Automated tracking of interaction with a resource of a message
Information of an electronic message to be delivered to an intended recipient is received. For an original resource identifier included in the electronic message, a corresponding alternative resource identifier that can be at least in part used to obtain the original resource identifier is determined. The original resource identifier included in the electronic message is replaced with the corresponding alternative resource identifier to generate a modified electronic message. The modified electronic message with the alternative resource identifier is allowed to be delivered to the intended recipient instead of the electronic message with the original resource identifier. An interaction associated with the original resource identifier is tracked using the alternative resource identifier.
1. A method, comprising:
receiving at a recipient system, information of an electronic message to be delivered to an intended recipient, wherein the electronic message has been sent via a network by a message sender prior to being received at the recipient system associated with the intended recipient;
determining for an original resource identifier included in the electronic message, a corresponding alternative resource identifier that is based on both the specific intended recipient and the original resource identifier and at least in part used to obtain the original resource identifier;
after receiving the electronic message at the recipient system and regardless of whether the original resource identifier is determined to be associated with a suspected malicious resource, replacing the original resource identifier included in the electronic message with the corresponding alternative resource identifier to generate a modified electronic message;
allowing the modified electronic message with the alternative resource identifier to be delivered to the intended recipient instead of the electronic message with the original resource identifier, wherein an interaction associated with the original resource identifier is tracked using the alternative resource identifier including by storing for the original resource identifier in a data structure, an entry that includes interaction information and associated context information for a request made using the alternative resource identifier;
obtaining from the data structure storing the interaction information and the associated context information, entries for the original resource identifier to determine a scoring associated with the original resource identifier; and
performing an action based on a determination that the scoring meets a threshold criteria, wherein performing the action includes performing one or more of the following: blocking access to the content referenced by the original resource identifier, providing a security warning, providing a modified version of the content referenced by the original resource identifier with modified functionality, logging an event associated with the request made using the alternative resource identifier, or performing an auditing operation.
2. The method of claim 1 , wherein the original resource identifier is a URL hyperlink included in a body content of the electronic message, and the alternative resource identifier is generated specifically for the intended recipient of the electronic message.
3. The method of claim 1 , wherein the electronic message is to be delivered to a plurality of different intended recipients and a different corresponding alternative resource identifier for the same original resource identifier is generated for each of the different intended recipients.
4. The method of claim 1 , wherein the interaction associated with the original resource identifier is tracked including by receiving a notification of the request made using the alternative resource identifier.
5. The method of claim 4 , wherein the logging information associated with the request includes recording a time associated with when the request was made.
6. The method of claim 1 , wherein a plurality of different interactions associated with the original resource identifier by different recipients of the electronic message is tracked.
7. The method of claim 1 , wherein determining the corresponding alternative resource identifier includes searching a data structure using the original resource identifier.
8. The method of claim 1 , wherein performing the action includes performing an analysis based at least in part on the tracked interaction.
9. The method of claim 8 , wherein performing the analysis includes determining a statistic associated with a likelihood a message recipient will request a content of the original resource identifier.
10. The method of claim 8 , wherein performing the analysis includes determining a list of message recipients that requested a content of the original resource identifier.
11. The method of claim 10 , further comprising performing a security action for each of the message recipients in the list.
12. The method of claim 1 , wherein the recipient system includes one or more of the following: a mail transfer agent device, a mail relay device, a gateway device, a cloud security device, or a local security appliance.
13. The method of claim 1 , wherein the corresponding alternative resource identifier includes a domain name associated with a security service, wherein the domain name associated with the security service is not included in the original resource identifier.
14. The method of claim 1 , wherein determining the corresponding alternative resource identifier includes determining a handle value corresponding to at least the original resource identifier and including the handle value in the corresponding alternative resource identifier.
15. The method of claim 14 , wherein the entry that includes the interaction information and the associated context information corresponds to the handle value.
16. The method of claim 1 , wherein determining the corresponding alternative resource identifier includes encrypting at least the original resource identifier to generate an encrypted value and including the encrypted value in the corresponding alternative resource identifier.
17. A system, comprising:
a communication interface configured to receive information of an electronic message to be delivered to an intended recipient, wherein the electronic message has been sent via a network by a message sender prior to being received at the communication interface of the system; and
a processor coupled with the communication interface and configured to:
determine for an original resource identifier included in the electronic message, a corresponding alternative resource identifier that is based on both the specific intended recipient and the original resource identifier and at least in part used to obtain the original resource identifier;
after receiving the electronic message at the recipient system and regardless of whether the original resource identifier is determined to be associated with a suspected malicious resource, replace the original resource identifier included in the electronic message with the corresponding alternative resource identifier to generate a modified electronic message;
allow the modified electronic message with the alternative resource identifier to be delivered to the intended recipient instead of the electronic message with the original resource identifier, wherein an interaction associated with the original resource identifier is tracked using the alternative resource identifier including by being configured to store for the original resource identifier in a data structure, an entry that includes interaction information and associated context information for a request made using the alternative resource identifier;
obtain from the data structure storing the interaction information and the associated context information, entries for the original resource identifier to determine a scoring associated with the original resource identifier; and
perform an action based on a determination that the scoring meets a threshold criteria, wherein performing the action includes performing one or more of the following: blocking access to the content referenced by the original resource identifier, providing a security warning, providing a modified version of the content referenced by the original resource identifier with modified functionality, logging an event associated with the request made using the alternative resource identifier, or performing an auditing operation.
18. The system of claim 17 , wherein performing the action includes performing an analysis based at least in part on the tracked interaction.
19. The system of claim 18 , wherein performing the analysis includes determining a statistic associated with a likelihood a message recipient will request a content of the original resource identifier.
20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving at a recipient system, information of an electronic message to be delivered to an intended recipient, wherein the electronic message has been sent via a network by a message sender prior to being received at the recipient system associated with the intended recipient;
determining for an original resource identifier included in the electronic message, a corresponding alternative resource identifier that is based on both the specific intended recipient and the original resource identifier and at least in part used to obtain the original resource identifier;
after receiving the electronic message at the recipient system and regardless of whether the original resource identifier is determined to be associated with a suspected malicious resource, replacing the original resource identifier included in the electronic message with the corresponding alternative resource identifier to generate a modified electronic message;
allowing the modified electronic message with the alternative resource identifier to be delivered to the intended recipient instead of the electronic message with the original resource identifier, wherein an interaction associated with the original resource identifier is tracked using the alternative resource identifier including by storing for the original resource identifier in a data structure, an entry that includes interaction information and associated context information for a request made using the alternative resource identifier;
obtaining from the data structure storing the interaction information and the associated context information, entries for the original resource identifier to determine a scoring associated with the original resource identifier; and
performing an action based on a determination that the scoring meets a threshold criteria, wherein performing the action includes performing one or more of the following: blocking access to the content referenced by the original resource identifier, providing a security warning, providing a modified version of the content referenced by the original resource identifier with modified functionality, logging an event associated with the request made using the alternative resource identifier, or performing an auditing operation.