Reputation management for network content classification
A system derives a reputation for a plurality of network addresses, the reputation of each network address determined by analyzing a plurality of high-level email features related to one or more emails originating from the network address. The plurality of high-level email features include domain registration analysis, hashed term frequency indexing, persistent communication, address age, correlation analysis, zombie detection, and hash vault matching.
1. A computer network device, comprising:
one or more processing units; and
a reputation server module executing on the one or more processing units, the reputation server module operable to derive a reputation for a plurality of network identifiers, the reputation of each network identifier determined by analyzing which nameservers contain information to resolve a particular domain name, changes in which nameservers contain information to resolve the particular domain name over a time duration, and one or more of a plurality of high-level transaction features related to one or more transactions originating from the each network identifier, wherein the nameservers are used to resolve domain names to internet protocol (IP) addresses corresponding to a server for the domain name.
2. The computer network device of claim 1 , wherein the each network identifier comprises at least one of a domain name, an IP (Internet Protocol) address, and a URL (Uniform Resource Locator).
3. The computer network device of claim 1 , wherein the plurality of high-level transaction features comprise one or more of hashed term frequency indexing, persistent communication, address age, correlation analysis, zombie detection, and hash vault matching.
4. The computer network device of claim 1 , where the transaction features comprise hashes of content from one or more senders associated with network identifiers, the hashes stored associated with the reputation of the associated network identifier.
5. The computer network device of claim 1 , where the transaction features comprise source and destination pairs that are analyzed for persistent communication patterns.
6. The computer network device of claim 1 , where the transaction features comprise sparse data retrieved by hash-based indexing of content information.
7. The computer network device of claim 1 , where the transaction features comprise domain names that are analyzed using statistical language models and properties derived from the nameservers containing resolution information for these domains.
8. The computer network device of claim 1 , where transaction features are tracked in real-time for unknown or suspicious network identifiers that are then subjected to further analysis to determine whether to allow or deny a transaction.
9. The computer network device of claim 1 , the transaction comprising email and the computer network device further operable to receive email information from a plurality of network devices, and to derive network identifier reputation data from the received email information.
10. The computer network device of claim 1 , the computer network device further operable to receive email information from a client device and to return reputation data regarding an email sender's network identifier to the client.
11. The computer network device of claim 1 , wherein the network device is further operable to send reputation information regarding the each network identifier to at least one of an end user and a gateway device, such that the end user or gateway device can use the reputation information to allow or disallow network traffic other than email between an end user and the each network identifier.
12. The computer network device of claim 1 , wherein the transaction comprises at least one of an email transaction, a credit card transaction, a consumer transaction, and a file transaction.
13. A non-transitory computer storage device comprising instructions stored thereon to cause one or more processing devices to:
determine a reputation for a plurality of network identifiers, the reputation of each network identifier determined by analyzing which nameservers contain information to resolve a particular domain name, changes in which nameservers contain information to resolve the particular domain name over a time duration, and one or more of a plurality of high-level features related to one or more transactions originating from the each network identifier, wherein the nameservers are used to resolve domain names to internet protocol (IP) addresses corresponding to a server for the domain name.
14. The non-transitory computer storage device of claim 13 , wherein the each network identifier comprises at least one of a domain name, an IP (Internet Protocol) address, and a URL (Uniform Resource Locator).
15. The non-transitory computer storage device of claim 13 , wherein the plurality of high-level features comprise one or more of domain registration analysis, hashed term frequency indexing, persistent communication, address age, correlation analysis, zombie detection, and hash vault matching.
16. The non-transitory computer storage device of claim 13 , wherein the features related to one or more transactions comprise hashes of content from one or more senders associated with network identifiers, the hashes stored associated with the reputation of the each network identifier.
17. The non-transitory computer storage device of claim 13 , wherein the features related to one or more transactions comprise source and destination pairs that are analyzed for persistent communication patterns.
18. The non-transitory computer storage device of claim 13 , wherein the features related to one or more transactions comprise sparse data retrieved by hash-based indexing of content information.
19. The non-transitory computer storage device of claim 13 , further comprising instructions to cause the one or more processing devices to analyze using statistical language models and properties derived from the nameservers containing resolution information for domain names associated with the one or more transactions originating from the network identifier.
20. The non-transitory computer storage device of claim 13 , further comprising instructions to cause the one or more processing devices to track the features related to one or more transactions in real-time for unknown or suspicious network identifiers that are then subjected to further analysis to determine whether to allow or deny a transaction.
21. The non-transitory computer storage device of claim 13 , further comprising instruction to cause one or more processors to receive email information from a plurality of network devices, and derive network identifier reputation data from the received email information.
22. The non-transitory computer storage device of claim 13 , further comprising instructions to cause one or more processors to receive email information from a client device and reply to the client with reputation data regarding a network identifier of a sender of the email.
23. The non-transitory computer storage device of claim 13 , further comprising instructions to cause one or more processors to send reputation information regarding the each network identifier to at least one of an end user and a gateway device, such that the end user or gateway device can use the reputation information to allow or disallow network traffic other than email between an end user and the each network identifier.
24. The non-transitory computer storage device of claim 13 , wherein a transaction selected from the one or more transactions comprises at least one of an email transaction, a credit card transaction, a consumer transaction, and a file transaction.
25. An email handling system, comprising:
one or more processing units; and
an email handling module executing on the one or more processing units, the email handling module operable to receive an email, request reputation information regarding the email's network identifier from a reputation server, and selectively forward the email based on reputation information regarding the sender received from the reputation server;
the reputation information for the email's network identifier determined by analyzing which nameservers contain information to resolve a particular domain name, changes in which nameservers contain information to resolve the particular domain name over a time duration, and one or more of a plurality of high-level email features related to one or more emails originating from the email's network identifier, wherein the nameservers are used to resolve domain names to internet protocol (IP) addresses corresponding to a server for the domain name.
26. The email handling system of claim 25 , wherein the email handling module is further operable to send information regarding received emails to the reputation server, such that the reputation server is operable to derive the network identifier reputation information from the received email information.
27. The email handling system of claim 25 , wherein the email's network identifier comprises at least one of a domain name, an IP (Internet Protocol) address, and a URL (Uniform Resource Locator).
28. The email handing system of claim 25 , wherein the plurality of high-level email features comprise one or more of domain registration analysis, hashed term frequency indexing, persistent communication, address age, correlation analysis, zombie detection, and hash vault matching.
29. The email handling system of claim 25 , further comprising at least one additional network traffic handling module executing on the one or more processing units and operable to use reputation information regarding the email's network identifier to allow or disallow network traffic other than email between an end user and the email's network identifier.
30. The computer network device of claim 1 , wherein analysis of which nameservers contain information to resolve a particular domain name further comprises deriving nameserver information for an unknown domain from zone information including identification of other domains having resolution information available on a common nameserver and a reputation history of the other domains.
31. The computer network device of claim 30 , wherein analysis of which nameservers contain information to resolve a particular domain name further comprises utilizing the reputation history of the common nameserver.