Automating the reduction of unsolicited email in real time

• US 20030149726A1
• Filed: 02/05/2002
• Published: 08/07/2003
• Est. Priority Date: 02/05/2002
• Status: Abandoned Application

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Spear, Steven W.
• Application Number:
  US10/068,090
• Publication Number:
  US 20030149726A1
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 61/4555 Directories for electronic mail or instant messaging
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A method and apparatus for reducing unsolicited bulk email, or spam, to a computer network is described having a gateway, a mail queue, and a delay queue. The gateway handles input/output for the computer network communicating outside of the computer network. The gateway may make an initial determination of a likelihood that incoming mail is spam and deliver likely spam to the delay queue, or all incoming mail may be delivered to the delay queue. Email delivered to the delay queue is held in the delay queue for a configurable amount of time, or until is determined to either be undesirable or permissible. Once an email is determined likely not to be spam or permissible, it is delivered to the mail queue for delivery to the intended recipient. Email determined to be undesirable or likely to be spam may be discarded, returned to the sender, or held for further inspection.

Claims

1. An apparatus for reducing unwanted emails to a computer network comprising:

an input/output point coupled to a computer network;

a mail queue; and

a delay queue coupled to the input/output point and the mail queue, whereby incoming email messages are placed on the delay queue, and whereby at least one characteristic of the email message placed on the delay queue is examined to determine whether the email message are likely to be desirable to the intended recipient or recipients.

2. The apparatus of claim 1 wherein the email messages are placed on the delay queue for a configurable time period.

3. The apparatus of claim 1 wherein the input/output point comprises at least one gateway.

4. The apparatus of claim 1 wherein the input/output point comprises a plurality of gateways.

5. The apparatus of claim 1 wherein the mail queue and delay queue are co-located.

6. The apparatus of claim 1 wherein the delay queue resides on a plurality of machines and wherein the delay queue polls the plurality of machines regarding the at least one characteristic of the emails on the delay queue.

7. The apparatus of claim 1 wherein the at least one characteristic of the emails placed on the delay queue is the sender'"'"'s Internet protocol address.

8. The apparatus of claim 1 wherein the at least one characteristic of the emails placed on the delay queue is the email'"'"'s MAC address.

9. The apparatus of claim 1 wherein the at least one characteristic of the emails placed on the delay queue is the number of recipients.

10. The apparatus of claim 1 wherein the at least one characteristic of the emails placed on the delay queue is the sender'"'"'s address.

11. The apparatus of claim 1 wherein the at least one characteristic of the emails is selected from the group of:

recipient address, number of invalid recipients, encryption of the emails, method of encryption of the emails, authentication of the sending user, method of authentication of the sending user, subject, message-ID, or message content.

12. The apparatus of claim 1 wherein a plurality of characteristics of the emails placed on the delay queue are examined, the characteristic of the emails being selected from the group of:

sender'"'"'s IP, MAC address, sender'"'"'s address, recipient address, number of recipients, number of invalid recipients, encryption of the emails, method of encryption of the emails, authentication of the sending user, method of authentication of the sending user, subject, message-ID, or message content.

13. An apparatus for reducing unsolicited bulk emails to a computer network comprising:

an at least one gateway to a computer network for receiving or transmitting information whereby incoming emails are initially examined for being suspect as unsolicited bulk emails;

a mail queue; and

a delay queue, whereby suspect incoming emails are placed on the delay queue for an appropriate and configurable time period, whereby at least one characteristic of the emails placed on the delay queue is examined to determine whether the emails is likely to be desirable to the intended recipient.

14. The apparatus of claim 13 wherein emails identified as not suspect as unsolicited bulk emails are delivered to the mail queue.

15. The apparatus of claim 13 wherein said emails placed on the delay queue and found sufficiently unique as not to present a threat to the resources of the computer network are delivered to the mail queue.

16. The apparatus of claim 15 wherein said emails found to present a threat to the resources of the computer network are not delivered to destination addresses.

17. The apparatus of claim 16 wherein said emails not delivered to the mail queue are discarded, returned to the sender, stored for further inspection, or stored for a recipient to request.

