Dynamically detecting abnormalities in otherwise legitimate emails containing uniform resource locators (URLs)
View Patent ↗Dynamically detecting abnormalities in otherwise legitimate emails containing Uniform Resource Locators (URLs) is provided. An example method includes determining one or more rules defining normal patterns in a number of sending Top-Level Domains of previously received emails received via a computer network to a user or group of users; generating a trusted trends criteria for a received email, associated with the user or the group of users, by evaluating the received email against the one or more rules; determining whether the trusted trends criteria exceeds a predetermined threshold; in response to exceeding the predetermined threshold, generating a second URL and applying it to the received email by replacing a first URL of the received email with the second URL; and redetermining the one or more rules defining normal patterns in the number of sending Top-Level Domains based on the previously received emails and the received email.
1. A method for dynamically detecting abnormalities in otherwise legitimate emails containing Uniform Resource Locators (URLs), the method comprising:
determining, using one or more processors, one or more rules that define normal patterns in a number of sending Top-Level Domains of previously received emails, associated with a user or a group of users, received via a computer network by the user or the group of users;
generating a trusted trends criteria for a received email, associated with the user or the group of users, by evaluating the received email against the one or more rules;
determining whether the trusted trends criteria exceeds a predetermined threshold;
based on the determining that the trusted trends criteria exceeds the predetermined threshold, generating a second URL and applying the second URL to the received email by replacing a first URL of the received email with the second URL; and
redetermining, using the one or more processors, the one or more rules that define the normal patterns in the number of sending Top-Level Domains based on the previously received emails and the received email.
2. The method of claim 1 , wherein the normal patterns further comprise normal patterns in a number of received emails, addressed to the user, by time of day, and a number of received emails, addressed to the group of users, by time of day.
3. The method of claim 1 , wherein the normal patterns further comprise normal patterns in a receive to send ratio by address.
4. The method of claim 1 , wherein the normal patterns further comprise normal patterns in:
a number of emails by size,
a number of emails per mail user agent,
a number of emails by language,
a number of emails by character set,
a number of emails by number of attachments,
a number of emails by content type,
a number of emails having a header and a number of emails lacking a header, and
a percentage of unsolicited emails received.
5. The method of claim 1 , wherein the normal patterns further comprise normal patterns in a number of Internet Protocol (IP) addresses in an Autonomous System Number (ASN).
6. The method of claim 1 , wherein the normal patterns further comprise normal patterns in:
email volume per Internet Protocol (IP) address,
a number of domains per an Autonomous System Number (ASN), and
a number of emails by size.
7. The method of claim 1 , wherein the normal patterns further comprise normal patterns in a number of emails received per domain.
8. The method of claim 1 , wherein the normal patterns further comprise normal patterns in a number of headers per email.
9. The method of claim 1 , wherein the normal patterns further comprise normal patterns in:
a number of emails per language,
a number of emails by character set,
a number of emails by country,
a number of emails by number of attachments, or
a number of emails by content type.
10. The method of claim 1 , wherein the normal patterns further comprise normal patterns in a number of emails to a target by an Internet Protocol (IP) address.
11. The method of claim 1 , wherein the normal patterns further comprise normal patterns in a number of Uniform Resource Locators (URLs) per email.
12. The method of claim 1 , further comprising marking, based on the determining that the trusted trends criteria exceeds the predetermined threshold, the received email as a suspicious email.
13. A system for dynamically detecting abnormalities in otherwise legitimate emails containing Uniform Resource Locators (URLs), the system comprising:
a processor; and
a memory for storing logic, the logic being executed by the processor to execute operations comprising:
determining, using one or more processors, one or more rules that define normal patterns in a number of sending Top-Level Domains of previously received emails, associated with a user or a group of users, received via a computer network by the user or the group of users;
generating a trusted trends criteria for a received email, associated with the user or the group of users, by evaluating the received email against the one or more rules;
determining whether the trusted trends criteria exceeds a predetermined threshold;
based on the determining that the trusted trends criteria exceeds the predetermined threshold, generating a second URL and applying the second URL to the received email by replacing a first URL of the received email with the second URL; and
redetermining, using the one or more processors, the one or more rules that define the normal patterns in the number of sending Top-Level Domains based on the previously received emails and the received email.
14. The system of claim 13 , wherein the normal patterns further comprise normal patterns in a number of received emails, addressed to the user, by time of day, and a number of received emails, addressed to the group of users, by time of day.
15. The system of claim 13 , wherein the operations further comprise marking, based on the determining that the trusted trends criteria exceeds the predetermined threshold, the received email as a suspicious email.
16. The system of claim 13 , wherein the operations further comprise informing an email service provider that the first URL was replaced with the second URL, the second URL being a predetermined safe URL.
17. A method for dynamically detecting abnormalities in otherwise legitimate emails containing Uniform Resource Locators (URLs), the method comprising:
determining, using one or more processors, one or more rules that define normal patterns in a number of sending Top-Level Domains of previously received emails, associated with a user or a group of users, received via a computer network by the user or the group of users;
generating a trusted trends criteria for a received email, associated with the user or the group of users, by evaluating the received email against the one or more rules;
determining whether the trusted trends criteria exceeds a predetermined threshold;
based on the determining that the trusted trends criteria exceeds the predetermined threshold, sandboxing the received email; and
redetermining, using the one or more processors, the one or more rules that define the normal patterns in the number of sending Top-Level Domains based on the previously received emails and the received email.