Granted Patent B2

US 12,238,121 · App. 17/708,825 · Granted Feb 25, 2025

Inventor: John Mears (Wales, GB)

Assignee: Sophos Limited

H04L63/1416H04L51/21H04L51/212H04L51/224H04L51/42

Abstract

Claims (83)

1. A computer-implemented method comprising:

performing, during offline analysis, processing of email data associated with a plurality of email messages to identify historical patterns and outliers in the plurality of email messages;

generating, independent of the processing of the email data, behavior patterns based on historical behavior of at least a subset of the plurality of email messages;

generating cached analytics from the historical patterns, the outliers, and the behavior patterns, wherein the generating includes discarding corresponding historical patterns, corresponding outliers, and corresponding behavior data associated with the email data that is older than a predetermined time period;

receiving an email message from a first sender, wherein the email message is withheld from delivery to a recipient;

extracting features from the email message;

providing the extracted features as input to a machine-learning model, wherein the machine-learning model is trained using the cached analytics;

comparing, with the machine-learning model, the extracted features to the cached analytics by:

determining whether content of the email message matches at least one criterion for suspicious content; and

determining a reputation score associated with the first sender based on a comparison of the extracted features with the behavior patterns and an association of the first sender to an other sender with a low reputation score, wherein the extracted features include an identity of the first sender; and

responsive to the content of the email message not matching the at least one criterion for suspicious content and the reputation score meeting a reputation threshold, delivering the email message to the recipient.

2. The method of claim 1 , wherein the other sender has the low reputation score based on performing an action selected from a group of actions including sending email messages with an attachment and no text in a body of the plurality of email messages, sending email messages with a filename for an attachment that is known to be associated with malicious content, and combinations thereof.

3. The method of claim 1 , wherein the at least one criterion for suspicious content includes a sender name that was previously identified to be associated with a new domain name and further comprising:

normalizing the new domain name by performing one or more normalizations selected from a group of case flattening, whitespace normalization, homograph flattening, nickname normalization, initials normalization, and combinations thereof;

comparing the normalized domain name to previously seen email addresses to determine if the normalized domain name is new.

4. The method of claim 1 , further comprising:

responsive to the content of the email message not matching any criterion for suspicious content and the reputation score being less than the reputation threshold, alerting the recipient that the email message is suspicious.

5. The method of claim 4 , wherein alerting the recipient that the email message is suspicious includes providing a user interface that includes an alert and an option to ignore the alert and provide the email message to the recipient.

6. The method of claim 1 , further comprising:

generating, cached analytics; and

comparing the extracted features to the cached analytics;

wherein providing the email message to the recipient is further responsive to the comparing the extracted features to the cached analytics not identifying the suspicious content.

7. The method of claim 1 , wherein the machine-learning model is further trained based on feedback events that include a recipient's reactions to protective acts performed responsive to determining that one or more of the plurality of email messages include suspicious content.

8. The method of claim 1 , wherein the extracted features include one or more of:

information from a Simple Mail Transfer Protocol (SMTP) process that generates the email message;

results from one or more scanners that perform the scanning; or

data added by an enriched scanner context.

9. The method of claim 8 , wherein the information from the SMTP process includes one or more of:

an SMTP client Internet Protocol (IP) address associated with the email message;

a number of email messages that were delivered in an SMTP session, wherein the email message is included in the SMTP session;

results of a reputation lookup on the SMTP client IP address;

whether the first sender passed one or more of a Domain-based Message Authentication, Reporting and Conformance (DMARC) test, a Domain Keys Identified Mail (DKIM) test, or a Sender Policy Framework (SPF) test;

a HELO parameter or an Extended HELO (EHLO) parameter;

SMTP verbs;

whether the email message exited the SMTP early; or

whether the email message sent an SMTP command before a response from a previous command was received.

10. The method of claim 8 , wherein the results from the one or more scanners include one or more of:

one or more results of reputation lookup in a third-party Domain Name System-based Remote Block List (DNS RBL);

one or more results of reputation lookup in local systems; or

one or more results of reputation lookup in local systems that are based on a client IP address, a sender domain, or a domain included in an Extended HELO (EHLO) command.

