Method for filtering e-mail messages

• US 20040177120A1
• Filed: 03/07/2003
• Published: 09/09/2004
• Est. Priority Date: 03/07/2003
• Status: Abandoned Application

• Current Assignee: Abaca Technology Corp. (Proofpoint Incorporated)
• Original Assignee: Abaca Technology Corp. (Proofpoint Incorporated)
• Inventors: Kirsch, Steven T.
• Application Number:
  US10/384,278
• Publication Number:
  US 20040177120A1
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method for filtering e-mail messages based on an identification of a true sender and assessing the reputation of the true sender among other users of an e-mail network. The true sender of a received e-mail message is identified in one embodiment by combining data in the e-mail message that is nearly impossible to forge with other information in the e-mail message. The reputation, or rating, of the true sender among other users in the e-mail network is then assessed by looking up the true sender in a database which maintains statistics, provided by the users in the network, on true senders. If the rating of a true sender exceeds some threshold set by the recipient, the message is passed on to the recipient. This method may work in combination with other e-mail filtering programs. An analogous method can be employed to detect e-mail messages having a computer virus sent via an attachment. The attachment is identified, for instance by computing a checksum value of the attachment or using the name of the attachment, and the reputation of the attachment, based on statistics sent by other e-mail users in the network, is assessed to determine whether the attachment contains a virus.

Claims

1. A method of processing a received e-mail message comprising:

a) identifying a true sender of the received e-mail message based on at least two data items in the message;

b) assessing a reputation of the true sender within a network of e-mail users; and

c) filtering the e-mail message based on the reputation of the true sender.

2. The method of claim 1 further comprising initially filtering the e-mail message using at least one recipient-created list of recognized senders and processing the message according to the recipient'"'"'s preferences if the sender of the message appears on at least one list of recognized senders.

3. The method of claim 1 wherein the reputation of the true sender is assessed by querying a database maintaining statistics about senders, the statistics obtained from the recipient and a plurality of other e-mail users in the network.

4. The method of claim 3 wherein the statistics include at least one of the following:

i) a number of e-mails the true sender has sent to users in the network;

ii) a date of the first e-mail sent by the true sender to a user in the network;

iii) a number of users in the network who have approved of receiving messages from the true sender;

iv) a number of users in the network who disapprove of receiving messages from the true sender;

v) a number of e-mail messages sent by the true sender to a spam trap;

vi) a number of unique users in the network to whom the true sender has sent messages;

vii) a number of unique users in the network to whom the true sender has sent at least one message over a first predetermined amount of time;

viii) a number of e-mail messages sent to users in the network over a second predetermined amount of time;

ix) a number of unique users in the network to whom the true sender has sent an e-mail message over a third predetermined amount of time, the users not having previously received a message from the true sender;

x) a number of e-mail messages sent by the true sender to users in the network for each determined interval of time over a course of a predetermined number of past time intervals;

xi) a number of unique users in the network to whom the true sender has sent messages over the course of the predetermined number of past intervals;

xii) a date of the last e-mail sent by the true sender;

xiii) a time of the last e-mail sent by the true sender;

xiv) an indication of whether the true sender previously has been determined to send junk e-mail;

xv) results of a proactive survey of a predetermined number of recent recipients of a message from the true sender, the survey asking the recipients to determine whether the true sender sent junk e-mail;

xvi) a number of e-mail addresses within the network to which the true sender has sent a message over a fourth predetermined amount of time where the sent message was bounced;

xvii) an indication of whether the true sender'"'"'s e-mail address accepts incoming e-mail;

xviii) an indication of whether the true sender has ever responded to a challenge e-mail;

xix) an indication of whether a component of the true sender'"'"'s e-mail message headers has been forged;

xx) an indication of whether the domain name of the true sender matches the domain name of the final IP address;

xxi) an indication of whether the content of a received message matches the content of an e-mail message caught in a spam trap;

xxii) an indication of whether the true sender is a subscriber in good standing to the e-mail filtering service;

xxiii) an indication of whether the true sender has ever registered on a special registration website;

xxiv) a number of unique users in the network who have sent e-mail messages to the true sender over a fifth predetermined amount of time;

xxv) a number of unique users in the network who have sent e-mail messages to the true sender;

xxvi) an indication of whether a rating entity considers the true sender to be a spammer;

xxvii) an indication of whether the rating entity does not consider the true sender to be a spammer;

xxviii) a number of e-mail messages users in the network have sent to the true sender; and

xxix) a number of unique users in the network who regularly send e-mail messages to the true sender.

