05 Daniel Quinlan Evaluating electronic mail messages based on probabilistic analysis
US20080082662A1 (en) * 2006-05-19 2008-04-03 Richard Dandliker Method and apparatus for controlling access to network resources based on reputation
US7958227B2 (en) 2006-05-22 2011-06-07 Mcafee, Inc. Attributes of captured objects in a capture system
US8640247B2 (en) * 2006-05-31 2014-01-28 The Invention Science Fund I, Llc Receiving an indication of a security breach of a protected set of files
US20070282723A1 (en) * 2006-05-31 2007-12-06 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Monitoring a status of a database by placing a false identifier in the database
US8209755B2 (en) * 2006-05-31 2012-06-26 The Invention Science Fund I, Llc Signaling a security breach of a protected set of files
US8191140B2 (en) * 2006-05-31 2012-05-29 The Invention Science Fund I, Llc Indicating a security breach of a protected set of files
US20070294767A1 (en) * 2006-06-20 2007-12-20 Paul Piccard Method and system for accurate detection and removal of pestware
US8087084B1 (en) 2006-06-28 2011-12-27 Emc Corporation Security for scanning objects
US8122507B1 (en) 2006-06-28 2012-02-21 Emc Corporation Efficient scanning of objects
US20080005315A1 (en) * 2006-06-29 2008-01-03 Po-Ching Lin Apparatus, system and method for stream-based data filtering
US20080005249A1 (en) * 2006-07-03 2008-01-03 Hart Matt E Method and apparatus for determining the importance of email messages
US8020206B2 (en) 2006-07-10 2011-09-13 Websense, Inc. System and method of analyzing web content
US8615800B2 (en) 2006-07-10 2013-12-24 Websense, Inc. System and method for analyzing web content
US7970922B2 (en) * 2006-07-11 2011-06-28 Napo Enterprises, Llc P2P real time media recommendations
US8327266B2 (en) 2006-07-11 2012-12-04 Napo Enterprises, Llc Graphical user interface system for allowing management of a media item playlist based on a preference scoring system
US9003056B2 (en) * 2006-07-11 2015-04-07 Napo Enterprises, Llc Maintaining a minimum level of real time media recommendations in the absence of online friends
US8059646B2 (en) 2006-07-11 2011-11-15 Napo Enterprises, Llc System and method for identifying music content in a P2P real time recommendation network
US8001603B1 (en) * 2006-07-24 2011-08-16 Symantec Corporation Variable scan of files based on file context
US8082587B2 (en) * 2006-08-02 2011-12-20 Lycos, Inc. Detecting content in files
US7971257B2 (en) * 2006-08-03 2011-06-28 Symantec Corporation Obtaining network origins of potential software threats
US8190868B2 (en) 2006-08-07 2012-05-29 Webroot Inc. Malware management through kernel detection
US8090606B2 (en) 2006-08-08 2012-01-03 Napo Enterprises, Llc Embedded media recommendations
US8620699B2 (en) 2006-08-08 2013-12-31 Napo Enterprises, Llc Heavy influencer media recommendations
US8533822B2 (en) * 2006-08-23 2013-09-10 Threatstop, Inc. Method and system for propagating network policy
US20160248813A1 (en) * 2006-08-23 2016-08-25 Threatstop, Inc. Method and system for propagating network policy
US20080077704A1 (en) * 2006-09-24 2008-03-27 Void Communications, Inc. Variable Electronic Communication Ping Time System and Method
US8087088B1 (en) * 2006-09-28 2011-12-27 Whitehat Security, Inc. Using fuzzy classification models to perform matching operations in a web application security scanner
CN101155182A (zh) * 2006-09-30 2008-04-02 阿里巴巴公司 一种基于网络的垃圾信息过滤方法和装置
US20080086555A1 (en) * 2006-10-09 2008-04-10 David Alexander Feinleib System and Method for Search and Web Spam Filtering
US7882187B2 (en) 2006-10-12 2011-02-01 Watchguard Technologies, Inc. Method and system for detecting undesired email containing image-based messages
US8306199B2 (en) * 2006-10-20 2012-11-06 Nokia Corporation Accounting in a transit network
CN101569136B (zh) * 2006-11-03 2013-08-28 网络通保安有限公司 管理入口
US8484733B2 (en) 2006-11-28 2013-07-09 Cisco Technology, Inc. Messaging security device
US9654495B2 (en) * 2006-12-01 2017-05-16 Websense, Llc System and method of analyzing web addresses
US7962460B2 (en) 2006-12-01 2011-06-14 Scenera Technologies, Llc Methods, systems, and computer program products for determining availability of presentable content via a subscription service
GB2444514A (en) 2006-12-04 2008-06-11 Glasswall Electronic file re-generation
US9729513B2 (en) 2007-11-08 2017-08-08 Glasswall (Ip) Limited Using multiple layers of policy management to manage risk
US8312536B2 (en) * 2006-12-29 2012-11-13 Symantec Corporation Hygiene-based computer security
CN100555991C (zh) * 2006-12-29 2009-10-28 华为技术有限公司 报文访问控制的方法、转发引擎装置和通信设备
GB2458094A (en) * 2007-01-09 2009-09-09 Surfcontrol On Demand Ltd URL interception and categorization in firewalls
US20090070185A1 (en) * 2007-01-17 2009-03-12 Concert Technology Corporation System and method for recommending a digital media subscription service
EP2122504B1 (en) * 2007-01-18 2014-10-01 Roke Manor Research Limited A method of extracting sections of a data stream
KR100850911B1 (ko) * 2007-01-19 2008-08-07 삼성전자주식회사 메시지 전송을 위한 장치 및 방법
US20080177843A1 (en) * 2007-01-22 2008-07-24 Microsoft Corporation Inferring email action based on user input
US8214497B2 (en) 2007-01-24 2012-07-03 Mcafee, Inc. Multi-dimensional reputation scoring
US8763114B2 (en) 2007-01-24 2014-06-24 Mcafee, Inc. Detecting image spam
US8027975B2 (en) * 2007-01-31 2011-09-27 Reputation.Com, Inc. Identifying and changing personal information
EP2127311B1 (en) 2007-02-02 2013-10-09 Websense, Inc. System and method for adding context to prevent data leakage over a computer network
US20080201722A1 (en) * 2007-02-20 2008-08-21 Gurusamy Sarathy Method and System For Unsafe Content Tracking
US7904958B2 (en) * 2007-02-27 2011-03-08 Symantec Corporation Spam honeypot domain identification
US9224427B2 (en) 2007-04-02 2015-12-29 Napo Enterprises LLC Rating media item recommendations using recommendation paths and/or media item usage
US8112720B2 (en) 2007-04-05 2012-02-07 Napo Enterprises, Llc System and method for automatically and graphically associating programmatically-generated media item recommendations related to a user's socially recommended media items
US9246938B2 (en) * 2007-04-23 2016-01-26 Mcafee, Inc. System and method for detecting malicious mobile program code
US20080281606A1 (en) * 2007-05-07 2008-11-13 Microsoft Corporation Identifying automated click fraud programs
US8230023B2 (en) * 2007-05-17 2012-07-24 International Business Machines Corporation Managing email disk usage based on user specified conditions
GB0709527D0 (en) 2007-05-18 2007-06-27 Surfcontrol Plc Electronic messaging system, message processing apparatus and message processing method
US8613092B2 (en) * 2007-05-21 2013-12-17 Mcafee, Inc. System, method and computer program product for updating a security system definition database based on prioritized instances of known unwanted data
US9083556B2 (en) * 2007-05-31 2015-07-14 Rpx Clearinghouse Llc System and method for detectng malicious mail from spam zombies
US20090049045A1 (en) 2007-06-01 2009-02-19 Concert Technology Corporation Method and system for sorting media items in a playlist on a media device
US9037632B2 (en) 2007-06-01 2015-05-19 Napo Enterprises, Llc System and method of generating a media item recommendation message with recommender presence information
US9164993B2 (en) 2007-06-01 2015-10-20 Napo Enterprises, Llc System and method for propagating a media item recommendation message comprising recommender presence information
US8285776B2 (en) 2007-06-01 2012-10-09 Napo Enterprises, Llc System and method for processing a received media item recommendation message comprising recommender presence information
US7865965B2 (en) * 2007-06-15 2011-01-04 Microsoft Corporation Optimization of distributed anti-virus scanning
US20090063585A1 (en) * 2007-08-31 2009-03-05 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Using party classifiability to inform message versioning
US20090063632A1 (en) * 2007-08-31 2009-03-05 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Layering prospective activity information
US8984133B2 (en) 2007-06-19 2015-03-17 The Invention Science Fund I, Llc Providing treatment-indicative feedback dependent on putative content treatment
US20080320088A1 (en) * 2007-06-19 2008-12-25 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Helping valuable message content pass apparent message filtering
US9374242B2 (en) 2007-11-08 2016-06-21 Invention Science Fund I, Llc Using evaluations of tentative message content
US20090064329A1 (en) * 2007-06-25 2009-03-05 Google Inc. Zero-hour quarantine of suspect electronic messages
US7899870B2 (en) * 2007-06-25 2011-03-01 Microsoft Corporation Determination of participation in a malicious software campaign
US8849921B2 (en) 2007-06-28 2014-09-30 Symantec Corporation Method and apparatus for creating predictive filters for messages
US8584094B2 (en) * 2007-06-29 2013-11-12 Microsoft Corporation Dynamically computing reputation scores for objects
US20090006211A1 (en) * 2007-07-01 2009-01-01 Decisionmark Corp. Network Content And Advertisement Distribution System and Method
US20090012965A1 (en) * 2007-07-01 2009-01-08 Decisionmark Corp. Network Content Objection Handling System and Method
JP4945344B2 (ja) * 2007-07-02 2012-06-06 日本電信電話株式会社 パケットフィルタリング方法およびパケットフィルタリングシステム
US8849909B2 (en) * 2007-07-06 2014-09-30 Yahoo! Inc. Real-time asynchronous event aggregation systems
US20090019041A1 (en) * 2007-07-11 2009-01-15 Marc Colando Filename Parser and Identifier of Alternative Sources for File
US7818384B2 (en) * 2007-07-26 2010-10-19 Rachal Eric M Simultaneous synchronous split-domain email routing with conflict resolution
CN101373456A (zh) * 2007-08-22 2009-02-25 国际商业机器公司 对软件进行支持的方法,软件支持代理以及计算机系统
US20090063631A1 (en) * 2007-08-31 2009-03-05 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Message-reply-dependent update decisions
JP4943278B2 (ja) * 2007-09-06 2012-05-30 株式会社日立製作所 ウィルススキャン方法及びその方法を用いた計算機システム
US8219686B2 (en) 2007-09-17 2012-07-10 Mcafee, Inc. Method and computer program product utilizing multiple UDP data packets to transfer a quantity of data otherwise in excess of a single UDP packet
US8230025B2 (en) 2007-09-20 2012-07-24 Research In Motion Limited System and method for delivering variable size messages based on spam probability
US20090083413A1 (en) * 2007-09-24 2009-03-26 Levow Zachary S Distributed frequency data collection via DNS
US10606901B1 (en) * 2007-09-28 2020-03-31 Emc Corporation Data disposition services orchestrated in an information management infrastructure
US8730946B2 (en) * 2007-10-18 2014-05-20 Redshift Internetworking, Inc. System and method to precisely learn and abstract the positive flow behavior of a unified communication (UC) application and endpoints
US20100306856A1 (en) * 2007-10-23 2010-12-02 Gecad Technologies Sa System and method for filtering email data
US8959624B2 (en) * 2007-10-31 2015-02-17 Bank Of America Corporation Executable download tracking system
US9060034B2 (en) * 2007-11-09 2015-06-16 Napo Enterprises, Llc System and method of filtering recommenders in a media item recommendation system
US8037536B2 (en) * 2007-11-14 2011-10-11 Bank Of America Corporation Risk scoring system for the prevention of malware
US8590039B1 (en) 2007-11-28 2013-11-19 Mcafee, Inc. System, method and computer program product for sending information extracted from a potentially unwanted data sample to generate a signature
US8144841B2 (en) * 2007-12-05 2012-03-27 Microsoft Corporation Multimedia spam determination using speech conversion
US20090150497A1 (en) * 2007-12-06 2009-06-11 Mcafee Randolph Preston Electronic mail message handling and presentation methods and systems
US8396951B2 (en) 2007-12-20 2013-03-12 Napo Enterprises, Llc Method and system for populating a content repository for an internet radio service based on a recommendation network