11. The method of claim 8 , wherein the data added by the enriched scanner context includes:

whether the first sender has an affinity with clusters of other senders based on the first sender and the clusters other senders emailing a same group of recipients and corresponding reputation scores for the clusters of other senders; and

machine-learning scores for machine-learning models that were exposed to the email message and a corresponding graph of correspondence that includes the email message.

12. A system comprising:

one or more processors; and

one or more computer-readable media, having instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

performing, during offline analysis, processing of email data associated with a plurality of email messages to identify historical patterns and outliers in the plurality of email messages;

generating, independent of the processing of the email data, behavior patterns based on historical behavior of at least a subset of the plurality of email messages;

generating cached analytics from the historical patterns, the outliers, and the behavior patterns, wherein the generating includes discarding corresponding historical patterns, corresponding outliers, and corresponding behavior data associated with the email data that is older than a predetermined time period;

receiving an email message from a first sender, wherein the email message is withheld from delivery to a recipient;

extracting features from the email message;

providing the extracted features as input to a machine-learning model;

comparing, with the machine-learning model, the extracted features to the cached analytics by:

determining whether content of the email message matches at least one criterion for suspicious content; and

determining a reputation score associated with the first sender based on a comparison of the extracted features with the behavior patterns and an association of the first sender to an other sender with a low reputation score, wherein the extracted features include an identity of the first sender; and

responsive to the content of the email message not matching the at least one criterion for suspicious content and the reputation score meeting a reputation threshold, delivering the email message to the recipient.

13. The system of claim 12 , wherein the first sender is determined to be associated with the other sender based on the first sender emailing the other sender more than a threshold number of times.

14. The system of claim 12 , wherein the operations further comprise:

responsive to the content of the email message not matching any criterion for suspicious content and the reputation score being less than the reputation threshold, alerting the recipient that the email message is suspicious.

15. The system of claim 12 , wherein the extracted features include one or more of:

information from a Simple Mail Transfer Protocol (SMTP) process that generates the email message;

results from one or more scanners that perform the scanning; or

data added by an enriched scanner context.

16. A computer-program product that includes one or more non-transitory computer-readable media with instructions stored thereon that, when executed by one or more computers, cause the one or more computers to perform operations comprising:

performing, during offline analysis, processing of email data associated with a plurality of email messages to identify historical patterns and outliers in the plurality of email messages;

generating, independent of the processing of the email data, behavior patterns based on historical behavior of at least a subset of the plurality of email messages;

generating cached analytics from the historical patterns, the outliers, and the behavior patterns, wherein the generating includes discarding corresponding historical patterns, corresponding outliers, and corresponding behavior data associated with the email data that is older than a predetermined time period;

receiving an email message from a first sender, wherein the email message is withheld from delivery to a recipient;

extracting features from the email message;

providing the extracted features as input to a machine-learning model;

comparing, with the machine-learning model, the extracted features to the cached analytics by:

determining whether content of the email message matches at least one criterion for suspicious content; and

determining a reputation score associated with the first sender based on a comparison of the extracted features with the behavior patterns and an association of the first sender to an other sender with a low reputation score, wherein the extracted features include an identity of the first sender; and

responsive to the content of the email message not matching the at least one criterion for suspicious content and the reputation score meeting a reputation threshold, delivering the email message to the recipient.

17. The computer-program product of claim 16 , wherein the operations further comprise:

providing a user interface that includes the email message and an option to report the email message as suspicious.

18. The computer-program product of claim 16 , wherein the operations further comprise:

responsive to the content of the email message not matching any criterion for suspicious content and the reputation score being less than the reputation threshold, alerting the recipient that the email message is suspicious.

19. The computer-program product of claim 18 , wherein alerting the recipient that the email message is suspicious includes providing a user interface that includes an alert and an option to ignore the alert and provide the email message to the recipient.

20. The computer-program product of claim 16 , wherein the extracted features include one or more of:

information from a Simple Mail Transfer Protocol (SMTP) process that generates the email message;

results from one or more scanners that perform the scanning; or

data added by an enriched scanner context.

Assignments (1)

Continuity (1)

References Cited (20)