Reputation-based threat protection
View Patent ↗Information concerning a plurality of identified threats provided by a plurality of preselected sources is stored in memory. An e-mail message may be received over a communication network. The received e-mail message is separated into a plurality of components. The stored information is searched to identify a reputation score associated with each of the plurality of components. It is then determined whether the e-mail is a threat based on the identified reputation score of each of the plurality of components. The determination is sent to a designated recipient.
1. A method for reputation-based threat protection, the method comprising:
receiving, from one or more databases, information concerning a plurality of identified threats from a plurality of selected sources;
executing instructions stored in memory, wherein execution of the instructions by a processor:
identifies one or more components of an intercepted e-mail message, wherein the intercepted e-mail message was received over a first network communication interface,
reviews the one or more components to associate, using the received information, one or more reputation scores with the intercepted e-mail message,
identifies the intercepted e-mail message as a threat based on the one or more reputation scores associated with the e-mail message
blocks access to a universal resource locator (URL) included in the intercepted e-mail according to at least a first threat vector, and
blocks access to the e-mail message according to at least a second vector; and
providing a notification that the e-mail message was identified as a threat.
2. The method of claim 1 , wherein the first vector corresponds to a first port for accessing the URL and the second vector corresponds to a second port.
3. The method of claim 1 , wherein a signature is generated from the one or more components of the intercepted e-mail message.
4. The method of claim 1 , wherein information corresponding to the intercepted e-mail message is transmitted to a data center.
5. The method of claim 4 , wherein the information corresponding to the intercepted e-mail message is encoded and is transmitted to the data center according to a secure hypertext transfer protocol (HTTPS).
6. The method of claim 5 , wherein the information corresponding to the intercepted e-mail message is encoded according to at least one of a data encryption standard (DES) or an advanced encryption standard (AES).
7. The method of claim 1 , wherein the first network communication interface corresponds to at least one of an interface associated with outgoing e-mail traffic or a communication interfaces associated with incoming e-mail traffic.
8. A non-transitory computer readable storage medium having embodied thereon a program executable by a processor for performing a method for reputation-based threat protection, the method comprising:
receiving, from one or more databases, information concerning a plurality of identified threats from a plurality of selected sources;
identifying one or more components of an intercepted e-mail message, wherein the intercepted e-mail message was received over a first network communication interface;
reviewing the one or more components to associate, using the received information, one or more reputation scores with the intercepted e-mail message;
identifying the intercepted e-mail message as a threat based on the one or more reputation scores associated with the e-mail message;
blocking access to a universal resource locator (URL) included in the intercepted e-mail according to at least a first threat vector;
blocking access to the e-mail message according to at least a second vector; and
providing a notification that the e-mail message was identified as a threat.
9. The non-transitory computer readable storage medium of claim 8 , wherein the first vector corresponds to a first port for accessing the URL and the second vector corresponds to a second port.
10. The non-transitory computer readable storage medium of claim 8 , wherein a signature is generated from the one or more components of the intercepted e-mail message.
11. The non-transitory computer readable storage medium of claim 8 , wherein information corresponding to the intercepted e-mail message is transmitted to a data center.
12. The non-transitory computer readable storage medium of claim 11 , wherein the information corresponding to the intercepted e-mail message is encoded and is transmitted to the data center according to a secure hypertext transfer protocol (HTTPS).
13. The non-transitory computer readable storage medium of claim 12 , wherein the information corresponding to the intercepted e-mail message is encoded according to at least one of a data encryption standard (DES) or an advanced encryption standard (AES).
14. The non-transitory computer readable storage medium of claim 8 , wherein the first network communication interface corresponds to at least one of an interface associated with outgoing e-mail traffic or a communication interfaces associated with incoming e-mail traffic.
15. A system for reputation-based threat protection, the system comprising:
one or more databases; and
at least one server communicatively coupled to the one or more databases, wherein the at least one server comprises:
a communication interface that receives from one or more databases, information concerning a plurality of identified threats from a plurality of selected sources; and
a processor that executes instructions stored in memory, wherein execution of the instructions by a processor:
identifies one or more components of an intercepted e-mail message, wherein the intercepted e-mail message was received over a first network communication interface,
reviews the one or more components to associate, using the received information, one or more reputation scores with the intercepted e-mail message,
identifies the intercepted e-mail message as a threat based on the one or more reputation scores associated with the e-mail message,
blocks access to a universal resource locator (URL) included in the intercepted e-mail according to at least a first threat vector, and
blocks access to the e-mail message according to at least a second vector,
wherein the communication interface provides a notification that the e-mail message was identified as a threat.
16. The system of claim 15 , wherein the first vector corresponds to a first port for accessing the URL and the second vector corresponds to a second port.
17. The system of claim 15 , wherein a signature is generated from the one or more components of the intercepted e-mail message.
18. The system of claim 15 , wherein information corresponding to the intercepted e-mail message is transmitted to a data center.
19. The system of claim 18 , wherein the information corresponding to the intercepted e-mail message is encoded and is transmitted to the data center according to a secure hypertext transfer protocol (HTTPS).
20. The system of claim 19 , wherein the encoding of the information corresponding to the intercepted e-mail message is encoded according to at least one of a data encryption standard (DES) or an advanced encryption standard (AES).