US9734507B2 (en) 2007-12-20 2017-08-15 Napo Enterprise, Llc Method and system for simulating recommendations in a social network for an offline user
US10318730B2 (en) * 2007-12-20 2019-06-11 Bank Of America Corporation Detection and prevention of malicious code execution using risk scoring
US8060525B2 (en) 2007-12-21 2011-11-15 Napo Enterprises, Llc Method and system for generating media recommendations in a distributed environment based on tagging play history information with location information
KR101224319B1 (ko) * 2007-12-21 2013-01-21 제너럴 인스트루먼트 코포레이션 디지털 미디어의 비인가 사용을 방지하기 위한 시스템 및 방법
US8316015B2 (en) 2007-12-21 2012-11-20 Lemi Technology, Llc Tunersphere
US8117193B2 (en) 2007-12-21 2012-02-14 Lemi Technology, Llc Tunersphere
US8296245B2 (en) * 2008-01-03 2012-10-23 Kount Inc. Method and system for creation and validation of anonymous digital credentials
US9183368B2 (en) * 2008-01-24 2015-11-10 Go Daddy Operating Company, LLC Validating control of domain zone
US8433747B2 (en) * 2008-02-01 2013-04-30 Microsoft Corporation Graphics remoting architecture
US8706820B2 (en) * 2008-02-08 2014-04-22 Microsoft Corporation Rules extensibility engine
US20110225244A1 (en) * 2008-02-13 2011-09-15 Barracuda Networks Inc. Tracing domains to authoritative servers associated with spam
JP4488074B2 (ja) * 2008-02-13 2010-06-23 日本電気株式会社 パターン検出装置、パターン検出システム、パターン検出プログラム、およびパターン検出方法
US9306796B1 (en) 2008-03-18 2016-04-05 Mcafee, Inc. System, method, and computer program product for dynamically configuring a virtual environment for identifying unwanted data
US9015842B2 (en) 2008-03-19 2015-04-21 Websense, Inc. Method and system for protection against information stealing software
US9130986B2 (en) * 2008-03-19 2015-09-08 Websense, Inc. Method and system for protection against information stealing software
US8407784B2 (en) 2008-03-19 2013-03-26 Websense, Inc. Method and system for protection against information stealing software
US8266672B2 (en) * 2008-03-21 2012-09-11 Sophos Plc Method and system for network identification via DNS
US7865561B2 (en) * 2008-04-01 2011-01-04 Mcafee, Inc. Increasing spam scanning accuracy by rescanning with updated detection rules
US8244752B2 (en) * 2008-04-21 2012-08-14 Microsoft Corporation Classifying search query traffic
US8302192B1 (en) * 2008-04-30 2012-10-30 Netapp, Inc. Integrating anti-virus in a clustered storage system
US20090282075A1 (en) * 2008-05-06 2009-11-12 Dawson Christopher J System and method for identifying and blocking avatar-based unsolicited advertising in a virtual universe
US9985978B2 (en) * 2008-05-07 2018-05-29 Lookingglass Cyber Solutions Method and system for misuse detection
US9123027B2 (en) * 2010-10-19 2015-09-01 QinetiQ North America, Inc. Social engineering protection appliance
US8028030B2 (en) * 2008-05-22 2011-09-27 International Business Machines Corporation Method and system for supervising electronic text communications of an enterprise
US20090300012A1 (en) * 2008-05-28 2009-12-03 Barracuda Inc. Multilevel intent analysis method for email filtration
US8301904B1 (en) * 2008-06-24 2012-10-30 Mcafee, Inc. System, method, and computer program product for automatically identifying potentially unwanted data as unwanted
US8490185B2 (en) * 2008-06-27 2013-07-16 Microsoft Corporation Dynamic spam view settings
US8381298B2 (en) * 2008-06-30 2013-02-19 Microsoft Corporation Malware detention for suspected malware
EP2318955A1 (en) * 2008-06-30 2011-05-11 Websense, Inc. System and method for dynamic and real-time categorization of webpages
US20100011420A1 (en) * 2008-07-02 2010-01-14 Barracuda Networks Inc. Operating a service on a network as a domain name system server
US8219644B2 (en) * 2008-07-03 2012-07-10 Barracuda Networks, Inc. Requesting a service or transmitting content as a domain name system resolver
US8205242B2 (en) 2008-07-10 2012-06-19 Mcafee, Inc. System and method for data mining and security policy management
US8676903B2 (en) * 2008-07-17 2014-03-18 International Business Machines Corporation System and method to control email whitelists
US20100023871A1 (en) * 2008-07-25 2010-01-28 Zumobi, Inc. Methods and Systems Providing an Interactive Social Ticker
US9253154B2 (en) 2008-08-12 2016-02-02 Mcafee, Inc. Configuration management for a capture/registration system
US9641537B2 (en) * 2008-08-14 2017-05-02 Invention Science Fund I, Llc Conditionally releasing a communiqué determined to be affiliated with a particular source entity in response to detecting occurrence of one or more environmental aspects
US20100057895A1 (en) * 2008-08-29 2010-03-04 At& T Intellectual Property I, L.P. Methods of Providing Reputation Information with an Address and Related Devices and Computer Program Products
EP2169897A1 (en) * 2008-09-25 2010-03-31 Avira GmbH Computer-based method for the prioritization of potential malware sample messages
CN101378407B (zh) * 2008-09-26 2012-10-17 成都市华为赛门铁克科技有限公司 一种信息推送方法、系统及设备
US8850571B2 (en) 2008-11-03 2014-09-30 Fireeye, Inc. Systems and methods for detecting malicious network content
US8997219B2 (en) 2008-11-03 2015-03-31 Fireeye, Inc. Systems and methods for detecting malicious PDF network content
US20100125663A1 (en) * 2008-11-17 2010-05-20 Donovan John J Systems, methods, and devices for detecting security vulnerabilities in ip networks
US8181251B2 (en) * 2008-12-18 2012-05-15 Symantec Corporation Methods and systems for detecting malware
US8375435B2 (en) * 2008-12-19 2013-02-12 International Business Machines Corporation Host trust report based filtering mechanism in a reverse firewall
US9704177B2 (en) 2008-12-23 2017-07-11 International Business Machines Corporation Identifying spam avatars in a virtual universe (VU) based upon turing tests
US9697535B2 (en) 2008-12-23 2017-07-04 International Business Machines Corporation System and method in a virtual universe for identifying spam avatars based upon avatar multimedia characteristics
US8424075B1 (en) * 2008-12-31 2013-04-16 Qurio Holdings, Inc. Collaborative firewall for a distributed virtual environment
US8850591B2 (en) * 2009-01-13 2014-09-30 Mcafee, Inc. System and method for concept building
US8706709B2 (en) 2009-01-15 2014-04-22 Mcafee, Inc. System and method for intelligent term grouping
US8200602B2 (en) 2009-02-02 2012-06-12 Napo Enterprises, Llc System and method for creating thematic listening experiences in a networked peer media recommendation environment
US8265658B2 (en) * 2009-02-02 2012-09-11 Waldeck Technology, Llc System and method for automated location-based widgets
US8473442B1 (en) 2009-02-25 2013-06-25 Mcafee, Inc. System and method for intelligent state management
US8627461B2 (en) 2009-03-04 2014-01-07 Mcafee, Inc. System, method, and computer program product for verifying an identification of program information as unwanted
US9141794B1 (en) * 2009-03-10 2015-09-22 Trend Micro Incorporated Preemptive and/or reduced-intrusion malware scanning
WO2010106578A1 (en) * 2009-03-19 2010-09-23 Hitachi, Ltd. E-mail archiving system, method, and program
US8904520B1 (en) 2009-03-19 2014-12-02 Symantec Corporation Communication-based reputation system
US9350755B1 (en) * 2009-03-20 2016-05-24 Symantec Corporation Method and apparatus for detecting malicious software transmission through a web portal
US8667121B2 (en) 2009-03-25 2014-03-04 Mcafee, Inc. System and method for managing data and policies
US8447722B1 (en) 2009-03-25 2013-05-21 Mcafee, Inc. System and method for data mining and security policy management
US11489857B2 (en) 2009-04-21 2022-11-01 Webroot Inc. System and method for developing a risk profile for an internet resource
US8234259B2 (en) * 2009-05-08 2012-07-31 Raytheon Company Method and system for adjudicating text against a defined policy
CN101582887B (zh) * 2009-05-20 2014-02-26 华为技术有限公司 安全防护方法、网关设备及安全防护系统
US8621614B2 (en) * 2009-05-26 2013-12-31 Microsoft Corporation Managing potentially phishing messages in a non-web mail client context
US9130972B2 (en) 2009-05-26 2015-09-08 Websense, Inc. Systems and methods for efficient detection of fingerprinted data and information
US8656476B2 (en) 2009-05-28 2014-02-18 International Business Machines Corporation Providing notification of spam avatars
EP2438540A1 (en) 2009-06-01 2012-04-11 AOL Inc. Providing suggested web search queries based on click data of stored search queries
CN101576947B (zh) * 2009-06-05 2012-08-08 成都市华为赛门铁克科技有限公司 文件防护处理方法、装置及系统
CN101600207A (zh) * 2009-06-18 2009-12-09 中兴通讯股份有限公司 一种基于wap的sp访问控制方法和系统
JP5147078B2 (ja) * 2009-07-01 2013-02-20 日本電信電話株式会社 アドレスリスト構築方法およびアドレスリスト構築システム、ならびにそのためのプログラム
US8347394B1 (en) * 2009-07-15 2013-01-01 Trend Micro, Inc. Detection of downloaded malware using DNS information
US8271650B2 (en) * 2009-08-25 2012-09-18 Vizibility Inc. Systems and method of identifying and managing abusive requests
US8800030B2 (en) * 2009-09-15 2014-08-05 Symantec Corporation Individualized time-to-live for reputation scores of computer files
US8510835B1 (en) * 2009-09-18 2013-08-13 Trend Micro Incorporated Techniques for protecting data in cloud computing environments
US8832829B2 (en) 2009-09-30 2014-09-09 Fireeye, Inc. Network-based binary file extraction and analysis for malware detection
US8539583B2 (en) 2009-11-03 2013-09-17 Mcafee, Inc. Rollback feature
US8356354B2 (en) * 2009-11-23 2013-01-15 Kaspersky Lab, Zao Silent-mode signature testing in anti-malware processing
US20110136542A1 (en) * 2009-12-09 2011-06-09 Nokia Corporation Method and apparatus for suggesting information resources based on context and preferences
US20110144567A1 (en) * 2009-12-15 2011-06-16 Alcon Research, Ltd. Phacoemulsification Hand Piece With Integrated Aspiration Pump and Cartridge
US8479286B2 (en) 2009-12-15 2013-07-02 Mcafee, Inc. Systems and methods for behavioral sandboxing
US20110153035A1 (en) * 2009-12-22 2011-06-23 Caterpillar Inc. Sensor Failure Detection System And Method
US8719939B2 (en) * 2009-12-31 2014-05-06 Mcafee, Inc. Malware detection via reputation system
US8549642B2 (en) * 2010-01-20 2013-10-01 Symantec Corporation Method and system for using spam e-mail honeypots to identify potential malware containing e-mails
US8793789B2 (en) 2010-07-22 2014-07-29 Bank Of America Corporation Insider threat correlation tool
US8782209B2 (en) 2010-01-26 2014-07-15 Bank Of America Corporation Insider threat correlation tool
US8800034B2 (en) 2010-01-26 2014-08-05 Bank Of America Corporation Insider threat correlation tool
US9038187B2 (en) * 2010-01-26 2015-05-19 Bank Of America Corporation Insider threat correlation tool
US8443452B2 (en) * 2010-01-28 2013-05-14 Microsoft Corporation URL filtering based on user browser history
US8719352B2 (en) * 2010-01-29 2014-05-06 Mcafee, Inc. Reputation management for network content classification
US8516100B1 (en) * 2010-02-04 2013-08-20 Symantec Corporation Method and apparatus for detecting system message misrepresentation using a keyword analysis
US8606792B1 (en) 2010-02-08 2013-12-10 Google Inc. Scoring authors of posts
US20110209207A1 (en) * 2010-02-25 2011-08-25 Oto Technologies, Llc System and method for generating a threat assessment
US8863279B2 (en) * 2010-03-08 2014-10-14 Raytheon Company System and method for malware detection
US9009820B1 (en) 2010-03-08 2015-04-14 Raytheon Company System and method for malware detection using multiple techniques
US8910279B2 (en) * 2010-03-10 2014-12-09 Sonicwall, Inc. Reputation-based threat protection
CN101789105B (zh) * 2010-03-15 2013-01-30 北京安天电子设备有限公司 一种在数据包的级别动态检测邮件附件病毒的方法
US8856165B1 (en) * 2010-03-26 2014-10-07 Google Inc. Ranking of users who report abuse
US8782794B2 (en) 2010-04-16 2014-07-15 Bank Of America Corporation Detecting secure or encrypted tunneling in a computer network
