Patents Assigned to Cloudmark, Inc.
-
Publication number: 20170208024Abstract: A computer includes a processor and a memory connected to the processor. The memory stores instructions executed by the processor to augment a message with network node attributes derived by linking from an original network node specified in the message to additional network nodes associated with the original network node. Message signatures representing the network node attributes are generated. The message signatures are evaluated to characterize the message.Type: ApplicationFiled: March 30, 2017Publication date: July 20, 2017Applicant: Cloudmark, Inc.Inventor: Mark Stemm
-
Patent number: 9634970Abstract: A computer includes a processor and a memory connected to the processor. The memory stores instructions executed by the processor to augment a message with network node attributes derived by linking from an original network node specified in the message to additional network nodes associated with the original network node. Message signatures representing the network node attributes are generated. The message signatures are evaluated to characterize the message.Type: GrantFiled: April 30, 2013Date of Patent: April 25, 2017Assignee: Cloudmark, Inc.Inventor: Mark Stemm
-
Patent number: 9560074Abstract: A method includes receiving a set of strings and applying one or more filters to generate a subset of strings that are determined to correspond to strings of interest. The method also includes retrieving domain name system (DNS) information associated with a first string of the subset. The method includes executing a rule-based engine to determine, based on application of one or more rules to the DNS information, whether to add the first string to a set of suspicious hostnames.Type: GrantFiled: October 7, 2014Date of Patent: January 31, 2017Assignee: Cloudmark, Inc.Inventors: Mark Richard Stemm, Arlyn Robert Johns
-
Publication number: 20160099954Abstract: A machine includes a processor and a memory connected to the processor. The memory stores instructions executed by the processor to identify a resource attack in response to spikes in the number of unique subdomains being queried and spikes in the number of timeouts or delayed responses from a specified name server.Type: ApplicationFiled: October 7, 2014Publication date: April 7, 2016Applicant: CLOUDMARK, INC.Inventors: Neil Cook, Olivier Lemarié, Aaron Alexander Lehmann
-
Publication number: 20160099852Abstract: A machine includes a processor and a memory connected to the processor. The memory stores instructions executed by the processor to preserve a second level domain, track requests for subdomains of the second level domain, determine the size of encoded subdomain data and determine the size of response data for subdomain requests. When the ratio of the number of unique subdomains versus the number of subdomain requests is over a first threshold a first satisfied condition is established. It is determined, in response to the first satisfied condition, when the size of the subdomain data exceeds a second threshold and the size of response data exceeds a third threshold to establish a second satisfied condition corresponding to deemed domain name system tunnel activity. It is determined, in response to the first satisfied condition, when the size of the subdomain data exceeds the second threshold to establish a third satisfied condition corresponding to deemed domain name system data exfiltration activity.Type: ApplicationFiled: October 7, 2014Publication date: April 7, 2016Applicant: Cloudmark, Inc.Inventors: Neil Cook, Olivier Lemarié, Mark Richard Stemm
-
Patent number: 9294490Abstract: A machine includes a processor and a memory connected to the processor. The memory stores instructions executed by the processor to identify a resource attack in response to spikes in the number of unique subdomains being queried and spikes in the number of timeouts or delayed responses from a specified name server.Type: GrantFiled: October 7, 2014Date of Patent: March 22, 2016Assignee: Cloudmark, Inc.Inventors: Neil Cook, Olivier Lemarié, Aaron Alexander Lehmann
-
Publication number: 20140324985Abstract: A computer includes a processor and a memory connected to the processor. The memory stores instructions executed by the processor to augment a message with network node attributes derived by linking from an original network node specified in the message to additional network nodes associated with the original network node. Message signatures representing the network node attributes are generated. The message signatures are evaluated to characterize the message.Type: ApplicationFiled: April 30, 2013Publication date: October 30, 2014Applicant: CLOUDMARK, INC.Inventor: Mark Stemm
-
Patent number: 8301702Abstract: A method and an apparatus to screen electronic communications have been disclosed. In one embodiment, the method includes extracting URLs from electronic communication and analyzing the URLs extracted to determine whether the electronic communication is of a first predetermined category. Other embodiments have been claimed and described.Type: GrantFiled: March 12, 2004Date of Patent: October 30, 2012Assignee: Cloudmark, Inc.Inventor: Vipul V. Prakash
-
Patent number: 8171091Abstract: A server is communicatively coupled to a content publisher and a client machine The server may register the publication by assigning a publication identification (ID) to the publication, and register the content by associating the content with the publication using the publication ID. In some example embodiments, the client machine may submit a request to the server to determine whether the content is associated with the publication. In some example embodiments, the server may provide the publication ID to the client based on the content being associated with the publication, and the publication ID may allow the client to determine whether the publication is on a subscribed list that is stored on the client machine. An example client machine may be configured to perform an action on the content, based on the user being subscribed to the publication.Type: GrantFiled: May 22, 2009Date of Patent: May 1, 2012Assignee: Cloudmark, Inc.Inventor: Vipul Ved Prakash
-
Publication number: 20110238770Abstract: A method and an apparatus to screen electronic communications have been disclosed. In one embodiment, the method includes extracting URLs from electronic communication and analyzing the URLs extracted to determine whether the electronic communication is of a first predetermined category. Other embodiments have been claimed and described.Type: ApplicationFiled: June 7, 2011Publication date: September 29, 2011Applicant: Cloudmark, Inc.Inventor: Vipul V. Prakash
