Malicious Message Detection and Processing

Patent metadata

Field	Value
Publication number	US-2017230411-A1
Application number	US-201715495604-A
Country	US
Kind code	A1
Filing date	Apr 24, 2017
Priority date	Jun 7, 2012
Publication date	Aug 10, 2017
Grant date	—

Abstract

Systems and methods for malicious message detection and processing are provided herein. According to various embodiments, a method includes detecting, via an intermediary node, a link included in a message, the link being associated with an unknown resource, hashing a unique identifier for a recipient of the message, coupling the hashed identifier with the link, creating an updated link, and forwarding an updated message, including the updated link, to the recipient.

First claim

What is claimed is:

1 . A method for processing messages using an intermediary node having a processor and a memory for storing executable instructions, the processor executing the instructions to perform the method, comprising:
detecting, via the intermediary node, a link included in a message, the link being associated with an unknown resource; hashing a unique identifier for a recipient of the message; coupling the hashed identifier with the link creating an updated link and updated message; and forwarding the updated message to the recipient.

2 . The method according to claim 1 , further comprising placing the unknown resource in a sandbox for testing; and blocking access to the unknown resource if the unknown resource is determined to be malicious.

3 . The method according to claim 2 , wherein if the unknown resource is determined to be malicious, subsequent messages that include the link will, before the subsequent messages are forwarded to the recipient, be modified with an alternate link to a trusted resource.

4 . The method according to claim 1 , wherein the unique identifier is an email address of the recipient that is determined from the message.

5 . The method according to claim 4 , wherein the hashed identifier is appended to the end of the link to create the updated link; wherein clicking on the updated link causes a request for the unknown resource to be received by the intermediary node.

6 . The method according to claim 5 , further comprising mapping the hashed identifier to the unique identifier of the recipient; and storing the mapping in a database.

7 . The method according to claim 6 , further comprising detecting if the recipient has clicked on the updated link by:
receiving a request for the unknown resource, the request comprising the updated link; comparing the hashed identifier of the updated link to the database; and returning the unique identifier of the recipient, the unique identifier identifying the recipient.

8 . The method according to claim 7 , further comprising quarantining the message if the link is associated with a malicious or potentially malicious resource or content of the email is malicious or potentially malicious.

9 . A method for processing messages using an intermediary node having a processor and a memory for storing executable instructions, the processor executing the instructions to perform the method, comprising:
receiving a message that includes a link to an unknown resource; placing the unknown resource in a sandbox for a testing period of time so as to determine if the unknown resource is malicious; for each message of a plurality of subsequent messages for a plurality of different recipients, the plurality of subsequent messages comprising the link, the plurality of subsequent messages being received during the testing period of time: hashing a unique identifier for a recipient of each message; coupling the hashed identifier with the link to create an updated link; and transmitting to the recipient the message with the updated link.

10 . The method according to claim 9 , further comprising blocking access to the unknown resource for the plurality of different recipients if the unknown resource is determined to be malicious during the testing period of time.

11 . The method according to claim 10 , further comprising tracking which of the plurality of different recipients clicked the updated link.

12 . The method according to claim 11 , further comprising, for the plurality of different recipients, mapping a hashed identifier to the unique identifier of the recipient.

13 . The method according to claim 12 , further comprising:
receiving a plurality of requests for the unknown resource during the testing period of time, each of the plurality of requests comprising a hashed identifier included in an updated link; for each of the plurality of requests, querying a database for a mapping of each hashed identifier so as to determine a unique identifier for each hashed identifier; and identifying the recipient associated with each of the plurality of requests using the unique identifiers.

14 . The method according to claim 10 , wherein the link comprises a URL for the unknown resource and the updated link comprises a URL referring to the intermediary node, the URL for the unknown resource, and the hashed identifier.

15 . A method, comprising:
detecting a link included in messages sent to a plurality of recipients, the link being associated with an unknown resource; for the plurality of recipients: coupling a hashed value with the link, the hashed value being a hashing of a unique identifier for a recipient of the message in combination with a validation hash, the validation hash being for detection of manipulation of the hashed value creating an updated link and updated message; and forwarding the updated message to the recipient.

16 . The method according to claim 15 , further comprising placing the unknown resource in a sandbox for testing; and blocking access to the unknown resource if the unknown resource is determined to be malicious.

17 . The method according to claim 16 , further comprising tracking a number of recipients that clicks on the updated link.

18 . The method according to claim 17 , further comprising ascertaining patterns of malicious activity by evaluating clicks for updated links from a plurality of recipients.

19 . The method according to claim 18 , further comprising grouping recipients that clicked on an updated link based upon a common characteristic between the recipients.

20 . The method according to claim 19 , wherein the common characteristic comprises a company, a group, a geographical region, a business type, and combinations thereof.

Assignees

• Proofpoint Inc

Inventors

• Starink Angelo
• Knight David

Classifications

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06F16/951

  Indexing; Web crawling techniques · CPC title

• G06F16/9566

  URL specific, e.g. using aliases, detecting broken or misspelled links · CPC title

• G06F2221/2115

  Third party · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title