US8544100B2 (en) 2010-04-16 2013-09-24 Bank Of America Corporation Detecting secure or encrypted tunneling in a computer network
CN101827104B (zh) * 2010-04-27 2013-01-02 南京邮电大学 一种基于多反病毒引擎的网络病毒联合防御方法
US9361130B2 (en) 2010-05-03 2016-06-07 Apple Inc. Systems, methods, and computer program products providing an integrated user interface for reading content
US8719900B2 (en) * 2010-05-18 2014-05-06 Amazon Technologies, Inc. Validating updates to domain name system records
US8601114B1 (en) 2010-05-21 2013-12-03 Socialware, Inc. Method, system and computer program product for interception, quarantine and moderation of internal communications of uncontrolled systems
US8244818B2 (en) 2010-05-28 2012-08-14 Research In Motion Limited System and method for visual representation of spam probability
US8627476B1 (en) * 2010-07-05 2014-01-07 Symantec Corporation Altering application behavior based on content provider reputation
CN101877710B (zh) * 2010-07-13 2012-10-17 成都市华为赛门铁克科技有限公司 代理网关防病毒实现方法、预分类器和代理网关
US8595830B1 (en) 2010-07-27 2013-11-26 Symantec Corporation Method and system for detecting malware containing E-mails based on inconsistencies in public sector “From” addresses and a sending IP address
US8464342B2 (en) * 2010-08-31 2013-06-11 Microsoft Corporation Adaptively selecting electronic message scanning rules
US9021043B2 (en) * 2010-09-28 2015-04-28 Microsoft Technology Licensing Llc Message gateway with hybrid proxy/store-and-forward logic
US9148432B2 (en) * 2010-10-12 2015-09-29 Microsoft Technology Licensing, Llc Range weighted internet protocol address blacklist
US8806615B2 (en) 2010-11-04 2014-08-12 Mcafee, Inc. System and method for protecting specified data combinations
US8990316B1 (en) * 2010-11-05 2015-03-24 Amazon Technologies, Inc. Identifying message deliverability problems using grouped message characteristics
US20120123778A1 (en) * 2010-11-11 2012-05-17 At&T Intellectual Property I, L.P. Security Control for SMS and MMS Support Using Unified Messaging System
US8819816B2 (en) * 2010-11-15 2014-08-26 Facebook, Inc. Differentiating between good and bad content in a user-provided content system
US8826437B2 (en) * 2010-12-14 2014-09-02 General Electric Company Intelligent system and method for mitigating cyber attacks in critical systems through controlling latency of messages in a communications network
US8769060B2 (en) 2011-01-28 2014-07-01 Nominum, Inc. Systems and methods for providing DNS services
US8554907B1 (en) * 2011-02-15 2013-10-08 Trend Micro, Inc. Reputation prediction of IP addresses
US8667592B2 (en) * 2011-03-15 2014-03-04 Symantec Corporation Systems and methods for looking up anti-malware metadata
US9122877B2 (en) 2011-03-21 2015-09-01 Mcafee, Inc. System and method for malware and network reputation correlation
US9473527B1 (en) * 2011-05-05 2016-10-18 Trend Micro Inc. Automatically generated and shared white list
US9858415B2 (en) * 2011-06-16 2018-01-02 Microsoft Technology Licensing, Llc Cloud malware false positive recovery
US9106680B2 (en) 2011-06-27 2015-08-11 Mcafee, Inc. System and method for protocol fingerprinting and reputation correlation
US20130018965A1 (en) * 2011-07-12 2013-01-17 Microsoft Corporation Reputational and behavioral spam mitigation
US9087324B2 (en) 2011-07-12 2015-07-21 Microsoft Technology Licensing, Llc Message categorization
US8650649B1 (en) * 2011-08-22 2014-02-11 Symantec Corporation Systems and methods for determining whether to evaluate the trustworthiness of digitally signed files based on signer reputation
US9319404B2 (en) 2011-09-23 2016-04-19 Jerome Svigals Security for the internet of things
US8997188B2 (en) * 2012-04-11 2015-03-31 Jerome Svigals System for enabling a smart device to securely accept unsolicited transactions
US9432378B1 (en) 2011-09-23 2016-08-30 Jerome Svigals Internet of things security
US9344437B2 (en) 2011-09-23 2016-05-17 Jerome Svigals Internet of things security
JP5667957B2 (ja) * 2011-09-30 2015-02-12 Kddi株式会社 マルウェア検知装置およびプログラム
US8726385B2 (en) 2011-10-05 2014-05-13 Mcafee, Inc. Distributed system and method for tracking and blocking malicious internet hosts
GB201117262D0 (en) * 2011-10-06 2011-11-16 Clark Steven D Electronic mail system
US9015109B2 (en) 2011-11-01 2015-04-21 Lemi Technology, Llc Systems, methods, and computer readable media for maintaining recommendations in a media recommendation system
WO2013067404A1 (en) * 2011-11-03 2013-05-10 Raytheon Company Intrusion prevention system (ips) mode for a malware detection system
US9832221B1 (en) * 2011-11-08 2017-11-28 Symantec Corporation Systems and methods for monitoring the activity of devices within an organization by leveraging data generated by an existing security solution deployed within the organization
US8549612B2 (en) * 2011-11-28 2013-10-01 Dell Products, Lp System and method for incorporating quality-of-service and reputation in an intrusion detection and prevention system
US20130159497A1 (en) * 2011-12-16 2013-06-20 Microsoft Corporation Heuristic-Based Rejection of Computing Resource Requests
US10365911B2 (en) * 2011-12-18 2019-07-30 International Business Machines Corporation Determining optimal update frequency for software application updates
US20130198203A1 (en) * 2011-12-22 2013-08-01 John Bates Bot detection using profile-based filtration
US8886651B1 (en) 2011-12-22 2014-11-11 Reputation.Com, Inc. Thematic clustering
US9001699B2 (en) * 2011-12-26 2015-04-07 Jaya MEGHANI Systems and methods for communication setup via reconciliation of internet protocol addresses
US8700561B2 (en) 2011-12-27 2014-04-15 Mcafee, Inc. System and method for providing data protection workflows in a network environment
US9270638B2 (en) 2012-01-20 2016-02-23 Cisco Technology, Inc. Managing address validation states in switches snooping IPv6
US10636041B1 (en) 2012-03-05 2020-04-28 Reputation.Com, Inc. Enterprise reputation evaluation
US8494973B1 (en) 2012-03-05 2013-07-23 Reputation.Com, Inc. Targeting review placement
RU2510982C2 (ru) * 2012-04-06 2014-04-10 Закрытое акционерное общество "Лаборатория Касперского" Система и способ оценки пользователей для фильтрации сообщений
US8931043B2 (en) 2012-04-10 2015-01-06 Mcafee Inc. System and method for determining and using local reputations of users and hosts to protect information in a network environment
US8782793B2 (en) * 2012-05-22 2014-07-15 Kaspersky Lab Zao System and method for detection and treatment of malware on data storage devices
US11093984B1 (en) 2012-06-29 2021-08-17 Reputation.Com, Inc. Determining themes
US9876742B2 (en) * 2012-06-29 2018-01-23 Microsoft Technology Licensing, Llc Techniques to select and prioritize application of junk email filtering rules
US9432401B2 (en) * 2012-07-06 2016-08-30 Microsoft Technology Licensing, Llc Providing consistent security information
US9049235B2 (en) * 2012-07-16 2015-06-02 Mcafee, Inc. Cloud email message scanning with local policy application in a network environment
US9124472B1 (en) 2012-07-25 2015-09-01 Symantec Corporation Providing file information to a client responsive to a file download stability prediction
US9461897B1 (en) * 2012-07-31 2016-10-04 United Services Automobile Association (Usaa) Monitoring and analysis of social network traffic
US10164929B2 (en) 2012-09-28 2018-12-25 Avaya Inc. Intelligent notification of requests for real-time online interaction via real-time communications and/or markup protocols, and related methods, systems, and computer-readable media
US9363133B2 (en) 2012-09-28 2016-06-07 Avaya Inc. Distributed application of enterprise policies to Web Real-Time Communications (WebRTC) interactive sessions, and related methods, systems, and computer-readable media
RU2514140C1 (ru) * 2012-09-28 2014-04-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ увеличения качества обнаружений вредоносных объектов с использованием правил и приоритетов
US8918473B1 (en) 2012-10-09 2014-12-23 Whatsapp Inc. System and method for detecting unwanted content
CN103824018B (zh) * 2012-11-19 2017-11-14 腾讯科技（深圳）有限公司 一种可执行文件处理方法以及可执行文件监控方法
US8904526B2 (en) * 2012-11-20 2014-12-02 Bank Of America Corporation Enhanced network security
US8869275B2 (en) * 2012-11-28 2014-10-21 Verisign, Inc. Systems and methods to detect and respond to distributed denial of service (DDoS) attacks
US9258263B2 (en) * 2012-11-29 2016-02-09 International Business Machines Corporation Dynamic granular messaging persistence
US9241259B2 (en) 2012-11-30 2016-01-19 Websense, Inc. Method and apparatus for managing the transfer of sensitive information to mobile devices
US9560069B1 (en) * 2012-12-02 2017-01-31 Symantec Corporation Method and system for protection of messages in an electronic messaging system
US9106681B2 (en) * 2012-12-17 2015-08-11 Hewlett-Packard Development Company, L.P. Reputation of network address
US8805699B1 (en) 2012-12-21 2014-08-12 Reputation.Com, Inc. Reputation report with score
US8744866B1 (en) 2012-12-21 2014-06-03 Reputation.Com, Inc. Reputation report with recommendation
US8955137B2 (en) * 2012-12-21 2015-02-10 State Farm Mutual Automobile Insurance Company System and method for uploading and verifying a document
US10572665B2 (en) 2012-12-28 2020-02-25 Fireeye, Inc. System and method to create a number of breakpoints in a virtual machine via virtual machine trapping events
US8966637B2 (en) 2013-02-08 2015-02-24 PhishMe, Inc. Performance benchmarking for simulated phishing attacks
US9398038B2 (en) 2013-02-08 2016-07-19 PhishMe, Inc. Collaborative phishing attack detection
US9356948B2 (en) 2013-02-08 2016-05-31 PhishMe, Inc. Collaborative phishing attack detection
US8990944B1 (en) 2013-02-23 2015-03-24 Fireeye, Inc. Systems and methods for automatically detecting backdoors
US9009823B1 (en) 2013-02-23 2015-04-14 Fireeye, Inc. Framework for efficient security coverage of mobile software applications installed on mobile devices
US9195829B1 (en) 2013-02-23 2015-11-24 Fireeye, Inc. User interface with real-time visual playback along with synchronous textual analysis log display and event/time index for anomalous behavior detection in applications
US9367681B1 (en) 2013-02-23 2016-06-14 Fireeye, Inc. Framework for efficient security coverage of mobile software applications using symbolic execution to reach regions of interest within an application
US9176843B1 (en) 2013-02-23 2015-11-03 Fireeye, Inc. Framework for efficient security coverage of mobile software applications
US9137049B2 (en) * 2013-02-28 2015-09-15 Apple Inc. Dynamically overriding alert suppressions based on prior actions
US10659480B2 (en) * 2013-03-07 2020-05-19 Inquest, Llc Integrated network threat analysis
US9626509B1 (en) 2013-03-13 2017-04-18 Fireeye, Inc. Malicious content analysis with multi-version application support within single operating environment
US9104867B1 (en) 2013-03-13 2015-08-11 Fireeye, Inc. Malicious content analysis using simulated user interaction without user involvement
US9355247B1 (en) 2013-03-13 2016-05-31 Fireeye, Inc. File extraction from memory dump for malicious content analysis
US10649970B1 (en) * 2013-03-14 2020-05-12 Invincea, Inc. Methods and apparatus for detection of functionality
US9311479B1 (en) 2013-03-14 2016-04-12 Fireeye, Inc. Correlation and consolidation of analytic data for holistic view of a malware attack
US9294458B2 (en) 2013-03-14 2016-03-22 Avaya Inc. Managing identity provider (IdP) identifiers for web real-time communications (WebRTC) interactive flows, and related methods, systems, and computer-readable media
US9430646B1 (en) 2013-03-14 2016-08-30 Fireeye, Inc. Distributed systems and methods for automatically detecting unknown bots and botnets
US8925099B1 (en) 2013-03-14 2014-12-30 Reputation.Com, Inc. Privacy scoring
WO2014145805A1 (en) 2013-03-15 2014-09-18 Mandiant, Llc System and method employing structured intelligence to verify and contain threats at endpoints
