Framework to enable integration of anti-spam technologies

• US 20040139165A1
• Filed: 11/12/2003
• Published: 07/15/2004
• Est. Priority Date: 01/09/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wang, Qiang, Attwell, Simon P., Neely, Samuel J., Koorland, Neil K., Wallace, Andrew J., McMillan, Bruce A.
• Granted Patent: US 7,533,148 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method that enables multiple spam detection solutions to be deployed in a manageable and rational manner to determine if a message is spam is presented. A framework invokes anti-spam filters to analyze the message and return confidence levels of whether a message is spam. The framework evaluates the highest confidence level against a set of defined thresholds. If the highest confidence level is greater than the highest threshold set by the administrator, the action specified for the highest threshold is taken. The highest confidence level is also compared against all thresholds and the action associated with the nearest threshold that has been exceeded is taken.

Claims

1. A method of determining if a message is spam in a system having a plurality of anti-spam modules comprising the steps of:

invoking a plurality of the plurality of anti-spam modules;

receiving a spam confidence level from each of the plurality of the plurality of anti-spam modules;

determining a highest spam confidence level from the spam confidence levels;

comparing the highest spam confidence level to at least one threshold; and

invoking an action associated with the at least one threshold if the highest spam confidence level is greater than the at least one threshold.

2. The method of claim 1 further comprising the step of applying a tuning factor to at least one spam confidence level to create at least one tuned spam confidence level and wherein the step of determining a highest spam confidence level comprises the step of determining the highest of the at least one tuned spam confidence level and the spam confidence levels that had the tuning factor applied.

3. The method of claim 2 wherein the step of applying a tuning factor comprising tuning the at least one spam confidence level by a user'"'"'s confidence level in the anti-spam module associated with the at least one spam confidence level.

4. The method of claim 1 further comprising the step of scaling each spam confidence level to a normalized range.

5. The method of claim 4 wherein the normalized range is 0 to 9.

6. The method of claim 1 further comprising the step of adding the spam confidence level to the message.

7. The method of claim 1 wherein the at least one threshold comprises a plurality of thresholds including a top threshold and a bottom threshold, the method further comprising the steps of:

comparing the highest spam confidence level to each of the plurality of thresholds;

determining if the highest spam confidence level is higher than at least one of the plurality of thresholds;

if the highest spam confidence level is higher than at least one of the plurality of thresholds;

determining which of the at least one of the plurality of thresholds is closest to the top threshold; and

invoking the action associated with the at least one of the plurality of thresholds that is closest to the top threshold.

8. The method of claim 1 wherein the step of invoking the action includes invoking one of deleting the message, sending a non-delivery notification, archiving the message, and passing the message to a client with the highest spam confidence level.

9. The method of claim 1 wherein the step of invoking the action includes:

dropping a connection if the highest spam confidence level exceeds a first threshold level;

returning a non-delivery message to a sender if the highest spam confidence level exceeds a second threshold level and is below the first threshold level;

delivering the message to a junk mail folder if the highest spam confidence level exceeds a third threshold level and is below the second threshold level.

10. The method of claim 9 wherein the first threshold is a ninety nine percent spam confidence level, the second threshold is a seventy percent spam confidence level, and the third threshold level is a forty percent spam confidence level.

11. The method of claim 9 further comprising the step of logging the action taken with the message.

12. A computer-readable medium having computer executable instructions for determining if a message is spam in a system having a plurality of anti-spam modules, the instructions comprising the steps of:

receiving a spam confidence level from each of a plurality of the plurality of anti-spam modules;

determining a highest spam confidence level;

comparing the highest spam confidence level to at least one threshold; and

invoking an action associated with the at least one threshold if the highest spam confidence level is greater than the at least one threshold.

13. The computer-readable medium of claim 12 having further computer-executable instructions for performing the step of applying a tuning factor to at least one spam confidence level to create at least one tuned spam confidence levels and wherein the step of determining a highest spam confidence level comprises the step of determining the highest of the at least one tuned spam confidence level and the spam confidence levels that had the tuning factor applied.

14. The computer-readable medium of claim 13 wherein the step of applying a tuning factor comprising tuning the at least one spam confidence level by a user'"'"'s confidence level in the anti-spam module associated with the at least one spam confidence level.

15. The computer-readable medium of claim 12 having further computer-executable instructions for performing the step of scaling each spam confidence level to a normalized range.

16. The computer-readable medium of claim 15 wherein the normalized range is 0 to 9.

17. The computer-readable medium of claim 12 having further computer-executable instructions for performing the step of adding the spam confidence level to the message.

18. The computer-readable medium of claim 12 wherein the at least one threshold comprises a plurality of thresholds including a top threshold and a bottom threshold, the computer-readable medium having further computer-executable instructions for performing the steps of:

comparing the highest spam confidence level to each of the plurality of thresholds;

determining if the highest spam confidence level is higher than at least one of the plurality of thresholds;

if the highest spam confidence level is higher than at least one of the plurality of thresholds;

determining which of the at least one of the plurality of thresholds is closest to the top threshold; and

invoking the action associated with the at least one of the plurality of thresholds that is closest to the top threshold.

19. The computer-readable medium of claim 12 wherein the step of invoking the action includes invoking one of deleting the message, sending a non-delivery notification, archiving the message, and passing the message to a client with the highest spam confidence level.

20. The computer-readable medium of claim 12 wherein the step of invoking the action includes:

dropping a connection if the highest spam confidence level exceeds a first threshold level;

returning a non-delivery message to a sender if the highest spam confidence level exceeds a second threshold level and is below the first threshold level;

delivering the message to a junk mail folder if the highest spam confidence level exceeds a third threshold level and is below the second threshold level.

21. The computer-readable medium of claim 20 wherein the first threshold is a ninety nine percent spam confidence level, the second threshold is a seventy percent spam confidence level, and the third threshold level is a forty percent spam confidence level.

22. The computer-readable medium of claim 20 having further computer-executable instructions for performing the steps of logging the action taken with the message.

23. The computer-readable medium of claim 12 having further computer-executable instructions for performing the steps of invoking the plurality of the plurality of anti-spam modules.

24. The computer-readable medium of claim 23 wherein the step of invoking the plurality of the plurality of anti-spam modules includes the step of providing a list of recipient addresses in the message.

25. The computer-readable medium of claim 12 having further computer executable instructions for performing the step comprising cracking an encoded content of the message.