Method of, and system for, processing email in particular to detect unsolicited bulk email

• US 20040093384A1
• Filed: 10/07/2003
• Published: 05/13/2004
• Est. Priority Date: 03/05/2001
• Status: Abandoned Application

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Shipp, Alex
• Application Number:
  US10/469,842
• Publication Number:
  US 20040093384A1
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

In order to alleviate problems caused by delivery of unwanted or unsolicited email (spam), email traffic is analysed for patterns of traffic which indicate or suggest that the emails are spam; when the system detects a pattern it thinks is spam it can take remedial action, e.g. blocking delivery of the emails involved, either itself or to a human operator. Analysis of email takes place by scanning a database of data abstracted from emails. These data are primarily abstracted from the emails when regarded as “containers” (i.e. without reference to the message contents).

Claims

1. A method of processing email which comprises monitoring email traffic passing through one or more nodes of a network for patterns of email traffic which are indicative of, or suggestive of, a mailshot of unsolicited or unwanted email and, once such a pattern is detected, initiating automatic remedial action, alerting an operator, or both.

2. A method according to claim 1 which comprises decomposing each email into its constituent parts, analysing one or more of the decomposed constituent parts for content taken to be indicative of that email belonging to such a mailshot and logging data of the decomposed email to a database.

3. A method according to claim 2, wherein data is logged only in respect of email which, on analysis, meets at least one criterion met by email belonging to such a mailshot.

4. A method according to claim 1, 2 or 3 and including the step of delivering, or forwarding for delivery, email not considered to belong to such a mailshot.

5. A method according to claim 2, 3 or 4 and including the step of continually or continuously executing an algorithm against entries in a database to identify patterns of email traffic taken to be indicative of, or suggestive of such a mailshot.

6. A method according to claim 5, wherein the database algorithm examines, principally or exclusively, only “

recently”

added database entries, i.e. entries which have been added less than a predetermined time ago.

7. A method according to any one of the preceding claims wherein the corrective action includes any or all of the following, in relation to each email which conforms to the detected pattern:

a) at least temporarily stopping the passage of the emails

b) notifying the intended recipient(s)

c) generating a signal to alert a human operator.

8. A system for processing email which comprises means for monitoring email traffic passing through one or more nodes of a network for patterns of email traffic which are indicative of, or suggestive of, a mailshot of unsolicited or unwanted email and once such a pattern is detected, initiating automatic remedial action, alerting an operator, or both.

9. A system according to claim 8 which comprises means for decomposing each email into its constituent parts, means for analysing one or more of the decomposed constituent parts for content taken to be indicative of that email being of such a mailshot and logging data of the decomposed email to a database.

10. A system according to claim 9 and including means for continually or continuously executing an algorithm against entries in the database to identify patterns of email traffic taken to be indicative of a mailshot of unsolicited emails.

11. A system according to claim 10, wherein the database algorithm examines, principally or exclusively, only “

recently”

added database entries, i.e. entries which have been added less than a predetermined time ago.

12. A system according to claim 9, 10, or 11, wherein data is logged only in respect of email which, on analysis, meets at least one criterion met by email belonging to such a mailshot.

13. A system according to claim 9, 10, 11, or 12 and including the step of delivering, or forwarding for delivery, email not considered to belong to such a mailshot.

14. A system according to any one of claims 8 to 13 wherein the corrective action includes any or all of the following, in relation to each email which conforms to the detected pattern:

a) at least temporarily stopping the passage of the emails

b) notifying the intended recipient(s)

c) generating a signal to alert a human operator.