Just-in-time, email embedded URL reputation determination
A system allows just-in-time checking of information about an email in which a hyperlink is embedded. Upon receipt of the email containing the hyperlink, the resource locator of the hyperlink is modified to allow checking the reputation of the email upon traversal of the hyperlink. At traversal of the hyperlink, the current reputation of the resource locator and the current reputation of the email are both determined, and one or more actions are performed responsive to the determination.
1. A non-transitory program storage device, on which are stored instructions comprising instructions for causing one or more processors to:
receive a request to traverse a resource locator of a hyperlink from an email containing the hyperlink;
determine a reputation of the email and a reputation of the resource locator, responsive to the request;
store reputation information associated with an identity of the email in a reputation database; and
perform an action responsive to the reputation of the email and the reputation of the resource locator.
2. The program storage device of claim 1 , wherein the action comprises one or more of:
subjecting the resource locator to greater scrutiny;
refusing to allow traversal of the resource locator; and
redirecting traversal to an alternate destination.
3. The program storage device of claim 2 , wherein the action further comprises subjecting downloaded data corresponding to the resource locator to greater scrutiny.
4. The program storage device of claim 1 , on which are stored instructions further comprising instructions for causing one or more processors to:
receive an email containing a hyperlink; and
modify the resource locator of the hyperlink in the email to indicate the identity of the email.
5. The program storage device of claim 4 , wherein the instructions for causing one or more processors to modify the resource locator comprise instructions for causing one or more processors to:
replace the resource locator in the email message.
6. The program storage device of claim 1 , wherein the instructions for causing one or more processors to determine a reputation of the email and a reputation of the resource locator comprise instructions for causing one or more processors to:
request reputation information for the email from an email gateway.
7. A system, comprising:
a web gateway; and
an email gateway,
wherein the web gateway comprises:
a processor;
a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to:
receive a request to make a connection to a location specified by a resource locator of a hyperlink embedded in an email;
determine an identity of the email based on the resource locator;
determine a current reputation of the email; and
determine a current reputation of the resource locator;
store reputation information associated with the identity of the email in a reputation database; and
perform an action responsive to a reputation of the resource locator and the email;
wherein the email gateway comprises:
a processor;
a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to:
receive the email; and
modify the resource locator in the email to identify the email.
8. The system of claim 7 , wherein the software of the email gateway further comprises instructions for causing the processor to:′
cache information corresponding to the email;
receive the request from the web gateway;
extract information about the email from the cached information based on information in the request;
obtain reputation information for the email; and
send the reputation information to the web gateway.
9. The system of claim 7 ,
wherein the software of the web gateway further comprises instructions for causing the processor to:
determine that the resource locator comprises information associated with a context of the email,
wherein the instructions for causing the processor to request reputation information comprise instructions for causing the processor to:
include the information associated with the context of the email in the request.
10. The system of claim 7 ,
wherein the software of the email gateway further comprises instructions for causing the processor to:
deliver the email containing the modified resource locator.
11. The system of claim 7 , wherein the instructions for causing the processor to modify the resource locator comprise instructions for causing the processor to:
generate a message identifier for the email; and
modify the email by encoding the message identifier into the resource locator in the email.
12. The system of claim 7 , wherein the software of the email gateway further comprises instructions for causing the processor to:
obtain an initial reputation of the email upon receipt of the email; and
perform an action responsive to the initial reputation.
13. The system of claim 7 , further comprising:
a redirection server, comprising:
a processor; and
a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to:
receive information associating the modified resource locator with the resource locator in the email;
receive a connection corresponding to the resource locator;
request a reputation of the email and the resource locator in the email; and
redirect the connection to a destination specified in the resource locator in the email,
wherein the instructions for causing the processor to modify the resource locator comprise instructions for causing the processor to:
replace the resource locator in the email with a resource locator pointing to the redirection server.
14. A method, comprising:
receiving an email, comprising:
determining by the computing device an initial reputation of the email; and
modifying by the computing device a first resource locator of a hyperlink embedded in the email to identify the email; and
receiving a request to traverse the first resource locator, comprising;
determining by the computing device a current reputation of the first resource locator;
analyzing by the computing device the first resource locator to identify the email in which the hyperlink was embedded;
determining by the computing device a current reputation of the email;
storing reputation information associated with an identity of the email in a reputation database; and
performing an action responsive to the reputation of the first resource locator and the current reputation of the email.
15. The method of claim 14 , wherein modifying by the computing device a first resource locator comprises:
replacing the resource locator by the computing device with a second resource locator; and
associating by the computing device the first resource locator with the second resource locator.
16. The method of claim 15 , wherein receiving a request to traverse the first resource locator further comprises:
receiving a request by a redirection service to traverse the second resource locator; and
determine the first resource locator associated with the second resource locator.
17. The method of claim 14 ,
wherein receiving an email further comprises:
storing by the computing device meta-information about the email; and
associating by the computing device the meta-information with a message identification data, and
wherein modifying by the computing device a first resource locator comprises:
encoding by the computing device the message identification data into the first resource locator.