US10164989B2 (en) * 2013-03-15 2018-12-25 Nominum, Inc. Distinguishing human-driven DNS queries from machine-to-machine DNS queries
US10713358B2 (en) 2013-03-15 2020-07-14 Fireeye, Inc. System and method to extract and utilize disassembly features to classify software intent
US9722918B2 (en) 2013-03-15 2017-08-01 A10 Networks, Inc. System and method for customizing the identification of application or content type
US9244903B2 (en) 2013-04-15 2016-01-26 Vmware, Inc. Efficient data pattern matching
US10318397B2 (en) * 2013-04-15 2019-06-11 Vmware, Inc. Efficient data pattern matching
WO2014176461A1 (en) * 2013-04-25 2014-10-30 A10 Networks, Inc. Systems and methods for network access control
US9634970B2 (en) 2013-04-30 2017-04-25 Cloudmark, Inc. Apparatus and method for augmenting a message to facilitate spam identification
US9495180B2 (en) 2013-05-10 2016-11-15 Fireeye, Inc. Optimized resource allocation for virtual machines within a malware content detection system
US9635039B1 (en) 2013-05-13 2017-04-25 Fireeye, Inc. Classifying sets of malicious indicators for detecting command and control communications associated with malware
US10205624B2 (en) 2013-06-07 2019-02-12 Avaya Inc. Bandwidth-efficient archiving of real-time interactive flows, and related methods, systems, and computer-readable media
US10133863B2 (en) 2013-06-24 2018-11-20 Fireeye, Inc. Zero-day discovery system
US9639693B2 (en) * 2013-06-28 2017-05-02 Symantec Corporation Techniques for detecting a security vulnerability
US9300686B2 (en) 2013-06-28 2016-03-29 Fireeye, Inc. System and method for detecting malicious links in electronic messages
US9525718B2 (en) 2013-06-30 2016-12-20 Avaya Inc. Back-to-back virtual web real-time communications (WebRTC) agents, and related methods, systems, and computer-readable media
US9065969B2 (en) 2013-06-30 2015-06-23 Avaya Inc. Scalable web real-time communications (WebRTC) media engines, and related methods, systems, and computer-readable media
US9112840B2 (en) 2013-07-17 2015-08-18 Avaya Inc. Verifying privacy of web real-time communications (WebRTC) media channels via corresponding WebRTC data channels, and related methods, systems, and computer-readable media
CN103338211A (zh) * 2013-07-19 2013-10-02 腾讯科技（深圳）有限公司 一种恶意url鉴定方法及装置
US9614890B2 (en) 2013-07-31 2017-04-04 Avaya Inc. Acquiring and correlating web real-time communications (WEBRTC) interactive flow characteristics, and related methods, systems, and computer-readable media
US9531808B2 (en) 2013-08-22 2016-12-27 Avaya Inc. Providing data resource services within enterprise systems for resource level sharing among multiple applications, and related methods, systems, and computer-readable media
KR101480903B1 (ko) * 2013-09-03 2015-01-13 한국전자통신연구원 모바일 악성코드 다중 점검 방법
US10225212B2 (en) 2013-09-26 2019-03-05 Avaya Inc. Providing network management based on monitoring quality of service (QOS) characteristics of web real-time communications (WEBRTC) interactive flows, and related methods, systems, and computer-readable media
US9628507B2 (en) 2013-09-30 2017-04-18 Fireeye, Inc. Advanced persistent threat (APT) detection center
US9736179B2 (en) 2013-09-30 2017-08-15 Fireeye, Inc. System, apparatus and method for using malware analysis results to drive adaptive instrumentation of virtual machines to improve exploit detection
US9171160B2 (en) 2013-09-30 2015-10-27 Fireeye, Inc. Dynamically adaptive framework and method for classifying malware using intelligent static, emulation, and dynamic analyses
US9690936B1 (en) 2013-09-30 2017-06-27 Fireeye, Inc. Multistage system and method for analyzing obfuscated content for malware
US9294501B2 (en) 2013-09-30 2016-03-22 Fireeye, Inc. Fuzzy hash of behavioral results
US10515214B1 (en) 2013-09-30 2019-12-24 Fireeye, Inc. System and method for classifying malware within content created during analysis of a specimen
RU2013144681A (ru) 2013-10-03 2015-04-10 Общество С Ограниченной Ответственностью "Яндекс" Система обработки электронного сообщения для определения его классификации
GB2518880A (en) 2013-10-04 2015-04-08 Glasswall Ip Ltd Anti-Malware mobile content data management apparatus and method
GB2519516B (en) * 2013-10-21 2017-05-10 Openwave Mobility Inc A method, apparatus and computer program for modifying messages in a communications network
WO2015060857A1 (en) 2013-10-24 2015-04-30 Mcafee, Inc. Agent assisted malicious application blocking in a network environment
US10263952B2 (en) 2013-10-31 2019-04-16 Avaya Inc. Providing origin insight for web applications via session traversal utilities for network address translation (STUN) messages, and related methods, systems, and computer-readable media
US9319423B2 (en) * 2013-11-04 2016-04-19 At&T Intellectual Property I, L.P. Malware and anomaly detection via activity recognition based on sensor data
US9769214B2 (en) 2013-11-05 2017-09-19 Avaya Inc. Providing reliable session initiation protocol (SIP) signaling for web real-time communications (WEBRTC) interactive flows, and related methods, systems, and computer-readable media
US10694029B1 (en) 2013-11-07 2020-06-23 Rightquestion, Llc Validating automatic number identification data
US9921978B1 (en) 2013-11-08 2018-03-20 Fireeye, Inc. System and method for enhanced security of storage devices
GB2520972A (en) 2013-12-05 2015-06-10 Ibm Workload management
US9747446B1 (en) 2013-12-26 2017-08-29 Fireeye, Inc. System and method for run-time object classification
US9756074B2 (en) 2013-12-26 2017-09-05 Fireeye, Inc. System and method for IPS and VM-based detection of suspicious objects
US10129243B2 (en) 2013-12-27 2018-11-13 Avaya Inc. Controlling access to traversal using relays around network address translation (TURN) servers using trusted single-use credentials
US9288221B2 (en) * 2014-01-14 2016-03-15 Pfu Limited Information processing apparatus, method for determining unauthorized activity and computer-readable medium
US9292686B2 (en) 2014-01-16 2016-03-22 Fireeye, Inc. Micro-virtualization architecture for threat-aware microvisor deployment in a node of a network environment
US9262635B2 (en) 2014-02-05 2016-02-16 Fireeye, Inc. Detection efficacy of virtual machine-based analysis with application specific events
US9264418B1 (en) * 2014-02-20 2016-02-16 Amazon Technologies, Inc. Client-side spam detection and prevention
EP3108399A4 (en) 2014-02-21 2017-07-19 Hewlett-Packard Enterprise Development LP Scoring for threat observables
US9241010B1 (en) 2014-03-20 2016-01-19 Fireeye, Inc. System and method for network behavior detection
US10242185B1 (en) 2014-03-21 2019-03-26 Fireeye, Inc. Dynamic guest image creation and rollback
US9591015B1 (en) 2014-03-28 2017-03-07 Fireeye, Inc. System and method for offloading packet processing and static analysis operations
US9223972B1 (en) 2014-03-31 2015-12-29 Fireeye, Inc. Dynamically remote tuning of a malware content detection system
US9432389B1 (en) 2014-03-31 2016-08-30 Fireeye, Inc. System, apparatus and method for detecting a malicious attack based on static analysis of a multi-flow object
US9749363B2 (en) 2014-04-17 2017-08-29 Avaya Inc. Application of enterprise policies to web real-time communications (WebRTC) interactive sessions using an enterprise session initiation protocol (SIP) engine, and related methods, systems, and computer-readable media
US10581927B2 (en) 2014-04-17 2020-03-03 Avaya Inc. Providing web real-time communications (WebRTC) media services via WebRTC-enabled media servers, and related methods, systems, and computer-readable media
US9245123B1 (en) 2014-05-07 2016-01-26 Symantec Corporation Systems and methods for identifying malicious files
US9906422B2 (en) 2014-05-16 2018-02-27 A10 Networks, Inc. Distributed system to determine a server's health
US9438623B1 (en) 2014-06-06 2016-09-06 Fireeye, Inc. Computer exploit detection using heap spray pattern matching
US9973531B1 (en) 2014-06-06 2018-05-15 Fireeye, Inc. Shellcode detection
US9594912B1 (en) 2014-06-06 2017-03-14 Fireeye, Inc. Return-oriented programming detection
WO2015195093A1 (en) 2014-06-17 2015-12-23 Hewlett-Packard Development Company, L. P. Dns based infection scores
US9912705B2 (en) 2014-06-24 2018-03-06 Avaya Inc. Enhancing media characteristics during web real-time communications (WebRTC) interactive sessions by using session initiation protocol (SIP) endpoints, and related methods, systems, and computer-readable media
US10084813B2 (en) 2014-06-24 2018-09-25 Fireeye, Inc. Intrusion prevention and remedy system
US9652615B1 (en) 2014-06-25 2017-05-16 Symantec Corporation Systems and methods for analyzing suspected malware
US9398028B1 (en) 2014-06-26 2016-07-19 Fireeye, Inc. System, device and method for detecting a malicious attack based on communcations between remotely hosted virtual machines and malicious web servers
US10805340B1 (en) 2014-06-26 2020-10-13 Fireeye, Inc. Infection vector and malware tracking with an interactive user display
US20150381533A1 (en) * 2014-06-29 2015-12-31 Avaya Inc. System and Method for Email Management Through Detection and Analysis of Dynamically Variable Behavior and Activity Patterns
US10002252B2 (en) 2014-07-01 2018-06-19 Fireeye, Inc. Verification of trusted threat-aware microvisor
CN105338126B (zh) * 2014-07-17 2018-10-23 阿里巴巴集团控股有限公司 远程查询信息的方法及服务器
US9654484B2 (en) * 2014-07-31 2017-05-16 Cisco Technology, Inc. Detecting DGA-based malicious software using network flow information
US10666676B1 (en) * 2014-08-18 2020-05-26 Trend Micro Incorporated Detection of targeted email attacks
US9548988B1 (en) 2014-08-18 2017-01-17 Symantec Corporation Systems and methods for attributing potentially malicious email campaigns to known threat groups
US9363280B1 (en) 2014-08-22 2016-06-07 Fireeye, Inc. System and method of detecting delivery of malware using cross-customer data
US9729565B2 (en) * 2014-09-17 2017-08-08 Cisco Technology, Inc. Provisional bot activity recognition
US10671726B1 (en) 2014-09-22 2020-06-02 Fireeye Inc. System and method for malware analysis using thread-level event monitoring
US10027689B1 (en) 2014-09-29 2018-07-17 Fireeye, Inc. Interactive infection visualization for improved exploit detection and signature generation for malware and malware families
US9773112B1 (en) 2014-09-29 2017-09-26 Fireeye, Inc. Exploit detection of malware and malware families
US9754106B2 (en) * 2014-10-14 2017-09-05 Symantec Corporation Systems and methods for classifying security events as targeted attacks
US9571510B1 (en) 2014-10-21 2017-02-14 Symantec Corporation Systems and methods for identifying security threat sources responsible for security events
KR102295664B1 (ko) * 2014-10-21 2021-08-27 삼성에스디에스 주식회사 글로벌 서버 로드 밸런서 장치 및 상기 장치에서의 동적 캐쉬 유효 기간 제어 방법
US9870534B1 (en) 2014-11-06 2018-01-16 Nominum, Inc. Predicting network activities associated with a given site
WO2016073793A1 (en) * 2014-11-07 2016-05-12 Area 1 Security, Inc. Remediating computer security threats using distributed sensor computers
US9374385B1 (en) 2014-11-07 2016-06-21 Area 1 Security, Inc. Remediating computer security threats using distributed sensor computers
US9398047B2 (en) * 2014-11-17 2016-07-19 Vade Retro Technology, Inc. Methods and systems for phishing detection
US9330264B1 (en) 2014-11-26 2016-05-03 Glasswall (Ip) Limited Statistical analytic method for the determination of the risk posed by file based content
EP3234791A4 (en) 2014-12-16 2018-07-11 Entit Software LLC Determining permissible activity based on permissible activity rules
US9690933B1 (en) 2014-12-22 2017-06-27 Fireeye, Inc. Framework for classifying an object as malicious with machine learning for deploying updated predictive models
US10075455B2 (en) 2014-12-26 2018-09-11 Fireeye, Inc. Zero-day rotating guest image profile
