Classifying a message based on fraud indicators
View Patent ↗Systems, methods, and media for classifying messages are disclosed. A plurality of fraud indicators are identified in the message. A signature of the message is generated. The generated signature of the message is compared to a stored signature. The stored signature is based on a statistical analysis of fraud indicators in a second message associated with the stored signature. A determination as to whether the message is fraudulent is made based on the comparison. The message is processed based on the determination that the message is a fraudulent message.
1. A method for classifying a message, comprising:
maintaining a database for storing a plurality of signatures, the database maintained in memory;
executing instructions stored in a computer-readable storage medium, wherein execution of the instructions by a processor:
identifies a plurality of fraud indicators in the message;
generates a signature for the message;
compares the generated signature to a signature stored in the database, the stored signature based on a statistical analysis of fraud indicators in a second message associated with the stored signature;
determines that the message is fraudulent based on the comparison; and
processes the message based on the determination that the message is a fraudulent message.
2. The method of claim 1 , wherein determining whether the message is fraudulent includes identifying a match between the stored signature and the generated signature.
3. The method of claim 1 , wherein identifying a plurality of fraud indicators includes identifying divergent reference points in the message.
4. The method of claim 1 , wherein identifying a plurality of fraud indicators in the message includes searching a second database storing information concerning legitimate reference points.
5. The method of claim 3 , wherein execution of the instructions by a processor further extracts the fraud indicators from the message, and stores the fraud indicators in association with the message classification.
6. The method of claim 3 , wherein executing instructions by a processor further extracts the fraud indicators from the message, and stores the fraud indicators in association with the stored signature.
7. The method of claim 1 , wherein identifying a plurality of fraud indicators includes identifying at least one reference point for contacting an illegitimate source.
8. The method of claim 1 , wherein identifying the plurality of fraud indicators includes identifying a raw Internet Protocol (IP) address.
9. The method of claim 1 , wherein identifying the plurality of fraud indicators includes identifying a link with an embedded user name.
10. The method of claim 1 , wherein identifying the plurality of fraud indicators includes identifying a form in the message.
11. The method of claim 10 , wherein the form includes a request for personal information from the user.
12. The method of claim 1 , wherein identifying the plurality of fraud indicators includes identifying non-standard encoding in the message.
13. The method of claim 1 , wherein identifying the plurality of fraud indicators includes identifying a link including a reference to an entity but not linking to the entity.
14. The method of claim 1 , wherein identifying the plurality of fraud indicators includes identifying a mismatched link name, the mismatched link name displaying a uniform resource locator (URL) but linking to a different URL.
15. The method of claim 1 , wherein identifying the plurality of fraud indicators includes identifying content known to be associated with fraudulent messages.
16. The method of claim 1 , wherein the database is shared among a plurality of users in a network.
17. The method of claim 1 , wherein generating the signature of the message includes applying a hash function to the content of the message.
18. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for classifying a message, the method comprising:
identifying a plurality of fraud indicators in the message;
generating a signature of the message;
comparing the generated signature to a signature stored in the database, the stored signature based on a statistical analysis of fraud indicators in a second message associated with the stored signature;
determining that the message is fraudulent based on the comparison; and
processing the message based on the determination that the message is a fraudulent message.
19. The non-transitory computer-readable storage medium of claim 18 , the method further comprising providing an alert to a recipient of the message indicating that the message is a fraudulent message appearing to be from a legitimate source.
20. The non-transitory computer-readable storage medium of claim 18 , the method further comprising providing an explanation of the fraudulent message appearing to be from a legitimate source to a recipient.