Cloudmark, Inc.

Proofpoint, Inc.

Proofprint, Inc.

Coudmark, Inc.

Mark Stemm

Vipul Ved Prakash

Arlyn Robert Johns

Olivier Lemarié

Neil Cook

A computer includes a processor and a memory connected to the processor. The memory stores instructions executed by the processor to augment a message with network node attributes derived by linking from an original network node specified in the message to additional network nodes associated with the original network node. Message signatures representing the network node attributes are generated. The message signatures are evaluated to characterize the message.

Apparatus and method for augmenting a message to facilitate spam identification

A method includes receiving a set of strings and applying one or more filters to generate a subset of strings that are determined to correspond to strings of interest. The method also includes retrieving domain name system (DNS) information associated with a first string of the subset. The method includes executing a rule-based engine to determine, based on application of one or more rules to the DNS information, whether to add the first string to a set of suspicious hostnames.

Systems and methods of identifying suspicious hostnames

A machine includes a processor and a memory connected to the processor. The memory stores instructions executed by the processor to preserve a second level domain, track requests for subdomains of the second level domain, determine the size of encoded subdomain data and determine the size of response data for subdomain requests. When the ratio of the number of unique subdomains versus the number of subdomain requests is over a first threshold a first satisfied condition is established. It is determined, in response to the first satisfied condition, when the size of the subdomain data exceeds a second threshold and the size of response data exceeds a third threshold to establish a second satisfied condition corresponding to deemed domain name system tunnel activity. It is determined, in response to the first satisfied condition, when the size of the subdomain data exceeds the second threshold to establish a third satisfied condition corresponding to deemed domain name system data exfiltration activity.

Apparatus and method for identifying domain name system tunneling, exfiltration and infiltration

Embodiments of the invention provide methods and apparatuses for classifying electronic documents (e.g., electronic communications) as either spam electronic documents or legitimate electronic documents. In accordance with one embodiment of the invention, each of a plurality of electronic communications is reduced to a corresponding multidimensional vector based on a multi-dimensional vector space. The multi-dimensional vectors represent corresponding electronic documents that have been classified as at least one type of electronic documents. Subsequent electronic documents to be classified are reduced to a corresponding multi-dimensional vector inserted into the multi-dimensional vector space. The electronic documents corresponding to an inserted multi-dimensional vector are classified based upon the proximity of the inserted multi-dimensional vector to at least one previously classified multi-dimensional vectors of the multi-dimensional vector space.

Growing community of inventors

Santa Monica, CA, United States of America

Mark Stemm