Classifying a message based on likelihood of spoofing

Abstract

A technique for determining a boundary IP address is disclosed. The technique includes processing a header to extract candidate IP address, locating a gateway IP address, and selecting the boundary IP address based on the location of the gateway IP address.

1 . (canceled) 
     
     
         2 . A method for classifying messages, the method comprising:
 receiving an electronic message;   identifying an addresses and a domain associated with the electronic message;   comparing the identified address and the domain associated with the electronic message with a set of information that cross references at least one of address information or domain information with a good status;   identifying that the received electronic message is a good message based at least in part on the comparison of the identified on or more addresses and the domain associated with the electronic message with the set of information that cross references the at least one of the address information or the domain information with the good status; and   allowing the electronic message to be sent to a destination based on the at least one of the address information or the domain information with the good status.   
     
     
         3 . The method of  claim 2 , further comprising:
 identifying that the identified address does not correspond to a known good address and that the identified domain corresponds to a known good domain; and   classifying the electronic message as good based on the identified domain corresponding to the known good domain and based on a preference that allows the domain information to supersede the address information.   
     
     
         4 . The method of  claim 2 , further comprising:
 classifying an address and a domain associated with a known electronic message sender, wherein the identified address and the identified domain correspond to the address and domain associated with the known electronic message sender; and   storing the address and the domain associated with the known electronic message sender in a table that stores the set of information that cross references the at least one of the address information or the domain information with the good status.   
     
     
         5 . The method of  claim 4 , wherein the address and the domain associated with a known electronic message sender are associated with a boundary of a computer network. 
     
     
         6 . The method of  claim 2 , further comprising:
 receiving one or more message from a first address and a first domain;   classifying the one or more messages from the first address and the first domain with a bad status when the first address and the first domain have not previously been associated with the good status;   receiving an indication that the first address and the first domain are now associated with the good status;   receiving a subsequent message from the first address and the first domain;   identifying that the subsequent message is associated with the good status; and   allowing the subsequent message to be sent to a recipient based on the indication associating the first address and the first domain with the good status.   
     
     
         7 . The method of  claim 6 , further comprising receiving information from one or more users indicating that the one or more received messages correspond to the good status, wherein the indication is received based on the information received from the one or more users. 
     
     
         8 . The method of  claim 2 , wherein the information that cross references the at least one of the address information or the domain information with the good status is based on data from a plurality of classifiers including machine classifiers and user classification information. 
     
     
         9 . The method of  claim 2 , wherein the good status is based on a calculation that compares a ratio of bad classifiers with good classifiers. 
     
     
         10 . The method of  claim 2 , wherein the set of information that cross references the at least one of the address information or the domain information with the good status is stored in a table that cross references good internet protocol (IP) addresses with good domains. 
     
     
         11 . A non-transitory computer readable storage medium having embodied thereon a program executable by a processor to perform a method for classifying messages, the method comprising:
 receiving an electronic message;   identifying an addresses and a domain associated with the electronic message;   comparing the identified address and the domain associated with the electronic message with a set of information that cross references at least one of address information or domain information with a good status;   identifying that the received electronic message is a good message based at least in part on the comparison of the identified on or more addresses and the domain associated with the electronic message with the set of information that cross references the at least one of the address information or the domain information with the good status; and   allowing the electronic message to be sent to a destination based on the at least one of the address information or the domain information with the good status.   
     
     
         12 . The non-transitory computer readable storage medium of  claim 2 , the program further executable to:
 identify that the identified address does not correspond to a known good address and that the identified domain corresponds to a known good domain; and   classify the electronic message as good based on the identified domain corresponding to the known good domain and based on a preference that allows the domain information to supersede the address information.   
     
     
         13 . The non-transitory computer readable storage medium of  claim 2 , the program further executable to:
 classify an address and a domain associated with a known electronic message sender, wherein the identified address and the identified domain correspond to the address and domain associated with the known electronic message sender; and   store the address and the domain associated with the known electronic message sender in a table that stores the set of information that cross references the at least one of the address information or the domain information with the good status.   
     
     
         14 . The non-transitory computer readable storage medium of  claim 13 , wherein the address and the domain associated with a known electronic message sender are associated with a boundary of a computer network. 
     
     
         15 . The non-transitory computer readable storage medium of  claim 11 , the program further executable to:
 receive one or more message from a first address and a first domain;   classify the one or more messages from the first address and the first domain with a bad status when the first address and the first domain have not previously been associated with the good status;   receive an indication that the first address and the first domain are now associated with the good status;   receive a subsequent message from the first address and the first domain;   identify that the subsequent message is associated with the good status; and   allow the subsequent message to be sent to a recipient based on the indication associating the first address and the first domain with the good status.   
     
     
         16 . The non-transitory computer readable storage medium of  claim 15 , the program further executable to receive information from one or more users indicating that the one or more received messages correspond to the good status, wherein the indication is received based on the information received from the one or more users. 
     
     
         17 . The non-transitory computer readable storage medium of  claim 11 , wherein the information that cross references the at least one of the address information or the domain information with the good status is based on data from a plurality of classifiers including machine classifiers and user classification information. 
     
     
         18 . The non-transitory computer readable storage medium of  claim 2 , wherein the good status is based on a calculation that compares a ratio of bad classifiers with good classifiers. 
     
     
         19 . The non-transitory computer readable storage medium of  claim 2 , wherein the set of information that cross references the at least one of the address information or the domain information with the good status is stored in a table that cross references good internet protocol (IP) addresses with good domains. 
     
     
         20 . An apparatus for classifying messages, the apparatus comprising:
 a network interface that receives an electronic message;   a memory; and   a processor that executes instructions out of the memory to:
 identify an addresses and a domain associated with the electronic message, 
 compare the identified address and the domain associated with the electronic message with a set of information that cross references at least one of address information or domain information with a good status, 
 identify that the received electronic message is a good message based at least in part on the comparison of the identified on or more addresses and the domain associated with the electronic message with the set of information that cross references the at least one of the address information or the domain information with the good status, and 
 allow the electronic message to be sent to a destination based on the at least one of the address information or the domain information with the good status. 
   
     
     
         21 . The apparatus of  claim 20  wherein:
 the identified address is identified as not corresponding to a known good address and that the identified domain corresponds to a known good domain, and 
 the electronic message is classified as good based on the identified domain corresponding to the known good domain and based on a preference that allows the domain information to supersede the address information.