5. The method of claim 3 further comprising a plurality of e-mail users in the network sending information about received e-mail messages to the database maintaining statistics about e-mail messages received within the network.

6. The method of claim 3 further comprising rating other users in the network so that the users'"'"' reputations are considered when using the users'"'"' statistics about the true sender to assess the reputation of the true sender.

7. The method of claim 1 further comprising filtering the e-mail message according to the reputation of the true sender based on a recipient'"'"'s preferences for handling e-mail messages.

8. The method of claim 7 wherein filtering the e-mail message includes sending it to the recipient.

9. The method of claim 7 wherein filtering the e-mail message includes deleting the e-mail message.

10. The method of claim 7 wherein filtering the e-mail message includes sending the e-mail message to a specific location.

11. The method of claim 1 wherein the true sender is identified by combining a full e-mail address or a base e-mail address of a sender and an IP address of a first network device used to send the e-mail message to a second network device trusted by a recipient of the message.

12. The method of claim 1 wherein the true sender is identified by combining a full e-mail address or a base e-mail address of a sender and a domain name corresponding to an IP address of a first network device used to send the e-mail message to a second network device trusted by a recipient of the message.

13. The method of claim 1 wherein the true sender is identified by combining a digital signature in the e-mail message with one of the following:

a) an IP address of a first network device used to send the e-mail message to a second network device trusted by a recipient of the message;

b) a full e-mail address of a sender;

c) a base e-mail address of the sender; and

d) a domain name associated with the first network device used to send the e-mail message to the second network device trusted by the recipient of the message.

14. The method of claim 1 further comprising encoding an identity of the true sender.

15. The method of claim 14 further comprising storing the encoded identity of the true sender in a database.

16. The method of claim 15 further comprising using the encoded identity of the true sender to assess the reputation of the true sender.

17. The method of claim 3 further comprising sending information to the database maintaining statistics about e-mail messages received within the network from a spam trap.

18. A computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method of processing a received e-mail message, the method comprising:

a) identifying a true sender of the received e-mail message based on at least two data items in the e-mail message;

b) assessing a reputation of the true sender within a network of e-mail users; and

c) filtering the e-mail message based on the reputation of the true sender.

19. The computer-readable storage medium of claim 18, the method further comprising initially filtering the e-mail message using at least one recipient-created list of recognized senders and processing the message according to the recipient'"'"'s preferences if the sender of the message appears on at least one list of recognized senders.

20. The computer-readable storage medium of claim 18 wherein the reputation of the true sender is assessed by querying a database maintaining statistics about senders, the statistics obtained from the recipient and a plurality of other e-mail users in the network.

21. The computer-readable storage medium of claim 19 wherein the statistics include at least one of the following:

i) a number of e-mails the true sender has sent to users in the network;

ii) a date of the first e-mail sent by the true sender to a user in the network;

iii) a number of users in the network who have approved of receiving messages from the true sender;

iv) a number of users in the network who disapprove of receiving messages from the true sender; and

v) a number of e-mail messages sent by the true sender to a spam trap;

vi) a number of unique users in the network to whom the true sender has sent messages;

vii) a number of unique users in the network to whom the true sender has sent at least one message over a first predetermined amount of time;

viii) a number of e-mail messages sent to users in the network over a second predetermined amount of time;

ix) a number of unique users in the network to whom the true sender has sent an e-mail message over a third predetermined amount of time, the users not having previously received a message from the true sender;

x) a number of e-mail messages sent by the true sender to users in the network for each determined interval of time over a course of a predetermined number of past time intervals;

xi) a number of unique users in the network to whom the true sender has sent messages over the course of the predetermined number of past intervals;

xii) a date of the last e-mail sent by the true sender;

xiii) a time of the last e-mail sent by the true sender;

xiv) an indication of whether the true sender previously has been determined to send junk e-mail;

xv) results of a proactive survey of a predetermined number of recent recipients of a message from the true sender, the survey asking the recipients to determine whether the true sender sent junk e-mail;

