System and method for managing e-mail message traffic

• US 20040199592A1
• Filed: 04/07/2003
• Published: 10/07/2004
• Est. Priority Date: 04/07/2003
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Inc. (Charter Communications Incorporated)
• Inventors: Gould, Kenneth, Chen, John Anthony
• Granted Patent: US 7,346,700 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method for managing e-mail traffic originating from a specific IP address. An outbound e-mail message is routed to an e-mail governor where the IP address of the computer from which outbound e-mail message originated is determined. A record associated with the originating IP address is created in a datatstore. Metrics useful to determine an e-mail message rate and an e-mail byte rate are stored in the e-mail record. An e-mail message rate is determined and compared with an e-mail message rate threshold. If the e-mail message rate threshold is exceeded, the originating IP address is sending spam e-mail (spam) and redial action is taken. An e-mail byte rate is also determined and compared with an e-mail byte rate threshold. If the e-mail byte rate threshold is exceeded, the originating IP address is using excess network resources to send e-mail and redial action is taken

Claims

1. A method for detecting the transmission of spam e-mail over a shared access network, the shared access network comprising one or more IP address records and one or more devices connected to the shared access network from which e-mail messages originate, wherein each of the one or more IP address records is uniquely associated with an IP address of one of the one or more devices, the method comprising:

receiving a proffered outbound e-mail message;

obtaining the IP address of an originating device connected to the shared access network from which the proffered outbound e-mail message originated (the “

originating IP address”

);

determining if the originating IP address matches one of the one or more device IP addresses associated with one of the one or more IP address records;

if the originating IP address matches one of the one or more device IP addresses associated with one of the one or more IP address records, calculating a message transmission rate for the originating IP address of the proffered outbound e-mail message and comparing the message transmission rate to a threshold message transmission rate; and

if the message transmission rate exceeds a threshold message transmission rate, identifying the proffered outbound e-mail message as a spam e-mail transmission.

2. The method for detecting the transmission of spam e-mail over a shared access network as in claim 1, wherein the originating device is a computer.

3. The method for detecting the transmission of spam e-mail over a shared access network as in claim 2, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

4. The method for detecting the transmission of spam e-mail over a shared access network as in claim 1, wherein the originating device is connected to the shared access network via a wired connection.

5. The method for detecting the transmission of spam e-mail over a shared access network as in claim 1, wherein the originating device is connected to the shared access network via a wireless connection.

6. The method for detecting the transmission of spam e-mail over a shared access network as in claim 1 further comprising:

if the originating IP address does not match any of the one or more device IP addresses associated with one of the one or more IP address records, creating an IP address record associated with the IP address of the originating device wherein the IP address record of the originating device comprises a time when the IP address record was created and a message count of 1.

7. The method for detecting the transmission of spam e-mail over a shared access network as in claim 1, wherein the IP address record associated with the device connected to the shared access network from which e-mail messages originate comprises:

a message count; and

a time when the IP address record was created; and

wherein calculating a message transmission rate for the originating IP address of the proffered outbound e-mail comprises;

timestamping the proffered outbound e-mail message;

incrementing the message count by 1; and

calculating a message transmission rate by dividing the message count by the difference between the proffered outbound e-mail timestamp and the time the IP address record was created.

8. The method for detecting the transmission of spam e-mail over a shared access network as in claim 7, wherein the method further comprises taking remedial action.

9. The method for detecting the transmission of spam e-mail over a shared access network of claim 8, wherein remedial action comprises discarding the proffered outbound e-mail, delaying the transmission of the proffered outbound e-mail, and sending a warning to the computer from which the proffered outbound e-mail message originated.

10. The method for detecting the transmission of spam e-mail over a shared access network as in claim 1, wherein the shared access network further comprises a clock and wherein the IP address of an originating device connected to the shared access network from which the proffered outbound e-mail message originated:

a message count; and

an elapsed time; and

wherein calculating a message transmission rate for the originating IP address of the proffered outbound e-mail comprises;

incrementing the message count by 1;

making a determination whether the elapsed time is equal to or greater than a time interval; and

if the elapsed time is equal to or greater than a time interval, setting the message transmission rate equal to the message count and setting the elapsed time and the message count to zero.

11. The method for detecting the transmission of spam e-mail over a shared access network as in claim 10 further comprising:

if the originating IP address does not match any of the one or more device IP addresses associated with one of the one or more IP address records, creating an IP record associated with the IP address of the originating device wherein the IP address record of the originating device comprises an elapsed time and a message count of 1.

12. The method for detecting the transmission of spam e-mail over a shared access network as in claim 10, wherein the method further comprises taking remedial action.