-
Patent number: 7953801Abstract: A method and an apparatus to screen electronic communications have been disclosed. In one embodiment, the method includes extracting URLs from electronic communication and analyzing the URLs extracted to determine whether the electronic communication is of a first predetermined category. Other embodiments have been claimed and described.Type: GrantFiled: March 12, 2004Date of Patent: May 31, 2011Assignee: Cloudmark, Inc.Inventor: Vipul V. Prakash
-
Patent number: 7890441Abstract: Embodiments of the invention provide methods and apparatuses for classifying electronic documents (e.g., electronic communications) as either spam electronic documents or legitimate electronic documents. In accordance with one embodiment of the invention, each of a plurality of electronic communications is reduced to a corresponding multidimensional vector based on a multi-dimensional vector space. The multi-dimensional vectors represent corresponding electronic documents that have been classified as at least one type of electronic documents. Subsequent electronic documents to be classified are reduced to a corresponding multi-dimensional vector inserted into the multi-dimensional vector space. The electronic documents corresponding to an inserted multi-dimensional vector are classified based upon the proximity of the inserted multi-dimensional vector to at least one previously classified multi-dimensional vectors of the multi-dimensional vector space.Type: GrantFiled: April 14, 2009Date of Patent: February 15, 2011Assignee: Cloudmark, Inc.Inventors: Vipul V. Prakash, Mark Stemm
-
Publication number: 20090282112Abstract: In one embodiment, a method includes receiving a plurality of reports from a community of users, each of the plurality of reports including a derivative of an email message to uniquely identify the email message, and suggesting the email message as being spam. The e-mail message is determined to be spam based on the plurality of reports received from the community of users, and a respective trust factor associated with each user of the community of users.Type: ApplicationFiled: May 12, 2008Publication date: November 12, 2009Applicant: Cloudmark, Inc.Inventor: Vipul Ved Prakash
-
Publication number: 20090259608Abstract: Embodiments of the invention provide methods and apparatuses for classifying electronic documents (e.g., electronic communications) as either spam electronic documents or legitimate electronic documents. In accordance with one embodiment of the invention, each of a plurality of electronic communications is reduced to a corresponding multidimensional vector based on a multi-dimensional vector space. The multi-dimensional vectors represent corresponding electronic documents that have been classified as at least one type of electronic documents. Subsequent electronic documents to be classified are reduced to a corresponding multi-dimensional vector inserted into the multi-dimensional vector space. The electronic documents corresponding to an inserted multi-dimensional vector are classified based upon the proximity of the inserted multi-dimensional vector to at least one previously classified multi-dimensional vectors of the multi-dimensional vector space.Type: ApplicationFiled: April 14, 2009Publication date: October 15, 2009Applicant: Cloudmark, Inc.Inventors: Vipul Ved Prakash, Mark Stemm
-
Patent number: 7539729Abstract: In accordance with one embodiment, a method is provided. The method comprises maintaining a database of registered electronic publications for a plurality of clients; configuring a set of clients to query the database to determine if a publication received from a content publisher is registered; and delivering the publication to an inbox associated with the client if the publication is registered.Type: GrantFiled: September 15, 2003Date of Patent: May 26, 2009Assignee: Cloudmark, Inc.Inventor: Vipul Ved Prakash
-
Patent number: 7519565Abstract: Embodiments of the invention provide methods and apparatuses for classifying electronic documents (e.g., electronic communications) as either spam electronic documents or legitimate electronic documents. In accordance with one embodiment of the invention, each of a plurality of electronic communications is reduced to a corresponding multidimensional vector based on a multi-dimensional vector space. The multi-dimensional vectors represent corresponding electronic documents that have been classified as at least one type of electronic documents. Subsequent electronic documents to be classified are reduced to a corresponding multi-dimensional vector inserted into the multi-dimensional vector space. The electronic documents corresponding to an inserted multi-dimensional vector are classified based upon the proximity of the inserted multi-dimensional vector to at least one previously classified multi-dimensional vectors of the multi-dimensional vector space.Type: GrantFiled: June 24, 2004Date of Patent: April 14, 2009Assignee: Cloudmark, Inc.Inventors: Vipul Ved Prakash, Mark Stemm
-
Publication number: 20080134326Abstract: Methods for generating a signature for executable code are described. An entry address for executable code is determined. Starting at the entry address, the method steps through the executable code, discarding a first type of instruction. Moreover, at least one type of branch instruction is followed but discarded. A mnemonic code listing is created by emitting into mnemonic form instructions not discarded until an ending condition is reached. The mnemonic code listing is processed to create a signature associated with the executable code. Lastly, the signature is analyzed to classify the executable code into one of a set of predetermined categories.Type: ApplicationFiled: March 1, 2006Publication date: June 5, 2008Applicant: CLOUDMARK, INC.Inventor: Christopher Abad
-
Patent number: 7373385Abstract: In one embodiment, a method for operating a server is provided. The method comprises receiving a plurality of reports from a community of users, each report identifying an email message as spam or not spam; and determining if the email message is spam based on a number of the reports received from the community of users, and a trust factor associated with each user.Type: GrantFiled: November 3, 2003Date of Patent: May 13, 2008Assignee: Cloudmark, Inc.Inventor: Vipul Ved Prakash