Classifying a message based on likelihood of spoofing
A technique for determining a boundary IP address is disclosed. The technique includes processing a header to extract candidate IP address, locating a gateway IP address, and selecting the boundary IP address based on the location of the gateway IP address.
1. A method of classifying a message transmitted over a network, the method comprising:
receiving the message transmitted over the network and addressed to a recipient; and
executing instructions stored in a non-transitory computer readable storage medium to:
identify one or more domains from which the received message is purported to have traversed,
identify that the identified domains appear on a whitelist associated with the recipient,
identify whether at least one domain of the one or more domains has been spoofed based on whether a common classification appears across a plurality of IP addresses associated with the one or more domains, wherein:
the one or more domains are identified not to be spoofed when the one or more domains are in the whitelist and have the common classification appearing across the plurality of IP addresses, and
the at least one domain of the one or more domains is identified to be spoofed when the one or more domains are in the whitelist and have different classifications associated with the plurality of IP addresses, and
classify the received message based on the identification that the at least one domain of the one or more domains has been or has not been spoofed.
2. The method of claim 1 , wherein identifying that the one or more domains from which the received message is purported to have traversed includes identifying a stated sender domain associated with the received message.
3. The method of claim 1 , wherein classifying the received message comprises assigning a score to the received message based on the identifying that the at least one domain has been spoofed.
4. The method of claim 3 , wherein assigning the score is further based on one or more classification variables.
5. The method of claim 4 , further comprising weighting the classification variables based on a source of the classification.
6. The method of claim 4 , further comprising decaying the classification variables over time, wherein decaying the classification variables reduces the effect of older classifications over time.
7. The method of claim 3 , wherein assigning the score includes identifying a spam ratio.
8. The method of claim 3 , wherein assigning the score includes identifying a spam rate.
9. The method of claim 3 , wherein assigning the score includes identifying an estimated instantaneous spam rate.
10. A system of classifying a message transmitted over a network, the system comprising:
a communication interface that receives the message transmitted over the network and addressed to a recipient; and
a processor that executes instructions stored in a non-transitory computer readable storage medium to:
identify one or more associated domains from which the received message is purported to have traversed,
identify that the identified domains appear on a whitelist associated with the recipient,
identify whether at least one domain of the one or more domains has been spoofed based on whether a common classification appears across a plurality of IP addresses associated with the one or more domains, wherein:
the one or more domains are identified as not to be spoofed when the one or more domains are in the whitelist and have the common classification appearing across the plurality of IP addresses, and
the at least one domain of the one or more domains is identified to be spoofed when the one or domains are in the whitelist and have different classifications associated with the plurality of IP addresses, and
classify the received message based on the identification that the at least one domain of the one or more domains has has been or has not been spoofed.
11. The system of claim 10 , wherein the processor identifies that the one or more domains from which the received message is purported to have traversed by identifying a stated sender domain associated with the received message.
12. The system of claim 10 , wherein the processor classifies the received message by assigning a score to the received message based on the identification that the domain has been spoofed.
13. The system of claim 12 , wherein assigning the score is further based on one or more classification variables.
14. The system of claim 13 , wherein the classification variables are weighted based on a source of the classification.
15. The system of claim 13 , wherein the classification variables decay over time.
16. The system of claim 12 , wherein assigning the score includes identifying a spam ratio.
17. The system of claim 12 , wherein assigning the score includes identifying a spam rate.
18. The system of claim 12 , wherein assigning the score includes identifying an estimated instantaneous spam rate.
19. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for classifying a message transmitted over a network, the method comprising:
receiving the message transmitted over the network and addressed to a recipient;
identifying one or more associated domains from which the received message is purported to have traversed;
identifying that the one or more identified domains determined domain appears in a whitelist associated with the recipient;
identifying whether at least one domain of the one or more domains have been spoofed based on whether a common classification appears across a plurality of IP addresses associated with the one or more domains, wherein:
the one or more domains are identified as not to be spoofed when the one or more domains are in whitelist and have the common classification appearing across the plurality of IP addresses, and
the at least one domain is of the one or more domains are identified to be spoofed when the received message is on the whitelist but have different classifications appearing across the plurality of IP addresses; and
classifying the received message based on the identification that the one or more domains has been or has not been spoofed.
20. The non-transitory computer-readable storage medium of claim 19 , wherein the identifying that the one or more domains from which the received message is purported to have traversed includes identifying a stated sender domain associated with the received message.