xvi) a number of e-mail addresses within the network to which the true sender has sent a message over a fourth predetermined amount of time where the sent message was bounced;

xvii) an indication of whether the true sender'"'"'s e-mail address accepts incoming e-mail;

xviii) an indication of whether the true sender has ever responded to a challenge e-mail;

xix) an indication of whether a component of the true sender'"'"'s e-mail message headers has been forged;

xx) an indication of whether the domain name of the true sender matches the domain name of the final IP address;

xxi) an indication of whether the content of a received message matches the content of an e-mail message caught in a spam trap;

xxii) an indication of whether the true sender is a subscriber in good standing to the e-mail filtering service;

xxiii) an indication of whether the true sender has ever registered on a special registration website;

xxiv) a number of unique users in the network who have sent e-mail messages to the true sender over a fifth predetermined amount of time;

xxv) a number of unique users in the network who have sent e-mail messages to the true sender;

xxvi) an indication of whether a rating entity considers the true sender to be a spammer;

xxvii) an indication of whether the rating entity does not consider the true sender to be a spammer;

xxviii) a number of e-mail messages users in the network have sent to the true sender; and

xxix) a number of unique users in the network who regularly send e-mail messages to the true sender.

22. The computer-readable storage medium of claim 20, the method further comprising a plurality of e-mail users in the network sending information about received e-mail messages to the database maintaining statistics about e-mail messages received within the network.

23. The computer-readable storage medium of claim 20, the method further comprising rating other users in the network so that the users'"'"' reputations are considered when using the users'"'"' statistics about the true sender to assess the reputation of the true sender.

24. The computer-readable storage medium of claim 18, the method further comprising filtering the e-mail message according to the reputation of the true sender based on a recipient'"'"'s preferences for handling e-mail messages.

25. The computer-readable storage medium of claim 24 wherein filtering the e-mail message includes sending it to the recipient.

26. The computer-readable storage medium of claim 24 wherein filtering the e-mail message includes deleting the e-mail message.

27. The computer-readable storage medium of claim 24 wherein filtering the e-mail message includes sending the e-mail message to a specific location.

28. The computer-readable storage medium of claim 18 wherein the true sender is identified by combining a full e-mail address or a base e-mail address of a sender and an IP address of a first network device used to send the e-mail message to a second network device trusted by a recipient of the message.

29. The computer-readable storage medium of claim 18 wherein the true sender is identified by combining a full e-mail address or a base e-mail address of a sender and a domain name corresponding to an IP address of a first network device used to send the e-mail message to a second network device trusted by a recipient of the message.

30. The computer-readable storage medium of claim 18 wherein the true sender is identified by combining a digital signature in the e-mail message with one of the following:

a) an IP address of a first network device used to send the e-mail message to a second network device trusted by a recipient of the message;

b) a full e-mail address of a sender; and

c) a base e-mail address of the sender; and

d) a domain name associated with the first network device used to send the e-mail message to the second network device trusted by the recipient of the message.

31. The computer-readable storage medium of claim 18, the method further comprising encoding an identification of the true sender.

32. The computer-readable storage medium of claim 31, the method further comprising storing the encoded identification of the true sender in a database.

33. The computer-readable storage medium of claim 32, the method further comprising using the encoded identification of the true sender to assess the reputation of the true sender.

34. The computer-readable storage medium of claim 20, the method further comprising sending information to the database maintaining statistics about e-mail messages received within the network from a spam trap.

35. A method of processing a received e-mail message comprising:

a) filtering the e-mail message using at least one recipient-created list of recognized senders; and

b) disposing of the message according to a recipient'"'"'s preferences if the sender appears on the at least one recipient-created list, otherwise identifying a true sender of the message based on at least two data items in the e-mail message and filtering the message according to a reputation of the true sender within a network of other e-mail users.

36. The method of claim 35 further comprising assessing the reputation of the true sender within the network of other e-mail users.

37. The method of claim 35 wherein the reputation of the true sender is assessed by querying a database maintaining statistics about senders, the statistics obtained from the recipient and a plurality of other e-mail users in the network.

