Sonicwall Inc.

Dell Software Inc.

Dell Products Inc.

Scott D Eikenberry

David A Koblas

Brian K Wilson

Jonathan J Oliver

Tim Nufire

Damon K Uyeda

Boris Yanovsky

Paul R Wieneke

Kwok H Ng

Gleb Budman

Nick Bilogorskiy

Bryan Kim

Gayatri Bhimaraju

Scott Roy

Brian Kim

John Everett Gmuender

Akbal Singh Karlcut

Bhuvanasundar Rachamreddy

Michael Carl Y Uy

Bhuvan Racham

MichaelCarl Y Uy

A global response network collects, analyzes, and distributes 'cross-vector' threat-related information between security systems to allow for an intelligent, collaborative, and comprehensive real-time response.

Real-time network updates for malicious content

A system and method are disclosed for maintaining a whitelist, including: obtaining message data based on an email message sent by a user; extracting recipient information from message data; updating the whitelist using the recipient information.

Probability based whitelist

Information concerning a plurality of identified threats provided by a plurality of preselected sources is stored in memory. An e-mail message may be received over a communication network. The received e-mail message is separated into a plurality of components. The stored information is searched to identify a reputation score associated with each of the plurality of components. It is then determined whether the e-mail is a threat based on the identified reputation score of each of the plurality of components. The determination is sent to a designated recipient.

Reputation-based threat protection

Handling a message comprises: classifying an incoming message for a recipient, storing the classified message and providing a notification to the recipient, wherein the notification includes summary information about the classified message and an interface that allows the recipient to operate on the classified message.

Declassifying of suspicious messages

A system and method are disclosed for improving a statistical message classifier. A message may be tested with a machine classifier, wherein the machine classifier is capable of making a classification on the message. In the event the message is classifiable by the machine classifier, the statistical message classifier is updated according to the reliable classification made by the machine classifier. The message may also be tested with a first classifier. In the event that the message is not classifiable by the first classifier, it is tested with a second classifier, wherein the second classifier is capable of making a second classification. In the event that the message is classifiable by the second classifier, the statistical message classifier is updated according to the second classification.

Statistical message classifier

A local gateway device receives email across the internet from a sender of the email and forwards it across the internet to an email filtering system. The email filtering system analyzes the email to determine whether it is spam, phishing or contains a virus and sends it back to the local gateway device along with the filtered determination. The local gateway device forwards the received email and the filtered determination to a local junk store which handles the email appropriately. For example, if the email has been determined to be spam, phishing or containing a virus, the junk store can quarantine the email and if the email has been determined to be non-spun and/or not phishing and/or not containing a virus, the junk store can forward the email to a local mail server for delivery.

Net-based email filtering

A system and method are disclosed for routing a message through a plurality of test methods. The method includes: receiving a message; applying a first test method to the message; updating a state of the message based on the first test method; and determining a second test method to be applied to the message based on the state.

Efficient use of resources in message classification

A system and method are disclosed for registering a email sender for the purpose of sending an email message to an email receiver including receiving a challenge message wherein the challenge message includes a machine answerable question; processing the challenge message to determine that it is a challenge message sent for the purpose of authorizing delivery of the email message; analyzing the question to determine a valid response to the challenge message; and sending the valid response that includes the answer wherein a nontrivial amount of resources are required to send the valid response.

Message challenge response

Growing community of inventors

Menlo Park, CA, United States of America

Scott D Eikenberry