Patent ID: 7953814
Filing Date: 2011-05-31
Classification: H04L

Abstract:
1. A method comprising: extracting behavior data of at least one subscriber account from outbound messages originated by said at least one subscriber account using a Sender Reputation Gateway (SRG) running on a computer system, said behavior data of said at least one subscriber account being attributes of said at least one subscriber account that are indicative of spam, virus, or worm related activity of said at least one subscriber account; building a profile for said at least one subscriber account based on said behavior data extracted from said outbound messages originated by said at least one subscriber on said SRG running on said computer system; tracking said behavior data extracted from said outbound messages originated by said at least one subscriber account using said SRG running on said computer system; detecting behavior-based anomalies for said outbound messages originated by said at least one subscriber account using said SRG running on said computer system by comparing recent outbound messages originated by said at least one subscriber account with said profile of said at least one subscriber account to detect changes in said recent outbound messages originated by said at least one subscriber account in comparison to said profile of said at least one subscriber account; determining reputation data for said at least one subscriber account based on said detected behavior-based anomalies using said SRG computer system, wherein the reputation data is added to the profile to determine a reputation score, and wherein if the reputation score falls below a threshold, then any subsequent outbound messages from the subscriber account are redirected to a server and prohibited from reaching their intended destination, and wherein the redirection to the server activity is designated for a specific time interval.