38. The method of claim 37 wherein the statistics including at least one of the following:

i) a number of e-mails the true sender has sent to users in the network;

ii) a date of the first e-mail sent by the true sender to a user in the network;

iii) a number of users in the network who have approved of receiving messages from the true sender;

iv) a number of users in the network who disapprove of receiving messages from the true sender; and

v) a number of e-mail messages sent by the true sender to a spam trap;

vi) a number of unique users in the network to whom the true sender has sent messages;

vii) a number of unique users in the network to whom the true sender has sent at least one message over a first predetermined amount of time;

viii) a number of e-mail messages sent to users in the network over a second predetermined amount of time;

ix) a number of unique users in the network to whom the true sender has sent an e-mail message over a third predetermined amount of time, the users not having previously received a message from the true sender;

x) a number of e-mail messages sent by the true sender to users in the network for each determined interval of time over a course of a predetermined number of past time intervals;

xi) a number of unique users in the network to whom the true sender has sent messages over the course of the predetermined number of past intervals;

xii) a date of the last e-mail sent by the true sender;

xiii) a time of the last e-mail sent by the true sender;

xiv) an indication of whether the true sender previously has been determined to send junk e-mail;

xv) results of a proactive survey of a predetermined number of recent recipients of a message from the true sender, the survey asking the recipients to determine whether the true sender sent junk e-mail;

xvi) a number of e-mail addresses within the network to which the true sender has sent a message over a fourth predetermined amount of time where the sent message was bounced;

xvii) an indication of whether the true sender'"'"'s e-mail address accepts incoming e-mail;

xviii) an indication of whether the true sender has ever responded to a challenge e-mail;

xix) an indication of whether a component of the true sender'"'"'s e-mail message header has been forged;

xx) an indication of whether the domain name of the true sender matches the domain name of the final IP address;

xxi) an indication of whether the content of a received message matches the content of an e-mail message caught in a spam trap;

xxii) an indication of whether the true sender is a subscriber in good standing to the e-mail filtering service;

xxiii) an indication of whether the true sender has ever registered on a special registration website;

xxiv) a number of unique users in the network who have sent e-mail messages to the true sender over a fifth predetermined amount of time;

xxv) a number of unique users in the network who have sent e-mail messages to the true sender;

xxvi) an indication of whether a rating entity considers the true sender to be a spammer;

xxvii) an indication of whether the rating entity does not consider the true sender to be a spammer;

xxviii) a number of e-mail messages users in the network have sent to the true sender.

39. The method of claim 37 further comprising a plurality of e-mail users in the network sending information about received e-mail messages to the database maintaining statistics about e-mail messages received within the network.

40. The method of claim 37 further comprising rating other users in the network so that the users'"'"' reputations are considered when using the users'"'"' statistics about the true sender to assess the reputation of the true sender.

41. The method of claim 35 further comprising filtering the e-mail message according to the reputation of the true sender based on the recipient'"'"'s preferences for handling e-mail messages.

42. The method of claim 41 wherein filtering the e-mail message includes sending it to the recipient.

43. The method of claim 41 wherein filtering the e-mail message includes deleting the e-mail message.

44. The method of claim 41 wherein filtering the e-mail message includes sending the e-mail message to a specific location.

45. The method of claim 35 wherein the true sender is identified by combining a full e-mail address or a base e-mail address of a sender and an IP address of a first network device used to send the e-mail message to a second network device trusted by the recipient of the message.

46. The method of claim 35 wherein the true sender is identified by combining a full e-mail address or base e-mail address of a sender and a domain name corresponding to an IP address of a first network device used to send the e-mail message to a second network device trusted by a recipient of the message.

47. The method of claim 35 wherein the true sender is identified by combining a digital signature in the e-mail message with one of the following:

a) an IP address of a first network device used to send the e-mail message to a second network device trusted by a recipient of the message;

b) a full e-mail address of a sender; and

c) a base e-mail address of the sender; and

d) a domain name associated with the first network device used to send the e-mail message to the second network device trusted by the recipient of the message.

48. The method of claim 35 further comprising encoding an identification of the true sender.

49. The method of claim 48 further comprising storing the encoded identification of the true sender in the database.

50. The method of claim 49 further comprising using the encoded identification of the true sender to assess the reputation of the true sender.

51. The method of claim 37 further comprising sending information to the database maintaining statistics about e-mail messages received within the network from a spam trap.

52. A method of processing a received e-mail message comprising:

a) identifying a true sender of the received e-mail message based on at least a digital signature in the message;

b) assessing a reputation of the true sender within a network of e-mail users; and

c) filtering the e-mail message based on the reputation of the true sender.

53. The method of claim 52 further comprising initially filtering the e-mail message using at least one recipient-created list of recognized senders and processing the message according to the recipient'"'"'s preferences if the sender of the message appears on at least one list of recognized senders.

54. The method of claim 52 wherein the reputation of the true sender is assessed by querying a database maintaining statistics about senders, the statistics obtained from the recipient and a plurality of other e-mail users in the network.

55. The method of claim 54 wherein the statistics include at least one of the following:

i) a number of e-mails the true sender has sent to users in the network;

ii) a date of the first e-mail sent by the true sender to a user in the network;

iii) a number of users in the network who have approved of receiving messages from the true sender;

iv) a number of users in the network who disapprove of receiving messages from the true sender;

v) a number of e-mail messages sent by the true sender to a spam trap;

vi) a number of unique users in the network to whom the true sender has sent messages;

vii) a number of unique users in the network to whom the true sender has sent at least one message over a first predetermined amount of time;

viii) a number of e-mail messages sent to users in the network over a second predetermined amount of time;

ix) a number of unique users in the network to whom the true sender has sent an e-mail message over a third predetermined amount of time, the users not having previously received a message from the true sender;

x) a number of e-mail messages sent by the true sender to users in the network for each determined interval of time over a course of a predetermined number of past time intervals;

xi) a number of unique users in the network to whom the true sender has sent messages over the course of the predetermined number of past intervals;

xii) a date of the last e-mail sent by the true sender;

xiii) a time of the last e-mail sent by the true sender;

xiv) an indication of whether the true sender previously has been determined to send junk e-mail;

xv) results of a proactive survey of a predetermined number of recent recipients of a message from the true sender, the survey asking the recipients to determine whether the true sender sent junk e-mail;

xvi) a number of e-mail addresses within the network to which the true sender has sent a message over a fourth predetermined amount of time where the sent message was bounced;

xvii) an indication of whether the true sender'"'"'s e-mail address accepts incoming e-mail;

xviii) an indication of whether the true sender has ever responded to a challenge e-mail;

xix) an indication of whether a component of the true sender'"'"'s e-mail message headers has been forged;

xx) an indication of whether the domain name of the true sender matches the domain name of the final IP address;

xxi) an indication of whether the content of a received message matches the content of an e-mail message caught in a spam trap;

xxii) an indication of whether the true sender is a subscriber in good standing to the e-mail filtering service;

xxiii) an indication of whether the true sender has ever registered on a special registration website;

xxiv) a number of unique users in the network who have sent e-mail messages to the true sender over a fifth predetermined amount of time;

xxv) a number of unique users in the network who have sent e-mail messages to the true sender;

xxvi) an indication of whether a rating entity considers the true sender to be a spammer;

xxvii) an indication of whether the rating entity does not consider the true sender to be a spammer;

xxviii) a number of e-mail messages users in the network have sent to the true sender; and

xxix) a number of unique users in the network who regularly send e-mail messages to the true sender.

56. The method of claim 54 further comprising a plurality of e-mail users in the network sending information about received e-mail messages to the database maintaining statistics about e-mail messages received within the network.

57. The method of claim 54 further comprising rating other users in the network so that the users'"'"' reputations are considered when using the users'"'"' statistics about the true sender to assess the reputation of the true sender.

58. The method of claim 52 further comprising filtering the e-mail message according to the reputation of the true sender based on a recipient'"'"'s preferences for handling e-mail messages.

59. The method of claim 58 wherein filtering the e-mail message includes sending it to the recipient.

60. The method of claim 58 wherein filtering the e-mail message includes deleting the e-mail message.

61. The method of claim 58 wherein filtering the e-mail message includes sending the e-mail message to a specific location.

62. The method of claim 52 wherein the true sender is identified by combining a digital signature in the e-mail message with one of the following:

a) an IP address of a first network device used to send the e-mail message to a second network device trusted by a recipient of the message;

b) a full e-mail address of a sender;

c) a base e-mail address of the sender; and

d) a domain name associated with the IP address of the first network device used to send the e-mail message to the second network device trusted by the recipient of the message.

63. The method of claim 52 further comprising encoding an identity of the true sender.

64. The method of claim 63 further comprising storing the encoded identity of the true sender in a database.

65. The method of claim 64 further comprising using the encoded identity of the true sender to assess the reputation of the true sender.

66. The method of claim 54 further comprising sending information to the database maintaining statistics about e-mail messages received within the network from a spam trap.

76. The computer-readable storage medium of claim 66, the method further comprising identifying the true sender by combining a digital signature in the e-mail message with one of the following:

a) an IP address of a first network device used to send the e-mail message to a second network device trusted by a recipient of the message;

b) a full e-mail address of a sender;

c) a base e-mail address of the sender; and

d) a domain name corresponding to the IP address of a first network device used to send the e-mail message to a second network device trusted by the recipient of the message.

67. A computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method of processing a received e-mail message, the method comprising:

a) identifying a true sender of the received e-mail message based on at least a digital signature in the message;

b) assessing a reputation of the true sender within a network of e-mail users; and

c) filtering the e-mail message based on the reputation of the true sender.

68. The computer-readable storage medium of claim 67, the method further comprising initially filtering the e-mail message using at least one recipient-created list of recognized senders and processing the message according to the recipient'"'"'s preferences if the sender of the message appears on at least one list of recognized senders.

69. The computer-readable storage medium of claim 67 wherein the reputation of the true sender is assessed by querying a database maintaining statistics about senders, the statistics obtained from the recipient and a plurality of other e-mail users in the network.

70. The computer-readable storage medium of claim 69 wherein the statistics include at least one of the following:

i) a number of e-mails the true sender has sent to users in the network;

ii) a date of the first e-mail sent by the true sender to a user in the network;

iii) a number of users in the network who have approved of receiving messages from the true sender;

iv) a number of users in the network who disapprove of receiving messages from the true sender; and

v) a number of e-mail messages sent by the true sender to a spam trap;

vi) a number of unique users in the network to whom the true sender has sent messages;

vii) a number of unique users in the network to whom the true sender has sent at least one message over a first predetermined amount of time;

viii) a number of e-mail messages sent to users in the network over a second predetermined amount of time;

ix) a number of unique users in the network to whom the true sender has sent an e-mail message over a third predetermined amount of time, the users not having previously received a message from the true sender;

x) a number of e-mail messages sent by the true sender to users in the network for each determined interval of time over a course of a predetermined number of past time intervals;

xi) a number of unique users in the network to whom the true sender has sent messages over the course of the predetermined number of past intervals;

xii) a date of the last e-mail sent by the true sender;

xiii) a time of the last e-mail sent by the true sender;

xiv) an indication of whether the true sender previously has been determined to send junk e-mail;

xv) results of a proactive survey of a predetermined number of recent recipients of a message from the true sender, the survey asking the recipients to determine whether the true sender sent junk e-mail;

xvi) a number of e-mail addresses within the network to which the true sender has sent a message over a fourth predetermined amount of time where the sent message was bounced;

xvii) an indication of whether the true sender'"'"'s e-mail address accepts incoming e-mail;

xviii) an indication of whether the true sender has ever responded to a challenge e-mail;

xix) an indication of whether a component of the true sender'"'"'s e-mail message headers has been forged;

xx) an indication of whether the domain name of the true sender matches the domain name of the final IP address;

xxi) an indication of whether the content of a received message matches the content of an e-mail message caught in a spam trap;

xxii) an indication of whether the true sender is a subscriber in good standing to the e-mail filtering service;

xxiii) an indication of whether the true sender has ever registered on a special registration website;

xxiv) a number of unique users in the network who have sent e-mail messages to the true sender over a fifth predetermined amount of time;

xxv) a number of unique users in the network who have sent e-mail messages to the true sender;

xxvi) an indication of whether a rating entity considers the true sender to be a spammer;

xxvii) an indication of whether the rating entity does not consider the true sender to be a spammer;

xxviii) a number of e-mail messages users in the network have sent to the true sender; and

xxix) a number of unique users in the network who regularly send e-mail messages to the true sender.