US9378364B1 (en) * 2014-12-27 2016-06-28 Intel Corporation Technologies for managing security threats to a computing system utilizing user interactions
US9621575B1 (en) * 2014-12-29 2017-04-11 A10 Networks, Inc. Context aware threat protection
US9934376B1 (en) 2014-12-29 2018-04-03 Fireeye, Inc. Malware detection appliance architecture
US9838417B1 (en) 2014-12-30 2017-12-05 Fireeye, Inc. Intelligent context aware user interaction for malware detection
US10164927B2 (en) 2015-01-14 2018-12-25 Vade Secure, Inc. Safe unsubscribe
US9674053B2 (en) * 2015-01-30 2017-06-06 Gigamon Inc. Automatic target selection
JP2016148967A (ja) * 2015-02-12 2016-08-18 富士通株式会社 情報処理装置、情報処理方法及びプログラム
MA41502A (fr) 2015-02-14 2017-12-19 Valimail Inc Validation centralisée d'expéditeurs d'email par ciblage de noms ehlo et d'adresses ip
US9690606B1 (en) 2015-03-25 2017-06-27 Fireeye, Inc. Selective system call monitoring
US10148693B2 (en) 2015-03-25 2018-12-04 Fireeye, Inc. Exploit detection system
US9438613B1 (en) 2015-03-30 2016-09-06 Fireeye, Inc. Dynamic content activation for automated analysis of embedded objects
US10417031B2 (en) 2015-03-31 2019-09-17 Fireeye, Inc. Selective virtualization for security threat detection
US9483644B1 (en) 2015-03-31 2016-11-01 Fireeye, Inc. Methods for detecting file altering malware in VM based analysis
US10474813B1 (en) 2015-03-31 2019-11-12 Fireeye, Inc. Code injection technique for remediation at an endpoint of a network
US10298602B2 (en) 2015-04-10 2019-05-21 Cofense Inc. Suspicious message processing and incident response
WO2016164844A1 (en) * 2015-04-10 2016-10-13 PhishMe, Inc. Message report processing and threat prioritization
US9906539B2 (en) 2015-04-10 2018-02-27 PhishMe, Inc. Suspicious message processing and incident response
US9654485B1 (en) 2015-04-13 2017-05-16 Fireeye, Inc. Analytics-based security monitoring system and method
US9594904B1 (en) 2015-04-23 2017-03-14 Fireeye, Inc. Detecting malware based on reflection
US20160337394A1 (en) * 2015-05-11 2016-11-17 The Boeing Company Newborn domain screening of electronic mail messages
US11363035B2 (en) 2015-05-22 2022-06-14 Fisher-Rosemount Systems, Inc. Configurable robustness agent in a plant security system
US9961090B2 (en) * 2015-06-18 2018-05-01 Bank Of America Corporation Message quarantine
US9521157B1 (en) * 2015-06-24 2016-12-13 Bank Of America Corporation Identifying and assessing malicious resources
US11113086B1 (en) 2015-06-30 2021-09-07 Fireeye, Inc. Virtual system and method for securing external network connectivity
US10454950B1 (en) 2015-06-30 2019-10-22 Fireeye, Inc. Centralized aggregation technique for detecting lateral movement of stealthy cyber-attacks
US10642753B1 (en) 2015-06-30 2020-05-05 Fireeye, Inc. System and method for protecting a software component running in virtual machine using a virtualization layer
US10726127B1 (en) 2015-06-30 2020-07-28 Fireeye, Inc. System and method for protecting a software component running in a virtual machine through virtual interrupts by the virtualization layer
KR101666614B1 (ko) * 2015-07-06 2016-10-14 (주)다우기술 이력을 이용한 지능형 지속 위협 탐지 시스템 및 방법
US9954804B2 (en) * 2015-07-30 2018-04-24 International Business Machines Coporation Method and system for preemptive harvesting of spam messages
US9690938B1 (en) 2015-08-05 2017-06-27 Invincea, Inc. Methods and apparatus for machine learning based malware detection
US10715542B1 (en) 2015-08-14 2020-07-14 Fireeye, Inc. Mobile application risk analysis
CN105187408A (zh) * 2015-08-17 2015-12-23 北京神州绿盟信息安全科技股份有限公司 网络攻击检测方法和设备
US9654492B2 (en) * 2015-09-15 2017-05-16 Mimecast North America, Inc. Malware detection system based on stored data
US9467435B1 (en) 2015-09-15 2016-10-11 Mimecast North America, Inc. Electronic message threat protection system for authorized users
US10536449B2 (en) 2015-09-15 2020-01-14 Mimecast Services Ltd. User login credential warning system
US10728239B2 (en) 2015-09-15 2020-07-28 Mimecast Services Ltd. Mediated access to resources
US11595417B2 (en) 2015-09-15 2023-02-28 Mimecast Services Ltd. Systems and methods for mediating access to resources
US10536408B2 (en) * 2015-09-16 2020-01-14 Litéra Corporation Systems and methods for detecting, reporting and cleaning metadata from inbound attachments
US9787581B2 (en) 2015-09-21 2017-10-10 A10 Networks, Inc. Secure data flow open information analytics
US10176321B2 (en) 2015-09-22 2019-01-08 Fireeye, Inc. Leveraging behavior-based rules for malware family classification
US10033747B1 (en) 2015-09-29 2018-07-24 Fireeye, Inc. System and method for detecting interpreter-based exploit attacks
US10706149B1 (en) 2015-09-30 2020-07-07 Fireeye, Inc. Detecting delayed activation malware using a primary controller and plural time controllers
US10817606B1 (en) 2015-09-30 2020-10-27 Fireeye, Inc. Detecting delayed activation malware using a run-time monitoring agent and time-dilation logic
US9825989B1 (en) * 2015-09-30 2017-11-21 Fireeye, Inc. Cyber attack early warning system
US9825976B1 (en) 2015-09-30 2017-11-21 Fireeye, Inc. Detection and classification of exploit kits
US10210329B1 (en) 2015-09-30 2019-02-19 Fireeye, Inc. Method to detect application execution hijacking using memory protection
US10601865B1 (en) 2015-09-30 2020-03-24 Fireeye, Inc. Detection of credential spearphishing attacks using email analysis
US10284575B2 (en) 2015-11-10 2019-05-07 Fireeye, Inc. Launcher for setting analysis environment variations for malware detection
FR3043807B1 (fr) * 2015-11-18 2017-12-08 Bull Sas Dispositif de validation de communication
EP3171567B1 (en) * 2015-11-23 2018-10-24 Alcatel Lucent Advanced persistent threat detection
US10846117B1 (en) 2015-12-10 2020-11-24 Fireeye, Inc. Technique for establishing secure communication between host and guest processes of a virtualization architecture
US10447728B1 (en) 2015-12-10 2019-10-15 Fireeye, Inc. Technique for protecting guest processes using a layered virtualization architecture
US10108446B1 (en) 2015-12-11 2018-10-23 Fireeye, Inc. Late load technique for deploying a virtualization layer underneath a running operating system
US10621338B1 (en) 2015-12-30 2020-04-14 Fireeye, Inc. Method to detect forgery and exploits using last branch recording registers
US10565378B1 (en) 2015-12-30 2020-02-18 Fireeye, Inc. Exploit of privilege detection framework
US10050998B1 (en) * 2015-12-30 2018-08-14 Fireeye, Inc. Malicious message analysis system
US10133866B1 (en) 2015-12-30 2018-11-20 Fireeye, Inc. System and method for triggering analysis of an object for malware in response to modification of that object
US10706368B2 (en) * 2015-12-30 2020-07-07 Veritas Technologies Llc Systems and methods for efficiently classifying data objects
US10581874B1 (en) 2015-12-31 2020-03-03 Fireeye, Inc. Malware detection system with contextual analysis
US11552986B1 (en) * 2015-12-31 2023-01-10 Fireeye Security Holdings Us Llc Cyber-security framework for application of virtual features
US9824216B1 (en) 2015-12-31 2017-11-21 Fireeye, Inc. Susceptible environment detection system
US10049193B2 (en) * 2016-01-04 2018-08-14 Bank Of America Corporation System for neutralizing misappropriated electronic files
US10154056B2 (en) 2016-02-10 2018-12-11 Agari Data, Inc. Message authenticity and risk assessment
US10218656B2 (en) 2016-03-08 2019-02-26 International Business Machines Corporation Smart message delivery based on transaction processing status
JP5982597B1 (ja) * 2016-03-10 2016-08-31 株式会社Ffri 情報処理装置、情報処理方法、プログラム及びプログラムを記録したコンピュータ読み取り可能な記録媒体
US10142366B2 (en) 2016-03-15 2018-11-27 Vade Secure, Inc. Methods, systems and devices to mitigate the effects of side effect URLs in legitimate and phishing electronic messages
US10432661B2 (en) * 2016-03-24 2019-10-01 Cisco Technology, Inc. Score boosting strategies for capturing domain-specific biases in anomaly detection systems
US10616266B1 (en) 2016-03-25 2020-04-07 Fireeye, Inc. Distributed malware detection system and submission workflow thereof
US10671721B1 (en) 2016-03-25 2020-06-02 Fireeye, Inc. Timeout management services
US10785255B1 (en) 2016-03-25 2020-09-22 Fireeye, Inc. Cluster configuration within a scalable malware detection system
US10601863B1 (en) 2016-03-25 2020-03-24 Fireeye, Inc. System and method for managing sensor enrollment
US9591012B1 (en) * 2016-03-31 2017-03-07 Viewpost Ip Holdings, Llc Systems and methods for detecing fraudulent electronic communication
US10893059B1 (en) 2016-03-31 2021-01-12 Fireeye, Inc. Verification and enhancement using detection systems located at the network periphery and endpoint devices
US10938781B2 (en) 2016-04-22 2021-03-02 Sophos Limited Secure labeling of network flows
US11102238B2 (en) 2016-04-22 2021-08-24 Sophos Limited Detecting triggering events for distributed denial of service attacks
US11277416B2 (en) * 2016-04-22 2022-03-15 Sophos Limited Labeling network flows according to source applications
US11165797B2 (en) 2016-04-22 2021-11-02 Sophos Limited Detecting endpoint compromise based on network usage history
US10986109B2 (en) 2016-04-22 2021-04-20 Sophos Limited Local proxy detection
EP3475822B1 (en) 2016-06-22 2020-07-22 Invincea, Inc. Methods and apparatus for detecting whether a string of characters represents malicious activity using machine learning
US10169585B1 (en) 2016-06-22 2019-01-01 Fireeye, Inc. System and methods for advanced malware detection through placement of transition events
US10073968B1 (en) * 2016-06-24 2018-09-11 Symantec Corporation Systems and methods for classifying files
GB2566657B8 (en) 2016-06-30 2022-04-13 Sophos Ltd Proactive network security using a health heartbeat
US10462173B1 (en) 2016-06-30 2019-10-29 Fireeye, Inc. Malware detection verification and enhancement by coordinating endpoint and malware detection systems
US10812348B2 (en) 2016-07-15 2020-10-20 A10 Networks, Inc. Automatic capture of network data for a detected anomaly
US10938844B2 (en) 2016-07-22 2021-03-02 At&T Intellectual Property I, L.P. Providing security through characterizing mobile traffic by domain names
US10341118B2 (en) 2016-08-01 2019-07-02 A10 Networks, Inc. SSL gateway with integrated hardware security module
RU2649793C2 (ru) 2016-08-03 2018-04-04 ООО "Группа АйБи" Способ и система выявления удаленного подключения при работе на страницах веб-ресурса
US11349852B2 (en) 2016-08-31 2022-05-31 Wedge Networks Inc. Apparatus and methods for network-based line-rate detection of unknown malware
US11182476B2 (en) * 2016-09-07 2021-11-23 Micro Focus Llc Enhanced intelligence for a security information sharing platform
US10592678B1 (en) 2016-09-09 2020-03-17 Fireeye, Inc. Secure communications between peers using a verified virtual trusted platform module
RU2634209C1 (ru) 2016-09-19 2017-10-24 Общество с ограниченной ответственностью "Группа АйБи ТДС" Система и способ автогенерации решающих правил для систем обнаружения вторжений с обратной связью
US10805270B2 (en) 2016-09-26 2020-10-13 Agari Data, Inc. Mitigating communication risk by verifying a sender of a message
US10880322B1 (en) 2016-09-26 2020-12-29 Agari Data, Inc. Automated tracking of interaction with a resource of a message
US11936604B2 (en) 2016-09-26 2024-03-19 Agari Data, Inc. Multi-level security analysis and intermediate delivery of an electronic message
US10805314B2 (en) * 2017-05-19 2020-10-13 Agari Data, Inc. Using message context to evaluate security of requested data
US10491627B1 (en) 2016-09-29 2019-11-26 Fireeye, Inc. Advanced malware detection using similarity analysis
US10218716B2 (en) * 2016-10-01 2019-02-26 Intel Corporation Technologies for analyzing uniform resource locators
US10382562B2 (en) 2016-11-04 2019-08-13 A10 Networks, Inc. Verification of server certificates using hash codes
US10795991B1 (en) 2016-11-08 2020-10-06 Fireeye, Inc. Enterprise search
