Mail server probability spam filter

• US 20040210640A1
• Filed: 04/17/2003
• Published: 10/21/2004
• Est. Priority Date: 04/17/2003
• Status: Active Grant

• Current Assignee: Go Daddy Operating Company LLC (GoDaddy, Inc.)
• Original Assignee: Go Daddy Group Incorporated (GoDaddy, Inc.)
• Inventors: Sink, Adam Thomas, Schwendiman, Blake, Chadwick, Michael Christopher
• Granted Patent: US 7,320,020 B2
• Time in Patent Office: Days
• US Class Current: 709/207
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Email senders may transmit emails over the internet to a mail server that handles emails for a plurality of users (clients). The mail server may use a spam filter to remove the spam and then transmit the filtered emails to the addressed clients. The spam filter may use a white list, black list, probability filter and keyword filter. The probability filter may use a user mail corpus and a user spam corpus for creating a user probability table that lists tokens and the probability that an email is a spam if the email contains the token. The probability filter may also use a general mail corpus and a general spam corpus for creating a general probability table that. Tokens of incoming emails may be searched for in the user probability table, and if not found, the general probability table to calculate the probability that the email is a spam.

Claims

1. A system for filtering spam emails from a stream of emails, comprising:

A) a mail server;

B) a spam filter residing on the mail sever; and

C) an internet interface for receiving emails from a sender and for transmitting emails to a client.

2. The system of claim 1, wherein the spam filter comprises:

a) a white filter;

b) a black filter; and

c) a probability filter.

3. The system of claim 2, wherein the probability filter uses a user probability table and a general probability table.

4. The system of claim 3, wherein the user probability table and the general probability table learn from each email in the stream of emails passed through the system.

5. A process for filtering spam emails from a stream of emails, comprising the steps of:

A) receiving a stream of emails into a mail server from a plurality of third parties;

B) filtering out the spam from the stream of emails with a spam filter; and

C) transmitting the stream of filtered emails to a plurality of clients.

6. The process of claim 5, wherein the filtering out the spam, further comprises the steps of”

a) using a white filter;

b) using a black filter; and

c) using a probability filter.

7. The process of claim 6, wherein the probability filter uses a user probability table and a general probability table.

8. The process of claim 7, wherein the user probability table and the general probability table learn from each email that passes through the process.

9. A process for filtering spam emails from a stream of emails, comprising the steps of:

A) building a general mail corpus, a general spam corpus;

a user mail corpus and a user spam corpus;

B) building a general probability table based on the general mail corpus and the general spam corpus, wherein the general probability table includes a list of tokens and a corresponding list of probabilities that an email is a spam for containing the corresponding token;

C) building a user probability table based on the user mail corpus and the user spam corpus;

wherein the user probability table includes a list of tokens and a corresponding list of probabilities that an email is a spam for containing the corresponding token;

D) receiving an email;

E) parsing the email into a plurality of tokens;

F) finding a token score for each token in the plurality of tokens, comprising the steps of;

a) searching the user probability table for each token;

b) if a token is not listed in the user probability table, searching the general probability table for that token; and

c) if the token is also not listed in the general probability table, ignoring the token or setting the token to a nominal value;

G) determining an email score, wherein the email score approximates a probability the email is a spam for containing all or some subset of the tokens in the email;

H) if the email score is above a predetermined value, diverting the email; and

I) if the email score is not above the predetermined value, transmitting the email to a user.

10. The process for claim 9, further comprising the steps of:

J) adding a diverted email to the user spam corpus; and

K) adding a transmitted email to the user mail corpus.

11. The process for claim 10, further comprising the steps of:

L) adding a diverted email to the general spam corpus; and

M) adding a transmitted email to the general mail corpus.

12. The process for claim 11, further comprising the step of:

N) performing a white list filter before step E) and, if a sender of the email is on a white list, transmitting the email to a client, adding the email to the user mail corpus, adding the email to the general mail corpus and stopping the filtering process for the email.

13. The process for claim 12, further comprising the step of:

O) performing a black list filter before step E) and, if a sender of the email is on a black list, diverting the email, adding the email to the user spam corpus, adding the email to the general spam corpus and stopping the filtering process for the email.

14. A process for filtering spam emails from a stream of emails, comprising the steps of:

A) receiving an incoming email from a stream of emails;

B) using a white list filter, wherein if a sender is on a white list, step B) further comprises the steps of;

a) transmitting the email to a user; and

b) skipping to step F);

C) using a black list filter, wherein if the sender is on a black list, step C) further comprises the steps of;

a) diverting the email; and

b) skipping to step F);

D) using a probability filter to determine an email score;

wherein if the email score is greater than a predetermined value, step D) further comprises the steps of;

a) diverting the email; and

b) skipping to step F);

E) transmitting the email to the user; and

F) repeating steps A) through F) as long as there are more unprocessed emails in the stream of emails.

15. The process of claim 14, further comprising the step of:

G) using a keyword filter after step C), but before step E), wherein if a keyword is found in the email, step G further comprises the steps of;

a) diverting the email; and

b) skipping to step F).

16. The process of claim 14, wherein step F) further comprises the steps of:

a) adding diverted email to a user spam corpus; and

b) adding transmitted email to a user mail corpus.

17. The process of claim 16, wherein step F) further comprises the steps of:

c) adding diverted email to a general spam corpus; and

d) adding transmitted email to a general mail corpus.

18. The process of claim 17, wherein step F) further comprises the steps of:

e) adding a sender of a diverted email to a black list; and

f) adding a sender of a transmitted email to a white list.