SYSTEMS AND METHODS FOR MANAGING THE TRANSMISSION OF ELECTRONIC MESSAGES VIA MESSAGE SOURCE DATA

• US 20050182959A1
• Filed: 04/26/2005
• Published: 08/18/2005
• Est. Priority Date: 02/19/2002
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Postini, Inc. (Alphabet Inc.)
• Inventors: Lund, Peter Kevin, Oswall, Michael John, Akamine, Shinya, Petry, Scott M., Cox, Fredric L.
• Granted Patent: US 8,769,020 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention provides an electronic message management system (EMS) that includes a real-time feedback loop where data is collected from the electronic messages on incoming connection attempts, outgoing delivery attempts, and message content analysis, and written to a centralized data matrix. A separate process accesses the data matrix and analyzes trends in that data. The detected data patterns, trends or behavior is based on configuration parameters for the recipient. Based on these determinations, the process is able to instruct components in the EMS to accept, redirect, refuse, modify, defer, or otherwise dispose of the connection request, the delivery attempt, or the message. Associated methods for managing the transmission of electronic messages are also disclosed.

Claims

1. A method of managing the transmission of electronic messages from sending mail servers to receiving mail servers, the method comprising:

reviewing an incoming electronic message sent from the sending mail server to the receiving mail server;

identifying the source IP address of the sending mail server from the electronic message; and

deciding disposition of the incoming electronic message based at least in part on the identified source IP address of the sending mail server.

2. A method according to claim 1, wherein reviewing comprises intercepting the incoming electronic message before it reaches the receiving mail server using an interposing service.

3. A method according to claim 2, wherein the interposing service is an interposing server.

4. A method according to claim 1, wherein identifying comprises identifying the source IP address of the sending mail server from data found in a portion of the electronic message.

5. A method according to claim 4, wherein the portion of the message is a data packet having source and destination data for the message.

6. A method as recited in claim 1, wherein deciding disposition further comprises processing the electronic message in accordance with rules established by an administrator or a user.

7. A method according to claim 6, wherein the processing comprises generating disposition instructions for disposing of the incoming electronic message.

8. A method according to claim 7, wherein generating disposition instructions includes generating disposition instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

placing the message in a black hole.

9. A method according to claim 7, wherein the processing further comprises employing program threads for detecting unwanted electronic messages and electronic message delivery attempts from unapproved source IP addresses.

10. A method according to claim 1, wherein the deciding disposition further comprises deciding based on associating the identified source IP address with metadata selected from the group consisting of:

count of connection attempts from the source IP address;

count of current open connections from the source IP address;

duration of connections from the source IP address;

count of messages from the source IP address;

message size;

count of recipients on messages;

count of spam messages from the source IP address;

count of virus infected messages from the source IP address;

count of messages from the source IP address with unwanted binary attachment;

count of messages from the source IP address with unwanted content;

count of messages from the source IP address against which the disposition option was blocked, black-holed, spooled, or quarantined;

count of current open connections to destination IP address duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

11. An electronic message management system for managing the transmission of electronic messages from sending mail servers to receiving mail servers, the system comprising:

an interposing service configured to intercept an electronic message sent from the sending mail server to the receiving mail server;

a message handling process associated with the interposing service and configured to identify the source IP address of the sending mail server from the intercepted electronic message; and

an interpreter process configured to decide a disposition of the electronic message based at least in part on the identified source IP address of the sending mail server.

12. A system according to claim 11, wherein the interpreter process is further configured to identify the source IP address of the sending mail server from data found in a portion of the electronic message.

13. A system according to claim 12, wherein the portion of the message is a data packet having source and destination data for the message.

14. A system according to claim 11, wherein the interposing service is an interposing server.

15. A system according to claim 11, wherein the message handling process comprises a connection management module configured to identify the source IP address from the incoming electronic message.

16. A system as recited in claim 11, further comprising an access console associated with the interpreter process for establishing rules for the disposition of the incoming electronic message.

17. A system according to claim 11, wherein the interpreter process is further configured to generate disposition instructions for use by the message handling process in deciding disposition of the incoming electronic message.

18. A system according to claim 17, wherein disposition instructions are selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

placing the message in a black hole.

19. A system as recited in claim 17, wherein the message handling process further comprises a delivery module configured to dispose of the incoming electronic message based on the disposition instructions.

20. A system according to claim 11, further comprising program threads for detecting unwanted electronic messages and electronic message delivery attempts from unapproved source IP addresses, the program threads employable by the message handling process to decide disposition of the incoming electronic message.

21. A system according to claim 11, wherein the interpreter process is further configured to decide disposition of the electronic message from the sending mail server based in part on associating the identified source IP address with metadata selected from the group consisting of:

count of connection attempts from the source IP address;

count of current open connections from the source IP address;

duration of connections from the source IP address;

count of messages from the source IP address;

message size;

count of recipients on messages;

count of spam messages from the source IP address;

count of virus infected messages from the source IP address;

count of messages from the source IP address with unwanted binary attachment;

count of messages from the source IP address with unwanted content;

count of messages from the source IP address against which the disposition option was blocked, black-holed, spooled, or quarantined;

count of current open connections to destination IP address duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.