GB2555858B (en) * 2016-11-15 2021-06-23 F Secure Corp Remote malware scanning method and apparatus
US10587647B1 (en) 2016-11-22 2020-03-10 Fireeye, Inc. Technique for malware detection capability comparison of network security devices
US11722513B2 (en) 2016-11-30 2023-08-08 Agari Data, Inc. Using a measure of influence of sender in determining a security risk associated with an electronic message
US11044267B2 (en) 2016-11-30 2021-06-22 Agari Data, Inc. Using a measure of influence of sender in determining a security risk associated with an electronic message
US10250475B2 (en) 2016-12-08 2019-04-02 A10 Networks, Inc. Measurement of application response delay time
US10552610B1 (en) 2016-12-22 2020-02-04 Fireeye, Inc. Adaptive virtual machine snapshot update framework for malware behavioral analysis
US10581879B1 (en) 2016-12-22 2020-03-03 Fireeye, Inc. Enhanced malware detection for generated objects
CN111541672A (zh) * 2016-12-23 2020-08-14 新东网科技有限公司 一种检测http请求安全性方法及系统
US10523609B1 (en) 2016-12-27 2019-12-31 Fireeye, Inc. Multi-vector malware detection and analysis
RU2671991C2 (ru) 2016-12-29 2018-11-08 Общество с ограниченной ответственностью "Траст" Система и способ сбора информации для обнаружения фишинга
RU2637477C1 (ru) 2016-12-29 2017-12-04 Общество с ограниченной ответственностью "Траст" Система и способ обнаружения фишинговых веб-страниц
US10397270B2 (en) 2017-01-04 2019-08-27 A10 Networks, Inc. Dynamic session rate limiter
US10187377B2 (en) 2017-02-08 2019-01-22 A10 Networks, Inc. Caching network generated security certificates
US10904286B1 (en) 2017-03-24 2021-01-26 Fireeye, Inc. Detection of phishing attacks using similarity analysis
US10902119B1 (en) 2017-03-30 2021-01-26 Fireeye, Inc. Data extraction system for malware analysis
US10798112B2 (en) 2017-03-30 2020-10-06 Fireeye, Inc. Attribute-controlled malware detection
US10848397B1 (en) 2017-03-30 2020-11-24 Fireeye, Inc. System and method for enforcing compliance with subscription requirements for cyber-attack detection service
US10791138B1 (en) 2017-03-30 2020-09-29 Fireeye, Inc. Subscription-based malware detection
US11019076B1 (en) 2017-04-26 2021-05-25 Agari Data, Inc. Message security assessment using sender identity profiles
JP6533823B2 (ja) * 2017-05-08 2019-06-19 デジタルア−ツ株式会社 情報処理装置、情報処理システム、プログラム、記録媒体及び情報処理方法
US10170112B2 (en) * 2017-05-11 2019-01-01 Google Llc Detecting and suppressing voice queries
US11102244B1 (en) * 2017-06-07 2021-08-24 Agari Data, Inc. Automated intelligence gathering
US11757914B1 (en) 2017-06-07 2023-09-12 Agari Data, Inc. Automated responsive message to determine a security risk of a message sender
JP6378808B2 (ja) * 2017-06-28 2018-08-22 エヌ・ティ・ティ・コミュニケーションズ株式会社 接続先情報判定装置、接続先情報判定方法、及びプログラム
US10855700B1 (en) 2017-06-29 2020-12-01 Fireeye, Inc. Post-intrusion detection of cyber-attacks during lateral movement within networks
US10601848B1 (en) 2017-06-29 2020-03-24 Fireeye, Inc. Cyber-security system and method for weak indicator detection and correlation to generate strong indicators
US10503904B1 (en) 2017-06-29 2019-12-10 Fireeye, Inc. Ransomware detection and mitigation
US10893068B1 (en) 2017-06-30 2021-01-12 Fireeye, Inc. Ransomware file modification prevention technique
US10742669B2 (en) * 2017-08-09 2020-08-11 NTT Security Corporation Malware host netflow analysis system and method
RU2666644C1 (ru) * 2017-08-10 2018-09-11 Акционерное общество "Лаборатория Касперского" Система и способ выявления потенциально опасных устройств при взаимодействии пользователя с банковскими сервисами
US10891373B2 (en) * 2017-08-31 2021-01-12 Micro Focus Llc Quarantining electronic messages based on relationships among associated addresses
US10983602B2 (en) * 2017-09-05 2021-04-20 Microsoft Technology Licensing, Llc Identifying an input device
US10747872B1 (en) 2017-09-27 2020-08-18 Fireeye, Inc. System and method for preventing malware evasion
US10805346B2 (en) 2017-10-01 2020-10-13 Fireeye, Inc. Phishing attack detection
US10708308B2 (en) * 2017-10-02 2020-07-07 Servicenow, Inc. Automated mitigation of electronic message based security threats
US11108809B2 (en) 2017-10-27 2021-08-31 Fireeye, Inc. System and method for analyzing binary code for malware classification using artificial neural network techniques
US11470029B2 (en) * 2017-10-31 2022-10-11 Edgewave, Inc. Analysis and reporting of suspicious email
RU2689816C2 (ru) 2017-11-21 2019-05-29 ООО "Группа АйБи" Способ для классифицирования последовательности действий пользователя (варианты)
WO2019104350A1 (en) 2017-11-27 2019-05-31 ArmorBlox, Inc. User model-based data loss prevention
US11240275B1 (en) 2017-12-28 2022-02-01 Fireeye Security Holdings Us Llc Platform and method for performing cybersecurity analyses employing an intelligence hub with a modular architecture
US11005860B1 (en) 2017-12-28 2021-05-11 Fireeye, Inc. Method and system for efficient cybersecurity analysis of endpoint events
US11271955B2 (en) 2017-12-28 2022-03-08 Fireeye Security Holdings Us Llc Platform and method for retroactive reclassification employing a cybersecurity-based global data store
RU2677361C1 (ru) 2018-01-17 2019-01-16 Общество с ограниченной ответственностью "Траст" Способ и система децентрализованной идентификации вредоносных программ
RU2668710C1 (ru) 2018-01-17 2018-10-02 Общество с ограниченной ответственностью "Группа АйБи ТДС" Вычислительное устройство и способ для обнаружения вредоносных доменных имен в сетевом трафике
RU2677368C1 (ru) 2018-01-17 2019-01-16 Общество С Ограниченной Ответственностью "Группа Айби" Способ и система для автоматического определения нечетких дубликатов видеоконтента
RU2680736C1 (ru) 2018-01-17 2019-02-26 Общество с ограниченной ответственностью "Группа АйБи ТДС" Сервер и способ для определения вредоносных файлов в сетевом трафике
RU2676247C1 (ru) 2018-01-17 2018-12-26 Общество С Ограниченной Ответственностью "Группа Айби" Способ и компьютерное устройство для кластеризации веб-ресурсов
RU2681699C1 (ru) 2018-02-13 2019-03-12 Общество с ограниченной ответственностью "Траст" Способ и сервер для поиска связанных сетевых ресурсов
US10826931B1 (en) 2018-03-29 2020-11-03 Fireeye, Inc. System and method for predicting and mitigating cybersecurity system misconfigurations
US10956477B1 (en) 2018-03-30 2021-03-23 Fireeye, Inc. System and method for detecting malicious scripts through natural language processing modeling
US11003773B1 (en) 2018-03-30 2021-05-11 Fireeye, Inc. System and method for automatically generating malware detection rule recommendations
US11558401B1 (en) 2018-03-30 2023-01-17 Fireeye Security Holdings Us Llc Multi-vector malware detection data sharing system for improved detection
JP6768732B2 (ja) * 2018-04-05 2020-10-14 デジタルア−ツ株式会社 情報処理装置、情報処理プログラム、記録媒体及び情報処理方法
US10880319B2 (en) * 2018-04-26 2020-12-29 Micro Focus Llc Determining potentially malware generated domain names
US11431745B2 (en) * 2018-04-30 2022-08-30 Microsoft Technology Licensing, Llc Techniques for curating threat intelligence data
US10785188B2 (en) * 2018-05-22 2020-09-22 Proofpoint, Inc. Domain name processing systems and methods
US10839353B2 (en) * 2018-05-24 2020-11-17 Mxtoolbox, Inc. Systems and methods for improved email security by linking customer domains to outbound sources
US11372893B2 (en) 2018-06-01 2022-06-28 Ntt Security Holdings Corporation Ensemble-based data curation pipeline for efficient label propagation
US11314859B1 (en) 2018-06-27 2022-04-26 FireEye Security Holdings, Inc. Cyber-security system and method for detecting escalation of privileges within an access token
US11075930B1 (en) 2018-06-27 2021-07-27 Fireeye, Inc. System and method for detecting repetitive cybersecurity attacks constituting an email campaign
US11228491B1 (en) 2018-06-28 2022-01-18 Fireeye Security Holdings Us Llc System and method for distributed cluster configuration monitoring and management
US11316900B1 (en) 2018-06-29 2022-04-26 FireEye Security Holdings Inc. System and method for automatically prioritizing rules for cyber-threat detection and mitigation
US11182473B1 (en) 2018-09-13 2021-11-23 Fireeye Security Holdings Us Llc System and method for mitigating cyberattacks against processor operability by a guest process
US11374977B2 (en) * 2018-09-20 2022-06-28 Forcepoint Llc Endpoint risk-based network protection
US11763004B1 (en) 2018-09-27 2023-09-19 Fireeye Security Holdings Us Llc System and method for bootkit detection
US11025651B2 (en) 2018-12-06 2021-06-01 Saudi Arabian Oil Company System and method for enhanced security analysis for quarantined email messages
RU2708508C1 (ru) 2018-12-17 2019-12-09 Общество с ограниченной ответственностью "Траст" Способ и вычислительное устройство для выявления подозрительных пользователей в системах обмена сообщениями
US11743290B2 (en) 2018-12-21 2023-08-29 Fireeye Security Holdings Us Llc System and method for detecting cyberattacks impersonating legitimate sources
US11368475B1 (en) 2018-12-21 2022-06-21 Fireeye Security Holdings Us Llc System and method for scanning remote services to locate stored objects with malware
US11176251B1 (en) 2018-12-21 2021-11-16 Fireeye, Inc. Determining malware via symbolic function hash analysis
RU2701040C1 (ru) 2018-12-28 2019-09-24 Общество с ограниченной ответственностью "Траст" Способ и вычислительное устройство для информирования о вредоносных веб-ресурсах
US11601444B1 (en) 2018-12-31 2023-03-07 Fireeye Security Holdings Us Llc Automated system for triage of customer issues
US11411990B2 (en) * 2019-02-15 2022-08-09 Forcepoint Llc Early detection of potentially-compromised email accounts
SG11202101624WA (en) 2019-02-27 2021-03-30 Group Ib Ltd Method and system for user identification by keystroke dynamics
US11063897B2 (en) 2019-03-01 2021-07-13 Cdw Llc Method and system for analyzing electronic communications and customer information to recognize and mitigate message-based attacks
US11310238B1 (en) 2019-03-26 2022-04-19 FireEye Security Holdings, Inc. System and method for retrieval and analysis of operational data from customer, cloud-hosted virtual resources
US10686826B1 (en) 2019-03-28 2020-06-16 Vade Secure Inc. Optical scanning parameters computation methods, devices and systems for malicious URL detection
RU2710739C1 (ru) * 2019-03-29 2020-01-10 Акционерное общество "Лаборатория Касперского" Система и способ формирования эвристических правил для выявления писем, содержащих спам
US11677786B1 (en) 2019-03-29 2023-06-13 Fireeye Security Holdings Us Llc System and method for detecting and protecting against cybersecurity attacks on servers
US11636198B1 (en) 2019-03-30 2023-04-25 Fireeye Security Holdings Us Llc System and method for cybersecurity analyzer update and concurrent management system
US11290358B2 (en) 2019-05-30 2022-03-29 Vmware, Inc. Partitioning health monitoring in a global server load balancing system
US11258806B1 (en) 2019-06-24 2022-02-22 Mandiant, Inc. System and method for automatically associating cybersecurity intelligence to cyberthreat actors
US11405363B2 (en) 2019-06-26 2022-08-02 Microsoft Technology Licensing, Llc File upload control for client-side applications in proxy solutions
US11556640B1 (en) 2019-06-27 2023-01-17 Mandiant, Inc. Systems and methods for automated cybersecurity analysis of extracted binary string sets
US11392700B1 (en) 2019-06-28 2022-07-19 Fireeye Security Holdings Us Llc System and method for supporting cross-platform data verification
US11178178B2 (en) 2019-07-29 2021-11-16 Material Security Inc. Secure communications service for intercepting suspicious messages and performing backchannel verification thereon
CN110443051B (zh) * 2019-07-30 2022-12-27 空气动力学国家重点实验室 一种防止涉密文档在互联网传播的方法
US11159464B2 (en) * 2019-08-02 2021-10-26 Dell Products L.P. System and method for detecting and removing electronic mail storms
KR102300193B1 (ko) * 2019-09-02 2021-09-08 주식회사 엘지유플러스 착오 송금 방지 방법 및 장치