13. The method for detecting the transmission of spam e-mail over a shared access network of claim 12, wherein remedial action comprises discarding the proffered outbound e-mail, delaying the transmission of the proffered outbound e-mail, and sending a warning to the computer from which the proffered outbound e-mail message originated.

14. A method for detecting the consumption of excess network resources to send e-mail over a shared access network, the shared access network comprising one or more IP address records and one or more devices connected to the shared access network from which e-mail messages originate, wherein each of the one or more IP address records is uniquely associated with an IP address of one of the one or more devices, the method comprising:

receiving a proffered outbound e-mail message;

obtaining the IP address of an originating device connected to the shared access network from which the proffered outbound e-mail message originated (the “

originating IP address”

);

determining if the originating IP address matches one of the one or more device IP addresses associated with one of the one or more IP address records;

if the originating IP address matches one of the one or more IP addresses associated with one of the one or more IP address records, calculating a message size rate for the originating IP address of the proffered outbound e-mail and comparing the message size rate to a threshold message size rate; and

if the message byte rate exceeds a threshold message byte rate, identifying the originating IP address of the proffered outbound e-mail as an excess resource consumer.

15. The method for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 14, wherein the originating device is a computer.

16. The method for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 15, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

17. The method for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 14, wherein the originating device is connected to the shared access network via a wired connection.

18. The method for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 14, wherein the originating device is connected to the shared access network via a wireless connection.

19. The method for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 14 further comprising:

if the originating IP address of the proffered outbound e-mail message does not match any of the one or more device IP addresses associated with one of the one or more IP address records, creating an IP address record associated with the IP address of the originating device wherein the IP address record of the originating device comprises the time the IP address record was created and a cumulative e-mail message size equal to the size of the proffered outbound e-mail message.

20. The method for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 14, wherein the IP address of an originating device comprises:

a cumulative e-mail message size; and

a time when the IP address record was created; and

wherein calculating a message size rate for the originating IP address of the proffered outbound e-mail comprises;

timestamping the proffered outbound e-mail message;

adding the proffered outbound e-mail message size to the cumulative email message size; and

calculating a size rate by dividing the cumulative e-mail message size by the difference between the proffered outbound e-mail timestamp and the time the IP address record was created.

21. The method for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 19, wherein the method further comprises taking remedial action.

22. The method for detecting the consumption of excess network resources to send e-mail over a shared access network of claim 21, wherein remedial action comprises discarding the proffered outbound e-mail, delaying the transmission of the proffered outbound e-mail, and sending a warning to the computer from which the proffered outbound e-mail message originated.

23. The method for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 14, wherein the shared access network further comprises a clock and the IP address of an originating device comprises:

a cumulative message size; and

an elapsed time; and

wherein calculating a message size rate for the originating IP address of the proffered outbound e-mail comprises;

adding the proffered outbound e-mail message size to the cumulative email message size;

making a determination whether the elapsed time is equal to or greater than a time interval; and

if the elapsed time is equal to or greater than a time interval, setting the message size rate equal to the message count and setting the elapsed time and the cumulative message size to zero.

24. The method for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 23 further comprising:

if the originating IP address does not match any of the one or more device IP addresses associated with one of the one or more IP address records, creating an IP record associated with the IP address of the originating device wherein the IP address record of the originating device comprises an elapsed time and a cumulative e-mail message size equal to the size of the proffered outbound e-mail message.

25. The method for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 23, wherein the method further comprises taking remedial action.

26. The method for detecting the consumption of excess network resources to send e-mail over a shared access network of claim 25, wherein remedial action comprises discarding the proffered outbound e-mail, delaying the transmission of the proffered outbound e-mail, and sending a warning to the computer from which the proffered outbound e-mail message originated.

27. A method for managing e-mail traffic over a shared access network, the method comprising:

receiving a proffered outbound e-mail message;

obtaining the IP address of an originating device connected to the shared access network from which the proffered outbound e-mail message originated (the “

originating IP address”

);

if the originating IP address does not match a device IP address in an IP address record, creating an IP address record associated with the IP address of the originating device.

28. The method for managing e-mail traffic over a shared access network of claim 27, wherein the IP address record comprises the timestamp of the proffered outbound e-mail message and a message count of 1.

29. The method for managing e-mail traffic over a shared access network of claim 27, wherein the shared access network further comprises a clock and the IP address record comprises an elapsed time and a message count of 1.

30. The method for managing e-mail traffic over a shared access network of claim 27, wherein the IP address record comprises the timestamp of the proffered outbound e-mail message and a cumulative e-mail message size equal to the size of the proffered outbound e-mail message.