71. The computer-readable storage medium of claim 69, the method further comprising a plurality of e-mail users in the network sending information about received e-mail messages to the database maintaining statistics about e-mail messages received within the network.

72. The computer-readable storage medium of claim 69, the method further comprising rating other users in the network so that the users'"'"' reputations are considered when using the users'"'"' statistics about the true sender to assess the reputation of the true sender.

73. The computer-readable storage medium of claim 67, the method further comprising filtering the e-mail message according to the reputation of the true sender based on a recipient'"'"'s preferences for handling e-mail messages.

74. The computer-readable storage medium of claim 73 wherein filtering the e-mail message includes sending it to the recipient.

75. The computer-readable storage medium of claim 73 wherein filtering the e-mail message includes deleting the e-mail message.

77. The computer-readable storage medium of claim 67, the method further comprising encoding an identification of the true sender.

78. The computer-readable storage medium of claim 77, the method further comprising storing the encoded identification of the true sender in a database.

79. The computer-readable storage medium of claim 78, the method further comprising using the encoded identity of the true sender to assess the reputation of the true sender.

80. The computer-readable storage medium of claim 67, the method further comprising sending information to the database maintaining statistics about e-mail messages received within the network from a spam trap.

81. A method of processing a received e-mail message having an attachment comprising:

a) identifying an attachment of the received e-mail message;

b) assessing a reputation of the identified attachment within a network of e-mail users; and

c) filtering the e-mail message-based on the reputation of the identified attachment.

82. The method of claim 81 wherein the reputation of the identified attachment is assessed by querying a database maintaining statistics about attachments and senders, the statistics obtained from the recipient and a plurality of other e-mail users in the network.

83. The method of claim 82 wherein the statistics include at least one of the following:

a) a number of unique senders of a message with an attachment having a particular checksum value over a first predetermined period of time;

b) a number of unique senders of a message with an attachment having a particular name over a second predetermined period of time;

c) an average number of messages per sender over a third predetermined period of time;

d) a rate of growth of a number of messages in the network with an attachment having a particular checksum value;

e) a rate of growth of a number of messages in the network with an attachment having a particular name;

f) a rate of growth of a number of unique senders sending messages having an attachment with a particular checksum value; and

g) a rate of growth of a number of unique senders sending messages having an attachment with a particular name.

84. The method of claim 81 further comprising filtering the e-mail message based on a recipient'"'"'s preferences for handling e-mail messages.

85. The method of claim 84 wherein filtering the e-mail message includes deleting the e-mail message.

86. The method of claim 81 wherein identifying the attachment includes calculating a checksum value of the attachment.

87. The method of claim 81 wherein identifying the attachment includes using a name of the attachment.

88. A computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method of processing a received e-mail message having an attachment, the method comprising:

a) identifying an attachment of the received e-mail message;

b) assessing a reputation of the identified attachment within a network of e-mail users; and

c) filtering the e-mail message based on the reputation of the identified attachment.

89. The computer-readable storage medium of claim 88 wherein the reputation of the identified attachment is assessed by querying a database maintaining statistics about attachments and senders, the statistics obtained from the recipient and a plurality of other e-mail users in the network.

90. The computer-readable storage medium of claim 89 wherein the statistics include at least one of the following:

a) a number of unique senders of a message with an attachment having a particular checksum value over a first predetermined period of time;

b) a number of unique'"'"'senders of a message with an attachment having a particular name over a second predetermined period of time;

c) an average number of messages sent per sender over a third predetermined period of time;

d) a rate of growth of a number of messages in the network with an attachment having a particular checksum value;

e) a rate of growth of a number of messages in the network with an attachment having a particular name;

f) a rate of growth of a number of unique senders sending messages having an attachment with a particular checksum value; and

g) a rate of growth of a number of unique senders sending messages having an attachment with a particular name.

91. The computer-readable storage medium of claim 89, the method further comprising filtering the e-mail message based on a recipient'"'"'s preferences for handling e-mail messages.

92. The computer-readable storage medium of claim 91 wherein filtering the e-mail message includes deleting the e-mail message.

93. The computer-readable storage medium of claim 88 wherein identifying the attachment includes calculating a checksum value of the attachment.

94. The computer-readable storage medium of claim 88 wherein identifying the attachment includes using a name of the attachment.