KR102219277B1 (ko) * 2019-09-03 2021-02-23 구글 엘엘씨 인증된 컨텐츠 전달 제어를 위한 시스템 및 방법
US11886585B1 (en) 2019-09-27 2024-01-30 Musarubra Us Llc System and method for identifying and mitigating cyberattacks through malicious position-independent code execution
US11637862B1 (en) 2019-09-30 2023-04-25 Mandiant, Inc. System and method for surfacing cyber-security threats with a self-learning recommendation engine
RU2728497C1 (ru) 2019-12-05 2020-07-29 Общество с ограниченной ответственностью "Группа АйБи ТДС" Способ и система определения принадлежности программного обеспечения по его машинному коду
RU2728498C1 (ru) 2019-12-05 2020-07-29 Общество с ограниченной ответственностью "Группа АйБи ТДС" Способ и система определения принадлежности программного обеспечения по его исходному коду
RU2743974C1 (ru) 2019-12-19 2021-03-01 Общество с ограниченной ответственностью "Группа АйБи ТДС" Система и способ сканирования защищенности элементов сетевой архитектуры
US11436327B1 (en) 2019-12-24 2022-09-06 Fireeye Security Holdings Us Llc System and method for circumventing evasive code for cyberthreat detection
US11522884B1 (en) 2019-12-24 2022-12-06 Fireeye Security Holdings Us Llc Subscription and key management system
US11838300B1 (en) 2019-12-24 2023-12-05 Musarubra Us Llc Run-time configurable cybersecurity system
US11582190B2 (en) * 2020-02-10 2023-02-14 Proofpoint, Inc. Electronic message processing systems and methods
SG10202001963TA (en) 2020-03-04 2021-10-28 Group Ib Global Private Ltd System and method for brand protection based on the search results
US11641375B2 (en) * 2020-04-29 2023-05-02 KnowBe4, Inc. Systems and methods for reporting based simulated phishing campaign
WO2021237739A1 (zh) * 2020-05-29 2021-12-02 西门子（中国）有限公司 工业控制系统安全性分析方法、装置和计算机可读介质
US11475090B2 (en) 2020-07-15 2022-10-18 Group-Ib Global Private Limited Method and system for identifying clusters of affiliated web resources
US11483314B2 (en) * 2020-08-04 2022-10-25 Mastercard Technologies Canada ULC Distributed evaluation list updating
RU2743619C1 (ru) 2020-08-06 2021-02-20 Общество с ограниченной ответственностью "Группа АйБи ТДС" Способ и система генерации списка индикаторов компрометации
US11050698B1 (en) * 2020-09-18 2021-06-29 Area 1 Security, Inc. Message processing system with business email compromise detection
US20220116406A1 (en) * 2020-10-12 2022-04-14 Microsoft Technology Licensing, Llc Malware detection and mitigation via a forward proxy server
US11588848B2 (en) 2021-01-05 2023-02-21 Bank Of America Corporation System and method for suspending a computing device suspected of being infected by a malicious code using a kill switch button
US11748680B2 (en) * 2021-02-22 2023-09-05 Intone Networks India Pvt. Ltd System for internal audit and internal control management and related methods
US11947572B2 (en) 2021-03-29 2024-04-02 Group IB TDS, Ltd Method and system for clustering executable files
US11882112B2 (en) 2021-05-26 2024-01-23 Bank Of America Corporation Information security system and method for phishing threat prevention using tokens
US11792155B2 (en) * 2021-06-14 2023-10-17 Vmware, Inc. Method and apparatus for enhanced client persistence in multi-site GSLB deployments
US20230004638A1 (en) * 2021-06-30 2023-01-05 Citrix Systems, Inc. Redirection of attachments based on risk and context
US20230041397A1 (en) * 2021-08-06 2023-02-09 Vmware, Inc. System and method for checking reputations of executable files using file origin analysis
US11934402B2 (en) * 2021-08-06 2024-03-19 Bank Of America Corporation System and method for generating optimized data queries to improve hardware efficiency and utilization
US11941121B2 (en) * 2021-12-28 2024-03-26 Uab 360 It Systems and methods for detecting malware using static and dynamic malware models
CN115348234B (zh) * 2022-08-10 2023-11-03 山石网科通信技术股份有限公司 服务器检测方法、装置及电子设备
WO2024044037A1 (en) * 2022-08-26 2024-02-29 Stairwell, Inc. Evaluating files using a rule- or feature-based system for detection of malicious and/or suspicious patterns
CN115632878B (zh) * 2022-12-06 2023-03-31 中海油能源发展股份有限公司采油服务分公司 基于网络隔离的数据传输方法、装置、设备及存储介质

Family Cites Families (138)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4956769A (en) * 1988-05-16 1990-09-11 Sysmith, Inc. Occurence and value based security system for computer databases
US5715466A (en) 1995-02-14 1998-02-03 Compuserve Incorporated System for parallel foreign language communication over a computer network
US5623600A (en) * 1995-09-26 1997-04-22 Trend Micro, Incorporated Virus detection and removal apparatus for computer networks
US5926462A (en) 1995-11-16 1999-07-20 Loran Network Systems, Llc Method of determining topology of a network of objects which compares the similarity of the traffic sequences/volumes of a pair of devices
US6453327B1 (en) 1996-06-10 2002-09-17 Sun Microsystems, Inc. Method and apparatus for identifying and discarding junk electronic mail
US6072942A (en) * 1996-09-18 2000-06-06 Secure Computing Corporation System and method of electronic mail filtering using interconnected nodes
US6119236A (en) * 1996-10-07 2000-09-12 Shipley; Peter M. Intelligent network security device and method
US5970149A (en) * 1996-11-19 1999-10-19 Johnson; R. Brent Combined remote access and security system
US6334193B1 (en) * 1997-05-29 2001-12-25 Oracle Corporation Method and apparatus for implementing user-definable error handling processes
US7778877B2 (en) 2001-07-09 2010-08-17 Linkshare Corporation Enhanced network based promotional tracking system
US7117358B2 (en) 1997-07-24 2006-10-03 Tumbleweed Communications Corp. Method and system for filtering communication
US6073165A (en) * 1997-07-29 2000-06-06 Jfax Communications, Inc. Filtering computer network messages directed to a user's e-mail box based on user defined filters, and forwarding a filtered message to the user's receiver
US6006329A (en) 1997-08-11 1999-12-21 Symantec Corporation Detection of computer viruses spanning multiple data streams
US6393465B2 (en) 1997-11-25 2002-05-21 Nixmail Corporation Junk electronic mail detector and eliminator
US6052709A (en) 1997-12-23 2000-04-18 Bright Light Technologies, Inc. Apparatus and method for controlling delivery of unsolicited electronic mail
US6161185A (en) * 1998-03-06 2000-12-12 Mci Communications Corporation Personal authentication system and method for multiple computer platform
JP3225924B2 (ja) 1998-07-09 2001-11-05 日本電気株式会社 通信品質制御装置
US6067619A (en) * 1998-09-24 2000-05-23 Hewlett-Packard Company Apparatus and method for configuring a computer networking device
US6546416B1 (en) * 1998-12-09 2003-04-08 Infoseek Corporation Method and system for selectively blocking delivery of bulk electronic mail
US6615242B1 (en) * 1998-12-28 2003-09-02 At&T Corp. Automatic uniform resource locator-based message filter
US6654787B1 (en) 1998-12-31 2003-11-25 Brightmail, Incorporated Method and apparatus for filtering e-mail
US6507866B1 (en) * 1999-07-19 2003-01-14 At&T Wireless Services, Inc. E-mail usage pattern detection
US7184971B1 (en) 1999-11-20 2007-02-27 Advertising.Com Method and apparatus for an E-mail affiliate program
US6728690B1 (en) * 1999-11-23 2004-04-27 Microsoft Corporation Classification system trainer employing maximum margin back-propagation with probabilistic outputs
AU782333B2 (en) * 1999-11-23 2005-07-21 Escom Corporation Electronic message filter having a whitelist database and a quarantining mechanism
US6701440B1 (en) 2000-01-06 2004-03-02 Networks Associates Technology, Inc. Method and system for protecting a computer using a remote e-mail scanning device
US7822977B2 (en) 2000-02-08 2010-10-26 Katsikas Peter L System for eliminating unauthorized electronic mail
JP2001222480A (ja) * 2000-02-14 2001-08-17 Fujitsu Ltd 電子メール運用管理システム
US20040006747A1 (en) 2000-03-13 2004-01-08 Tyler Joseph C. Electronic publishing system and method
US6931437B2 (en) * 2000-04-27 2005-08-16 Nippon Telegraph And Telephone Corporation Concentrated system for controlling network interconnections
US7428576B2 (en) * 2000-05-16 2008-09-23 Hoshiko Llc Addressee-defined mail addressing system and method
US6732153B1 (en) 2000-05-23 2004-05-04 Verizon Laboratories Inc. Unified message parser apparatus and system for real-time event correlation
US8972717B2 (en) 2000-06-15 2015-03-03 Zixcorp Systems, Inc. Automatic delivery selection for electronic content
US7328349B2 (en) 2001-12-14 2008-02-05 Bbn Technologies Corp. Hash-based systems and methods for detecting, preventing, and tracing network worms and viruses
GB2357939B (en) * 2000-07-05 2002-05-15 Gfi Fax & Voice Ltd Electronic mail message anti-virus system and method
US20020059418A1 (en) * 2000-07-17 2002-05-16 Alan Bird Method of and system for recording and displaying electronic mail statistics
TW569106B (en) * 2000-07-29 2004-01-01 Hai Lin A method preventing spam
US7149778B1 (en) 2000-08-24 2006-12-12 Yahoo! Inc. Unsolicited electronic mail reduction
GB2366706B (en) 2000-08-31 2004-11-03 Content Technologies Ltd Monitoring electronic mail messages digests
US6886099B1 (en) 2000-09-12 2005-04-26 Networks Associates Technology, Inc. Computer virus detection
US6785712B1 (en) * 2000-09-21 2004-08-31 Rockwell Collins, Inc. Airborne e-mail data transfer protocol
US6757830B1 (en) * 2000-10-03 2004-06-29 Networks Associates Technology, Inc. Detecting unwanted properties in received email messages
JP2002123469A (ja) * 2000-10-13 2002-04-26 Nec System Technologies Ltd 電子メール送受信装置、電子メールシステム、電子メール処理方法、記録媒体
US6748422B2 (en) * 2000-10-19 2004-06-08 Ebay Inc. System and method to control sending of unsolicited communications relating to a plurality of listings in a network-based commerce facility
GB2371711B (en) * 2000-11-27 2004-07-07 Nokia Mobile Phones Ltd A Server
CA2437726A1 (en) 2001-02-15 2002-08-22 Suffix Mail Inc. E-mail messaging system
US8219620B2 (en) * 2001-02-20 2012-07-10 Mcafee, Inc. Unwanted e-mail filtering system including voting feedback
US6941466B2 (en) * 2001-02-22 2005-09-06 International Business Machines Corporation Method and apparatus for providing automatic e-mail filtering based on message semantics, sender's e-mail ID, and user's identity
US20020120600A1 (en) * 2001-02-26 2002-08-29 Schiavone Vincent J. System and method for rule-based processing of electronic mail messages
GB2373130B (en) 2001-03-05 2004-09-22 Messagelabs Ltd Method of,and system for,processing email in particular to detect unsolicited bulk email
US7249195B2 (en) 2001-03-30 2007-07-24 Minor Ventures, Llc Apparatus and methods for correlating messages sent between services
US7340505B2 (en) * 2001-04-02 2008-03-04 Akamai Technologies, Inc. Content storage and replication in a managed internet content storage environment
US20020184533A1 (en) 2001-05-30 2002-12-05 Fox Paul D. System and method for providing network security policy enforcement
US7380126B2 (en) 2001-06-01 2008-05-27 Logan James D Methods and apparatus for controlling the transmission and receipt of email messages
US7076527B2 (en) * 2001-06-14 2006-07-11 Apple Computer, Inc. Method and apparatus for filtering email
US7673342B2 (en) 2001-07-26 2010-03-02 Mcafee, Inc. Detecting e-mail propagated malware
JP2003046576A (ja) * 2001-07-27 2003-02-14 Fujitsu Ltd メッセージ配送システム並びにメッセージ配送管理サーバ，メッセージ配送管理プログラムおよび同プログラムを記録したコンピュータ読取可能な記録媒体
US7657935B2 (en) * 2001-08-16 2010-02-02 The Trustees Of Columbia University In The City Of New York System and methods for detecting malicious email transmission
US7146402B2 (en) * 2001-08-31 2006-12-05 Sendmail, Inc. E-mail system providing filtering methodology on a per-domain basis
US7331061B1 (en) 2001-09-07 2008-02-12 Secureworks, Inc. Integrated computer security management system and method
WO2003044617A2 (en) 2001-10-03 2003-05-30 Reginald Adkins Authorized email control system