31. The method for managing e-mail traffic over a shared access network of claim 27, wherein the shared access network further comprises a clock and the IP address record comprises an elapsed time and a cumulative e-mail message size equal to the size of the proffered outbound e-mail message.

32. A system for the identifying the transmission of spam e-mail over a shared access network, the system comprising:

a network interface adapted to receive an IP message;

a router adapted to;

receive the IP message from the network interface;

identify a proffered outbound e-mail message; and

direct the proffered outbound e-mail message to an e-mail governor; and

one or more devices connected to the shared access network from which e-mail messages originate;

one or more IP address records wherein each of the one or more IP address records is uniquely associated with an IP address of one of the one or more devices, and wherein the IP address record comprises;

a time when the IP address record was created; and

a message count; and

an e-mail governor adapted to;

receive the proffered outbound e-mail message;

obtain the IP address of an originating device connected to the shared access network from which the proffered outbound e-mail message originated (the “

originating IP address”

);

determine if the originating IP address matches one of the one or more device IP addresses associated with one of the one or more IP address records;

if the originating IP address does not match any of the one or more device IP addresses associated with one of the one or more IP address records;

create an IP record associated with the IP address of the originating device;

store the time the IP address record was created in the IP address record; and

set the message count in the IP address record to 1;

if the originating IP address matches one of the one or more device IP addresses associated with one of the one or more IP address records;

timestamp the proffered outbound e-mail message;

increment the message count by one;

calculate a message transmission rate by dividing the message count by the difference between the proffered outbound e-mail timestamp and the time the IP record was created;

compare the message transmission rate to a threshold message transmission rate; and

if the message transmission rate exceeds a threshold message transmission rate, identify the proffered message as a spam e-mail transmission.

33. The system for the identifying the transmission of spam e-mail over a shared access network as in claim 32, wherein the originating device is a computer.

34. The system for the identifying the transmission of spam e-mail over a shared access network as in claim 33, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

35. The system for the identifying the transmission of spam e-mail over a shared access network as in claim 32, wherein the originating device is connected to the shared access network via a wired connection.

36. The system for the identifying the transmission of spam e-mail over a shared access network as in claim 32, wherein the originating device is connected to the shared access network via a wireless connection.

37. The system for the identifying the transmission of spam e-mail over a shared access network as in claim 32, wherein the system further comprises taking remedial action.

38. The system for the identifying the transmission of spam e-mail over a shared access network of claim 37, wherein remedial action comprises discarding the proffered outbound e-mail, delaying the transmission of the proffered outbound e-mail, and sending a warning to the computer from which the proffered outbound e-mail message originated.

45. The system for the identifying the transmission of spam e-mail over a shared access network as in claim 37, wherein remedial action comprises discarding the proffered outbound e-mail, delaying the transmission of the proffered outbound e-mail, and sending a warning to the computer from which the proffered outbound e-mail message originated.

39. A system for the identifying the transmission of spam e-mail over a shared access network, the system comprising:

a network interface adapted to receive an IP message;

a router adapted to;

receive the IP message from the network interface;

identify a proffered outbound e-mail message; and

direct the proffered outbound e-mail message to an e-mail governor; and

one or more devices connected to the shared access network from which e-mail messages originate;

one or more IP address records wherein each of the one or more IP address records is uniquely associated with an IP address of one of the one or more devices, and wherein the IP address record comprises;

a time interval; and

a message count; and

an e-mail governor adapted to;

measure time interval;

receive the proffered outbound e-mail message;

obtain the IP address of an originating device connected to the shared access network from which the proffered outbound e-mail message originated (the “

originating IP address”

);

determine if the originating IP address matches one of the one or more device IP addresses associated with one of the one or more IP address records;

if the originating IP address does not match any of the one or more device IP addresses associated with one of the one or more IP address records;

create an IP record associated with the IP address of the originating device;

set the message count in the IP address record to 1;

if the originating IP address matches one of the one or more device IP addresses associated with one of the one or more IP address records;

increment the message count by one,

determine if the lapsed time equals or exceeds the time interval;

if the elapsed time is equal to or greater than the time interval, setting the message transmission rate equal to the message count and setting the elapsed time and the message count to zero;

compare the message transmission rate to a threshold message transmission rate; and

if the message transmission rate exceeds a threshold message transmission rate, identify the proffered outbound e-mail message as a spam e-mail transmission.

40. The system for the identifying the transmission of spam e-mail over a shared access network as in claim 39, wherein the originating device is a computer.

41. The system for the identifying the transmission of spam e-mail over a shared access network as in claim 40, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

42. The system for the identifying the transmission of spam e-mail over a shared access network as in claim 39, wherein the originating device is connected to the shared access network via a wired connection.

