Compact input compensating reputation data tracking mechanism

1. A computer implemented method for determining whether to block incoming electronic content based on running rates of content origination from sources, the method comprising the steps of:

receiving, by a destination computer, information concerning origination of incoming electronic content received from at least one external source over time;

aggregating, by the destination computer, the received information concerning origination of electronic content from the at least one source, wherein the received information comprises notifications from multiple sources;

calculating, by the destination computer, at least one running rate of content origination from the at least one source, based on aggregated information concerning origination of electronic content from the at least one source, wherein the running rate is indicative of a reputation of the at least one source, and wherein the running rate comprises a single number updated using at least an amount of time since the last update to control an influence of new information on the running rate;

receiving, by the destination computer, incoming electronic content from a specific source; and

determining, by the destination computer, whether to block the incoming electronic content from the specific source responsive to at least one running rate of content origination from the specific source.

2. The method of claim 1 wherein receiving, by the destination computer, information concerning origination of electronic content from at least one source over time further comprises:

receiving, by a computer, at least one notification that malicious content was received from a given source at a given time.

3. The method of claim 1 wherein receiving, by the destination computer, information concerning origination of electronic content from at least one source over time further comprises:

receiving, by a computer, at least one notification that non-malicious content was received from a given source at a given time.

4. The method of claim 1 wherein receiving, by the destination computer, information concerning origination of electronic content from at least one source over time further comprises:

receiving, by a computer, at least one notification that a complaint was received at a given time concerning content from a given source.

5. The method of claim 1 wherein receiving, by the destination computer, information concerning origination of electronic content from at least one source over time further comprises:

receiving, by a computer, at least one notification that content from a given source was blocked at a given time.

6. The method of claim 1 wherein receiving, by the destination computer, information concerning origination of electronic content from at least one source over time further comprises:

receiving, by a computer, notifications concerning receipt of content from given sources, the received notifications originating from a plurality of computer systems.

7. The method of claim 1 wherein calculating, by a computer, at least one running rate of content origination from the at least one source, based on aggregated information concerning origination of electronic content from the at least one source further comprises:

calculating, by a computer, at least one initial running rate of content origination from a given source, based on a number of detections of originations of content from the given source and a period of time over which the detections where made.

8. The method of claim 1 wherein calculating, by the destination computer, at least one running rate of content origination from the at least one source, based on aggregated information concerning origination of electronic content from the at least one source, further comprises:

updating, by a computer, a current running rate of content origination from a given source, based on the current running rate, a number of detections of originations of content from the given source since the running rate was last updated, and an amount of time since the running rate was last updated.

9. The method of claim 8 wherein updating, by the destination computer, a current running rate of content origination from a given source further comprises:

weighing, by a computer, previous detections of originations of content and current detections of originations of content differently.

10. The method of claim 1 wherein updating, by the destination computer, a current running rate of content origination from a given source further comprises:

updating, by a computer, the current running rate responsive to receiving, by a computer, incoming electronic content from a specific source.

11. The method of claim 1 wherein calculating, by the destination computer, at least one running rate of content origination from the at least one source, based on aggregated information concerning origination of electronic content from the at least one source, further comprises calculating, by a computer, at least one running rate of content origination from a group consisting of:

a running rate of malicious content origination;

a running rate of virus origination; and

a running rate of spam origination.

12. The method of claim 1 wherein determining, by the destination computer, whether to block the incoming electronic content from the specific source responsive to at least one running rate of content origination from the specific source further comprises:

calculating, by a computer, at least one reputation characterization percentage based on at least one running rate of content origination from the specific source; and

determining, by a computer, whether to block the incoming electronic content from the specific source responsive to the at least one reputation characterization percentage.

13. The method of claim 1 wherein determining, by the destination computer, whether to block the incoming electronic content from the specific source responsive to at least one running rate of content origination from the specific source further comprises:

responsive to results of the determining step, blocking, by a computer, the incoming electronic content from the specific source.

14. The method of claim 1 wherein determining, by the destination computer, whether to block the incoming electronic content from the specific source responsive to at least one running rate of content origination from the specific source further comprises: responsive to results of the determining step, not blocking, by a computer, the incoming electronic content from the specific source.

15. The method of claim 1 wherein receiving, by a destination computer, information concerning origination of incoming electronic content received from at least one external source over time comprises electronic content received from at least one of:

an individual e-mail sender;

an e-mail server;

a domain;

a sub-domain; and

an IP address.

16. At least one non-transitory computer readable storage medium storing a computer program product for determining whether to block incoming electronic content based on running rates of content origination from sources, the computer program product comprising:

program code for receiving, by a destination computer, information concerning origination of incoming electronic content received from at least one external source over time;

program code for aggregating the received information concerning origination of electronic content from the at least one source, wherein the received information comprises notifications from multiple sources;

program code for calculating at least one running rate of content origination from the at least one source, based on aggregated information concerning origination of electronic content from the at least one source, wherein the running rate is indicative of a reputation of the at least one source, and wherein the running rate comprises a single number updated using at least an amount of time since the last update to control an influence of new information on the running rate;

program code for receiving incoming electronic content from a specific source; and

program code for determining whether to block the incoming electronic content from the specific source responsive to at least one running rate of content origination from the specific source.

17. The computer program product of claim 16 wherein the program code for receiving, by the destination computer, information concerning origination of electronic content from at least one source over time further comprises program code for performing at least one step from a group of steps consisting of:

receiving at least one notification that malicious content was received from a given source at a given time;

receiving at least one notification that non-malicious content was received from a given source at a given time;

receiving at least one notification that a complaint was received at a given time concerning content from a given source;

receiving at least one notification that content from a given source was blocked at a given time; and

receiving notifications concerning receipt of content from given sources, the received notifications originating from a plurality of computer systems.

18. The computer program product of claim 16 wherein the program code for calculating at least one running rate of content origination from the at least one source, based on aggregated information concerning origination of electronic content from the at least one source further comprises:

program code for calculating at least one initial running rate of content origination from a given source, based on a number of detections of originations of content from the given source and a period of time over which the detections where made; and

program code for updating a current running rate of content origination from a given source, based on the current running rate, a number of detections of originations of content from the given source since the running rate was last updated, and an amount of time since the running rate was last updated.

19. The computer program product of claim 16 wherein the program code for calculating at least one running rate of content origination from the at least one source, based on aggregated information concerning origination of electronic content from the at least one source, further comprises program code for calculating at least one running rate of content origination from a group consisting of:

a running rate of malicious content origination;

a running rate of virus origination; and

a running rate of spam origination.

20. The computer program product of claim 16 wherein the program code for determining whether to block the incoming electronic content from the specific source responsive to at least one running rate of content origination from the specific source further comprises:

program code for calculating at least one reputation characterization percentage based on at least one running rate of content origination from the specific source; and

program code for determining whether to block the incoming electronic content from the specific source responsive to the at least one reputation characterization percentage.

21. A destination computer system configured to determine whether to block incoming electronic content based on running rates of content origination from sources, the computer system comprising:

a processor;

system memory;

an aggregating module to receive information concerning origination of electronic content received from at least one external source over time and aggregating the received information concerning origination of electronic content from the at least one source, wherein the received information comprises

notifications from multiple sources; and

a blocking module to calculate at least one running rate of content origination from the at least one source, based on aggregated information concerning origination of electronic content from the at least one source, wherein the running rate is indicative of a reputation of the at least one source, and wherein the running rate comprises a single number updated using at least an amount of time since the last update to control an influence of new information on the running rate,

wherein the aggregating module receives incoming electronic content from a specific source,

wherein the blocking module determines whether to block the incoming electronic content from the specific source responsive to at least one running rate of content origination from the specific source.