JP3717829B2 (ja) 2001-10-05 2005-11-16 日本デジタル株式会社 迷惑メール撃退システム
US7319858B2 (en) 2001-11-16 2008-01-15 Cingular Wireless Ii, Llc System and method for querying message information
US20030095555A1 (en) 2001-11-16 2003-05-22 Mcnamara Justin System for the validation and routing of messages
US20030096605A1 (en) 2001-11-16 2003-05-22 Schlieben Karl J. System for handling proprietary files
US6944616B2 (en) * 2001-11-28 2005-09-13 Pavilion Technologies, Inc. System and method for historical database training of support vector machines
US20030149726A1 (en) * 2002-02-05 2003-08-07 At&T Corp. Automating the reduction of unsolicited email in real time
ATE427608T1 (de) * 2002-02-19 2009-04-15 Postini Inc E-mail-verwaltungsdienste
EP1482696A4 (en) * 2002-02-22 2006-03-15 Access Co Ltd METHOD AND DEVICE FOR PROCESSING UNDESIRABLE ELECTRONIC MAIL FOR THE USER
US7400722B2 (en) * 2002-03-28 2008-07-15 Broadcom Corporation Methods and apparatus for performing hash operations in a cryptography accelerator
AUPS193202A0 (en) * 2002-04-23 2002-05-30 Pickup, Robert Barkley Mr A method and system for authorising electronic mail
US7249262B2 (en) * 2002-05-06 2007-07-24 Browserkey, Inc. Method for restricting access to a web site by remote users
AU2003243327A1 (en) * 2002-05-28 2003-12-12 Alan H. Teague Message processing based on address patterns and automated management and control of contact aliases
US20040003255A1 (en) 2002-06-28 2004-01-01 Storage Technology Corporation Secure email time stamping
US7539726B1 (en) * 2002-07-16 2009-05-26 Sonicwall, Inc. Message testing
US20040019651A1 (en) 2002-07-29 2004-01-29 Andaker Kristian L. M. Categorizing electronic messages based on collaborative feedback
US20040024632A1 (en) 2002-08-05 2004-02-05 Avenue A, Inc. Method of determining the effect of internet advertisement on offline commercial activity
EP1535164B1 (en) * 2002-08-26 2012-01-04 International Business Machines Corporation Determining threat level associated with network activity
US7748039B2 (en) 2002-08-30 2010-06-29 Symantec Corporation Method and apparatus for detecting malicious code in an information handling system
US7072944B2 (en) 2002-10-07 2006-07-04 Ebay Inc. Method and apparatus for authenticating electronic mail
US20040083270A1 (en) 2002-10-23 2004-04-29 David Heckerman Method and system for identifying junk e-mail
US7159149B2 (en) * 2002-10-24 2007-01-02 Symantec Corporation Heuristic detection and termination of fast spreading network worm attacks
US7664963B2 (en) 2002-11-04 2010-02-16 Riverbed Technology, Inc. Data collectors in connection-based intrusion detection
US8990723B1 (en) * 2002-12-13 2015-03-24 Mcafee, Inc. System, method, and computer program product for managing a plurality of applications via a single interface
US7373664B2 (en) * 2002-12-16 2008-05-13 Symantec Corporation Proactive protection against e-mail worms and spam
US7171450B2 (en) * 2003-01-09 2007-01-30 Microsoft Corporation Framework to enable integration of anti-spam technologies
US7533148B2 (en) 2003-01-09 2009-05-12 Microsoft Corporation Framework to enable integration of anti-spam technologies
US8595495B2 (en) 2003-01-12 2013-11-26 Yaron Mayer System and method for secure communications
JP4344922B2 (ja) * 2003-01-27 2009-10-14 富士ゼロックス株式会社 評価装置およびその方法
JP2004254034A (ja) * 2003-02-19 2004-09-09 Fujitsu Ltd スパムメール抑制ポリシー制御システム及び方法
US7249162B2 (en) 2003-02-25 2007-07-24 Microsoft Corporation Adaptive junk message filtering system
US7219148B2 (en) * 2003-03-03 2007-05-15 Microsoft Corporation Feedback loop for spam prevention
US20040177120A1 (en) * 2003-03-07 2004-09-09 Kirsch Steven T. Method for filtering e-mail messages
US7366761B2 (en) 2003-10-09 2008-04-29 Abaca Technology Corporation Method for creating a whitelist for processing e-mails
US20050091320A1 (en) 2003-10-09 2005-04-28 Kirsch Steven T. Method and system for categorizing and processing e-mails
US7206814B2 (en) * 2003-10-09 2007-04-17 Propel Software Corporation Method and system for categorizing and processing e-mails
US20050091319A1 (en) * 2003-10-09 2005-04-28 Kirsch Steven T. Database for receiving, storing and compiling information about email messages
US20040181581A1 (en) 2003-03-11 2004-09-16 Michael Thomas Kosco Authentication method for preventing delivery of junk electronic mail
US20060168006A1 (en) * 2003-03-24 2006-07-27 Mr. Marvin Shannon System and method for the classification of electronic communication
US7342906B1 (en) * 2003-04-04 2008-03-11 Airespace, Inc. Distributed wireless network security system
US7346700B2 (en) * 2003-04-07 2008-03-18 Time Warner Cable, A Division Of Time Warner Entertainment Company, L.P. System and method for managing e-mail message traffic
US7320020B2 (en) 2003-04-17 2008-01-15 The Go Daddy Group, Inc. Mail server probability spam filter
US7366919B1 (en) 2003-04-25 2008-04-29 Symantec Corporation Use of geo-location data for spam detection
US7653698B2 (en) * 2003-05-29 2010-01-26 Sonicwall, Inc. Identifying e-mail messages from allowed senders
US7272853B2 (en) 2003-06-04 2007-09-18 Microsoft Corporation Origination/destination features and lists for spam prevention
JP4013835B2 (ja) * 2003-06-11 2007-11-28 日本電気株式会社 電子メール中継装置及びそれに用いる電子メール中継方法
US20040254990A1 (en) 2003-06-13 2004-12-16 Nokia, Inc. System and method for knock notification to an unsolicited message
US8533270B2 (en) * 2003-06-23 2013-09-10 Microsoft Corporation Advanced spam detection techniques
US7051077B2 (en) * 2003-06-30 2006-05-23 Mx Logic, Inc. Fuzzy logic voting method and system for classifying e-mail using inputs from multiple spam classifiers
DE602004022817D1 (de) * 2003-07-11 2009-10-08 Computer Ass Think Inc Verfahren und system zum schutz vor computerviren
JP2005056048A (ja) * 2003-08-01 2005-03-03 Fact-Real:Kk 電子メール監視システム、電子メール監視プログラム及び電子メール監視方法
GB2405229B (en) * 2003-08-19 2006-01-11 Sophos Plc Method and apparatus for filtering electronic mail
US20050060643A1 (en) 2003-08-25 2005-03-17 Miavia, Inc. Document similarity detection and classification system
US20050060295A1 (en) 2003-09-12 2005-03-17 Sensory Networks, Inc. Statistical classification of high-speed network data through content inspection
US20050071432A1 (en) 2003-09-29 2005-03-31 Royston Clifton W. Probabilistic email intrusion identification methods and systems
US7257564B2 (en) * 2003-10-03 2007-08-14 Tumbleweed Communications Corp. Dynamic message filtering
US20050080858A1 (en) 2003-10-10 2005-04-14 Microsoft Corporation System and method for searching a peer-to-peer network
US7181498B2 (en) * 2003-10-31 2007-02-20 Yahoo! Inc. Community-based green list for antispam
JP2005208780A (ja) * 2004-01-21 2005-08-04 Nec Corp メールフィルタリングシステム及びそれに用いるｕｒｌブラックリスト動的構築方法
US7631044B2 (en) * 2004-03-09 2009-12-08 Gozoom.Com, Inc. Suppression of undesirable network messages
US7554974B2 (en) 2004-03-09 2009-06-30 Tekelec Systems and methods of performing stateful signaling transactions in a distributed processing environment
US8918466B2 (en) * 2004-03-09 2014-12-23 Tonny Yu System for email processing and analysis
US20050204005A1 (en) * 2004-03-12 2005-09-15 Purcell Sean E. Selective treatment of messages based on junk rating
ATE399427T1 (de) 2004-03-30 2008-07-15 Imencro Software Sa Ein filter und ein verfahren zur filterung elektronischer nachrichten
JP4128975B2 (ja) * 2004-04-02 2008-07-30 株式会社古河テクノマテリアル 生体用超弾性チタン合金
US7627670B2 (en) 2004-04-29 2009-12-01 International Business Machines Corporation Method and apparatus for scoring unsolicited e-mail
US7457823B2 (en) * 2004-05-02 2008-11-25 Markmonitor Inc. Methods and systems for analyzing data related to possible online fraud
US7391725B2 (en) * 2004-05-18 2008-06-24 Christian Huitema System and method for defeating SYN attacks
US7748038B2 (en) * 2004-06-16 2010-06-29 Ironport Systems, Inc. Method and apparatus for managing computer virus outbreaks
US20060095410A1 (en) * 2004-10-29 2006-05-04 Ostrover Lewis S Personal video recorder for home network providing filtering and format conversion of content
US7634810B2 (en) * 2004-12-02 2009-12-15 Microsoft Corporation Phishing detection, prevention, and notification
US20060123083A1 (en) * 2004-12-03 2006-06-08 Xerox Corporation Adaptive spam message detector
US7610344B2 (en) * 2004-12-13 2009-10-27 Microsoft Corporation Sender reputations for spam prevention
US20060167971A1 (en) * 2004-12-30 2006-07-27 Sheldon Breiner System and method for collecting and disseminating human-observable data
US20060149820A1 (en) * 2005-01-04 2006-07-06 International Business Machines Corporation Detecting spam e-mail using similarity calculations
US7716743B2 (en) 2005-01-14 2010-05-11 Microsoft Corporation Privacy friendly malware quarantines
US20070028301A1 (en) * 2005-07-01 2007-02-01 Markmonitor Inc. Enhanced fraud monitoring systems
US7475118B2 (en) * 2006-02-03 2009-01-06 International Business Machines Corporation Method for recognizing spam email

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102713853A (zh) * 2009-10-26 2012-10-03 赛门铁克公司 使用文件流行程度通知行为试探的攻击性
CN102713853B (zh) * 2009-10-26 2015-09-09 赛门铁克公司 使用文件流行程度通知行为试探的攻击性
CN104137501B (zh) * 2012-01-26 2017-10-20 惠普发展公司，有限责任合伙企业 用于识别推送通信模式的系统和方法
US11082510B2 (en) 2012-01-26 2021-08-03 Micro Focus Llc Identifying a push communication pattern
CN103823761A (zh) * 2014-03-09 2014-05-28 林虎 一种提升终端黑名单容量和检索速度的方法
CN103823761B (zh) * 2014-03-09 2017-01-25 林虎 一种提升终端黑名单容量和检索速度的方法
CN105743876A (zh) * 2015-08-28 2016-07-06 哈尔滨安天科技股份有限公司 一种基于邮件源数据发现针对性攻击的方法及系统
US10686817B2 (en) 2015-09-21 2020-06-16 Hewlett Packard Enterprise Development Lp Identification of a DNS packet as malicious based on a value
CN108431792A (zh) * 2015-12-21 2018-08-21 电子湾有限公司 检测与被伪造的元数据不匹配的隐藏的链接

Also Published As

Publication number Publication date
US7877493B2 (en) 2011-01-25
JP2008545177A (ja) 2008-12-11
WO2006122055A3 (en) 2009-04-30
EP1877905B1 (en) 2014-10-22
US20070220607A1 (en) 2007-09-20
CA2607005C (en) 2012-02-07
EP1877904A4 (en) 2013-09-11
WO2006119508A2 (en) 2006-11-09
US20070079379A1 (en) 2007-04-05
US7836133B2 (en) 2010-11-16
EP1877904A2 (en) 2008-01-16
WO2006119509A3 (en) 2009-04-16
US20070078936A1 (en) 2007-04-05
EP1877904B1 (en) 2015-12-30
JP5118020B2 (ja) 2013-01-16
US7712136B2 (en) 2010-05-04
EP1877905A2 (en) 2008-01-16
WO2006122055A2 (en) 2006-11-16
WO2006119508A3 (en) 2009-04-16
CA2606998C (en) 2014-09-09
WO2006119509A2 (en) 2006-11-09
WO2006119506A2 (en) 2006-11-09
US20070073660A1 (en) 2007-03-29
EP1877905A4 (en) 2013-10-09
WO2006119506A3 (en) 2009-04-16
US7854007B2 (en) 2010-12-14
JP4880675B2 (ja) 2012-02-22
CN101495969B (zh) 2012-10-10
CN101558398B (zh) 2012-11-28
JP2008547067A (ja) 2008-12-25
US20070070921A1 (en) 2007-03-29
US7548544B2 (en) 2009-06-16
CA2607005A1 (en) 2006-11-09
CA2606998A1 (en) 2006-11-09
US20070083929A1 (en) 2007-04-12
CN101495969A (zh) 2009-07-29

Similar Documents

Publication Publication Date Title
CN101558398B (zh) 基于被引用资源的概率分析检测不想要的电子邮件消息
US10628797B2 (en) Online fraud solution
US9356947B2 (en) Methods and systems for analyzing data related to possible online fraud
US7913302B2 (en) Advanced responses to online fraud
US7870608B2 (en) Early detection and monitoring of online fraud
US7921063B1 (en) Evaluating electronic mail messages based on probabilistic analysis
US8041769B2 (en) Generating phish messages
US7992204B2 (en) Enhanced responses to online fraud
US9413716B2 (en) Securing email communications
US20070299915A1 (en) Customer-based detection of online fraud
US20070107053A1 (en) Enhanced responses to online fraud
CN1573784B (zh) 用于阻止垃圾邮件的源/目的地的特征和列表
US20060224677A1 (en) Method and apparatus for detecting email fraud
JP2008507005A (ja) オンライン詐欺解決法
Dhinakaran et al. Multilayer approach to defend phishing attacks
Pitsillidis Spam Value Chain: Defensive Intervention Analysis

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant