Reputation-based threat protection
View Patent ↗Information concerning a plurality of identified threats provided by a plurality of preselected sources is stored in memory. An e-mail message may be received over a communication network. The received e-mail message is separated into a plurality of components. The stored information is searched to identify a reputation score associated with each of the plurality of components. It is then determined whether the e-mail is a threat based on the identified reputation score of each of the plurality of components. The determination is sent to a designated recipient.
1. A method for reputation-based threat protection, the method comprising:
maintaining information in memory concerning a plurality of identified threats, the maintained information provided by a plurality of preselected sources;
intercepting an e-mail message from a sender in an organization and addressed to a destination outside of the organization, wherein the e-mail message is intercepted prior to leaving a communication network of the organization;
executing instructions stored in memory, wherein execution of the instructions by a processor:
separates the intercepted e-mail message into a plurality of components,
searches the maintained information to identify a reputation score associated with each of the plurality of components,
determines whether the intercepted e-mail message includes sensitive data as defined by policies of the organization, wherein the determination is based on one or more dictionaries for identifying the sensitive data, and
determines that the e-mail message is a threat based on the identified reputation score of each of the plurality of components and whether the e-mail message includes sensitive data;
sending information to a designated recipient within the organization regarding the determination that the email message is a threat, the information being sent over the communication network;
placing the e-mail message in quarantine for analysis;
permitting the designated recipient to review the quarantined e-mail message and information regarding the determination that the e-mail message is a threat; and
notifying the sender that the e-mail message was determined to be a threat.
2. The method of claim 1 , further comprising generating a thumbprint for each of the plurality of components.
3. The method of claim 2 , wherein each of the preselected sources is allowed one vote per thumbprint per day.
4. The method of claim 3 , wherein the reputation score for each of the plurality of components is based on a collection of votes from the preselected sources.
5. The method of claim 1 , further comprising:
identifying the sender of the e-mail message determined to be a threat; and
sending an alert regarding the identified sender.
6. The method of claim 5 , further comprising locating the sender device, wherein the sender device is placed in safe mode.
7. The method of claim 1 , wherein the analysis includes permitting the sender to review the quarantined message and information regarding the determination that the e-mail message is a threat.
8. The method of claim 1 , wherein content in the quarantined message is blocked from display.
9. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for reputation-based threat protection, the method comprising:
maintaining information concerning a plurality of identified threats, the maintained information provided by a plurality of preselected sources;
intercepting an e-mail message from a sender in an organization and addressed to a destination outside of the organization, wherein the e-mail message is intercepted prior to leaving a communication network of the organization;
separating the intercepted e-mail message into a plurality of components;
searching the maintained information to identify a reputation score associated with each of the plurality of components;
determining whether the intercepted e-mail message includes sensitive data as defined by policies of the organization, wherein the determination is based on one or more dictionaries for identifying the sensitive data,
determining that the e-mail message is a threat based on the identified reputation score of each of the plurality of components and whether the e-mail message includes sensitive data;
sending information to a designated recipient within the organization regarding the determination that the e-mail message is a threat;
placing the e-mail message in quarantine for analysis;
permitting the designated recipient to review the quarantined e-mail message and information regarding the determination that the e-mail message is a threat; and
notifying the sender that the e-mail message was determined to be a threat.
10. The non-transitory computer-readable storage medium of claim 9 , wherein content in the quarantined message is blocked from display.
11. The non-transitory computer-readable storage medium of claim 9 , the program further executable to generate a thumbprint for each of the plurality of components.
12. The non-transitory computer-readable storage medium of claim 11 , wherein each of the preselected sources is allowed one vote per thumbprint per day.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the reputation score for each of the plurality of components is based on a collection of votes from the preselected sources.
14. The non-transitory computer-readable storage medium of claim 9 , the program further executable to:
identify the sender of the e-mail message determined to be a threat; and
send an alert regarding the identified sender.
15. The non-transitory computer-readable storage medium of claim 14 , the program further executable to locate the sender device, wherein the sender device is placed in safe mode.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the analysis includes permitting the sender to review the quarantined message and information regarding the determination that the e-mail message is a threat.