43. The system for the identifying the transmission of spam e-mail over a shared access network as in claim 39, wherein the originating device is connected to the shared access network via a wireless connection.

44. The system for the identifying the transmission of spam e-mail over a shared access network as in claim 39, wherein the system further comprises taking remedial action.

46. A system for detecting the consumption of excess network resources to send e-mail over a shared access network, the system comprising:

a network interface adapted to receive an IP message;

a router adapted to;

receive the IP message from the network interface;

identify an outbound e-mail message; and

direct the outbound e-mail message to an e-mail governor; and

one or more devices connected to the shared access network from which e-mail messages originate;

one or more IP address records wherein each of the one or more IP address records is uniquely associated with an IP address of one of the one or more devices, and wherein the IP address record comprises;

a time when the IP address record was created; and

a cumulative message size; and

an e-mail governor adapted to;

receive the proffered outbound e-mail message;

obtain the IP address of an originating device connected to the shared access network from which the proffered outbound e-mail message originated (the “

originating IP address”

);

determine if the originating IP address matches one of the one or more device IP addresses associated with one of the one or more IP address records;

if the originating IP address does not match any of the one or more device IP addresses associated with one of the one or more IP address records;

create an IP record associated with the IP address of the originating device;

store the time the IP address record was created in the IP address record; and

set the cumulative message size in the IP address record to the size of the proffered outbound e-mail message;

if the originating IP address matches one of the one or more device IP addresses associated with one of the one or more IP address records;

timestamp the proffered outbound e-mail message,

add the size of the proffered outbound e-mail message to the cumulative message size;

calculate a message size rate by dividing the cumulative message size by the difference between the proffered outbound e-mail timestamp and the time the IP address record was created;

compare the message size rate to a threshold message size rate; and

if the message size rate exceeds a threshold message size rate, identify the originating IP address of the proffered outbound e-mail as an excess resource consumer.

47. The system for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 46, wherein the originating device is a computer.

48. The system for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 47, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

49. The system for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 46, wherein the originating device is connected to the shared access network via a wired connection.

50. The system for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 46, wherein the originating device is connected to the shared access network via a wireless connection.

51. The system for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 46, wherein the system further comprises taking remedial action.

52. The system for detecting the consumption of excess network resources to send e-mail over a shared access network of claim 51, wherein remedial action comprises discarding the proffered outbound e-mail, delaying the transmission of the proffered outbound e-mail, and sending a warning to the computer from which the proffered outbound e-mail message originated.

53. A system for detecting the consumption of excess network resources to send e-mail over a shared access network, the system comprising:

a network interface adapted to receive an IP message;

a router adapted to;

receive the IP message from the network interface;

identify a proffered outbound e-mail message; and

direct the proffered outbound e-mail message to an e-mail governor; and

one or more devices connected to the shared access network from which e-mail messages originate;

one or more IP address records wherein each of the one or more IP address records is uniquely associated with an IP address of one of the one or more devices, and wherein the IP address record comprises;

a time interval; and

a cumulative message size; and

an e-mail governor adapted to;

measure the time interval;

receive the proffered outbound e-mail message;

obtain the IP address of an originating device connected to the shared access network from which the proffered outbound e-mail message originated (the “

originating IP address”

);

determine if the originating IP address matches one of the one or more device IP addresses associated with one of the one or more IP address records;

if the originating IP address does not match any of the one or more device IP addresses associated with one of the one or more IP address records;

create an IP record associated with the IP address of the originating device; and

set the cumulative message size in the IP address record to the size of the proffered outbound e-mail message;

if the originating IP address matches one of the one or more device IP addresses associated with one of the one or more IP address records;

determine if the lapsed time equals or exceeds the time interval;

if the elapsed time is equal to or greater than the time interval, set the message size rate equal to the cumulative message size and set the elapsed time and the cumulative message size to zero;

compare the message size rate to a threshold message size rate; and

if the message size rate exceeds a threshold message transmission rate, identify the proffered outbound e-mail message as a spam e-mail transmission.

54. The system for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 53, wherein the originating device is a computer.

55. The system for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 54, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

56. The system for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 54, wherein the originating device is connected to the shared access network via a wired connection.

57. The system for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 53, wherein the originating device is connected to the shared access network via a wireless connection.

58. The system for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 53, wherein the system further comprises taking remedial action.

59. The system for detecting the consumption of excess network resources to send e-mail over a shared access network as in claim 58, wherein remedial action comprises discarding the proffered outbound e-mail, delaying the transmission of the proffered outbound e-mail, and sending a warning to the computer from which the proffered outbound e-mail message originated.