18. The apparatus of claim 13 further including computer-executable instructions for determining whether the emails are acceptable as desired or permitted, said computer-executable instructions providing rules for accepted characteristics for individual emails.

19. The apparatus of claim 18 wherein said emails placed on the delay queue are compared against established protocols, and wherein emails found acceptable are delivered to the mail queue.

20. The apparatus of claim 19 wherein said emails not delivered to the mail queue may be discarded, returned to the sender, stored for further inspection, or stored for a recipient to request.

21. A method of reducing unwanted email messages received at a computer network, the method comprising:

(a) storing an email message on a delay queue;

(b) identifying at least one characteristic of the email message stored on the delay queue; and

(c) comparing said at least one characteristic of the email message stored on the delay queue with corresponding characteristics of other email messages stored on the delay queue to determine a likelihood that the email message is an unwanted e-mail message.

22. The method of claim 21 further including initially identifying incoming email messages as suspect or not suspect, whereby email messages identified as suspect are stored on the delay queue.

23. The method of claim 22 further including delivering email messages identified as not suspect to a mail queue for ultimate delivery to the intended recipient.

24. The method of claim 21 wherein (c) includes comparing a plurality of characteristics of the email message with corresponding characteristics of other email messages.

25. The method of claim 24 further including:

receiving a delay time at the delay queue; and

storing the email message on the delay queue for the delay time.

26. The method of claim 25 further including:

after determining in (c) that the email message is likely not an unwanted message, delivering the email message to the mail queue.

27. The method of claim 26 further including:

after determining in (c) that the email message is likely an unwanted message, preventing delivery of the email message.

28. The method of claim 27 wherein preventing delivery includes returning the email message to a sender.

29. The method of claim 27 wherein preventing delivery includes discarding the email message.

30. The method of claim 27 wherein preventing delivery includes storing the email message.

31. A computer-readable medium having computer-executable instructions for causing an email server to perform the steps comprising:

placing emails on a delay queue;

identifying at least one characteristic of the emails placed on the delay queue; and

comparing said at least one characteristic of the emails placed on the delay queue to determine a likelihood that emails with similar characteristics are likely unsolicited bulk emails.

32. The computer readable medium of claim 31 further comprising computer-executable instructions for performing the step of initially identifying incoming emails as suspect or not suspect, whereby emails identified as suspect are placed on the delay queue.

33. The computer readable medium of claim 32 having further computer-executable instructions for performing the step of delivering emails identified as not suspect to a mail queue for delivery to the intended recipient.

34. The computer readable medium of claim 31 wherein said step of identifying at least one characteristic of the emails includes identifying a plurality of characteristics of the emails, and wherein said step of comparing includes comparing said plurality of characteristics of the emails placed on the delay queue to determine a likelihood that emails with similar characteristics are unsolicited bulk emails.

35. The computer readable medium of claim 34 further comprising computer-executable instructions for performing the steps of:

configuring a delay time for the delay queue;

delaying said emails on the delay queue for the delay time; and

comparing said plurality of characteristics of the emails placed on the delay queue during the delay time to determine a likelihood that emails with similar characteristics are likely unsolicited bulk emails.

36. The computer readable medium of claim 35 further comprising computer-executable instructions for performing the steps of:

determining emails placed on the delay queue whose characteristics are not sufficiently similar to other emails simultaneously on the delay queue are not likely to be unsolicited bulk email; and

delivering emails which are not determined likely to be unsolicited bulk email from the delay queue to the mail queue after said emails have resided on the delay queue for the delay time.

37. The computer readable medium of claim 36 further comprising computer-executable instructions for performing the step of preventing delivery of emails determined to be likely to be unsolicited bulk email.

38. The computer readable medium of claim 37 wherein said step of preventing delivery includes returning to the sender emails determined to be likely to be unsolicited bulk email.

39. The computer readable medium of claim 37 wherein said step of preventing delivery includes discarding emails determined to be likely to be unsolicited bulk email.

40. The computer readable medium of claim 37 wherein said step of preventing delivery includes storing emails determined to be likely to be unsolicited bulk email.