SYSTEMS AND METHODS FOR MANAGING THE TRANSMISSION OF ELECTRONIC MESSAGES VIA THROTTLING AND DELAYING DELIVERY

• US 20050182960A1
• Filed: 04/26/2005
• Published: 08/18/2005
• Est. Priority Date: 02/19/2002
• Status: Abandoned Application

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Postini, Inc. (Alphabet Inc.)
• Inventors: Lund, Peter K., Akamine, Shinya, Petry, Scott M., Oswall, Michael J., Cox, Fredric L.
• Application Number:
  US10/908,061
• Publication Number:
  US 20050182960A1
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention provides an electronic message management system (EMS) that includes a real-time feedback loop where data is collected from the electronic messages on incoming connection attempts, outgoing delivery attempts, and message content analysis, and written to a centralized data matrix. A separate process accesses the data matrix and analyzes trends in that data. The detected data patterns, trends or behavior is based on configuration parameters for the recipient. Based on these determinations, the process is able to instruct components in the EMS to accept, redirect, refuse, modify, defer, or otherwise dispose of the connection request, the delivery attempt, or the message. Associated methods for managing the transmission of electronic messages are also disclosed.

Claims

1. A method of managing the transmission of electronic messages from sending mail servers to receiving mail servers, the method comprising:

reviewing at least one incoming electronic message sent from the sending mail server to the receiving mail server;

obtaining data from the at least one incoming electronic message; and

throttling at least one SMTP connection upon which the at least one electronic message arrives based at least in part on the obtained data.

2. A method according to claim 1, wherein obtaining data from the at least one incoming electronic message comprises extracting source data associated with the sending mail server from the at least one incoming electronic message.

3. A method according to claim 2, wherein the source data comprises the source IP address of the sending mail server.

4. A method according to claim 1, wherein obtaining data from the at least one incoming electronic message further comprises deriving metadata associated with the at least one incoming electronic message and supplementing the obtained data with the metadata.

5. A method according to claim 4, wherein the metadata derived from the at least one incoming electronic message is selected from the group consisting of:

count of connection attempts from the source IP address;

count of current open connections from the source IP address;

duration of connections from the source IP address;

count of messages from the source IP address;

message size;

count of recipients on messages;

count of spam messages from the source IP address;

count of virus infected messages from the source IP address;

count of messages from the source IP address with unwanted binary attachment;

count of messages from the source IP address with unwanted content; and

count of messages from the source IP address against which the disposition option was blocked, black-holed, spooled, or quarantined.

6. A method according to claim 1, wherein reviewing the at least one incoming message comprises intercepting at least one incoming electronic message between the sending mail server and the receiving mail server.

7. A method according to claim 6, wherein the intercepting comprises intercepting the at least one incoming electronic message within an intermediate mail server.

8. An electronic message management system for use in managing the transmission of electronic messages from sending mail servers to receiving mail servers, the system comprising:

an intermediate service configured to intercept at least one of the electronic messages between a sending mail server and a receiving mail server; and

a connection management module associated with the intermediate service, the connection management module configured to obtain data from the at least one incoming electronic message and to throttle an SMTP connection upon which the at least one electronic message arrives at the intermediate service based at least in part on the obtained data.

9. A system according to claim 8, wherein the data obtained from the at least one incoming electronic message comprises source data associated with the sending mail server extracted from the at least one electronic message.

10. A system according to claim 9, wherein the source data comprises the source IP address of the sending mail server.

11. A system according to claim 8, wherein the data obtained from the at least one incoming electronic message further comprises metadata associated with the at least one incoming electronic message derived from the at least one electronic message, the metadata supplementing the obtained data.

12. A system according to claim 11, wherein the metadata derived from the at least one incoming electronic message is selected from the group consisting of:

count of connection attempts from the source IP address;

count of current open connections from the source IP address;

duration of connections from the source IP address;

count of messages from the source IP address;

message size;

count of recipients on messages;

count of spam messages from the source IP address;

count of virus infected messages from the source IP address;

count of messages from the source IP address with unwanted binary attachment;

count of messages from the source IP address with unwanted content; and

count of messages from the source IP address against which the disposition option was blocked, black-holed, spooled, or quarantined.

13. A system according to claim 8, wherein the intermediate service in an intermediate mail server.

14. A method of managing the transmission of electronic messages from sending mail servers to receiving mail servers, the method comprising:

reviewing at least one incoming electronic message sent from the sending mail server to the receiving mail server;

obtaining data from the at least one incoming electronic message; and

delaying delivery of the at least one electronic message to the receiving mail server based at least in part on the obtained data.

15. A method according to claim 14, wherein obtaining data from the at least one incoming electronic message comprises extracting source data associated with the sending mail server from the at least one incoming electronic message.

16. A method according to claim 15, wherein the source data comprises the source IP address of the sending mail server.

17. A method according to claim 15, wherein obtaining data from the at least one incoming electronic message further comprises deriving metadata associated with the at least one incoming electronic message and supplementing the obtained data with the metadata.

18. A method according to claim 17, wherein the metadata derived from the at least one incoming electronic message is selected from the group consisting of:

count of connection attempts from the source IP address;

count of current open connections from the source IP address;

duration of connections from the source IP address;

count of messages from the source IP address;

message size;

count of recipients on messages;

count of spam messages from the source IP address;

count of virus infected messages from the source IP address;

count of messages from the source IP address with unwanted binary attachment;

count of messages from the source IP address with unwanted content;

count of messages from the source IP address against which the disposition option was blocked, black-holed, spooled, or quarantined;

count of current open connections to the destination IP address;

duration of connections to the destination IP address;

count of failed connections to the destination IP address;

count of temporary deferral errors from the destination IP address; and

count of unknown user errors from the destination IP address.

19. A method according to claim 15, wherein reviewing the at least one incoming message comprises intercepting the at least one incoming electronic message between the sending mail server and the receiving mail server.

20. A method according to claim 19, wherein the intercepting comprises intercepting the at least one incoming electronic message within an intermediate mail server.

21. An electronic message management system for use in managing the transmission of electronic messages from sending mail servers to receiving mail servers, the system comprising:

an intermediate service configured to review at least one of the electronic messages between a sending mail server and a receiving mail server; and

a delivery management module associated with the intermediate service, the delivery management module configured to obtain data from the at least one incoming electronic message and to delay delivery of the at least one electronic message to the receiving mail server based at least in part on the obtained data.

22. A system according to claim 21, wherein the data obtained from the at least one incoming electronic message comprises source data associated with the sending mail server extracted from the at least one electronic message.

23. A system according to claim 22, wherein the source data comprises the source IP address of the sending mail server.

24. A system according to claim 21, wherein the data obtained from the at least one incoming electronic message further comprises metadata associated with the at least one incoming electronic message derived from the at least one electronic message, the metadata supplementing the obtained data.

25. A system according to claim 24, wherein the metadata derived from the at least one incoming electronic message is selected from the group consisting of:

count of connection attempts from the source IP address;

count of current open connections from the source IP address;

duration of connections from the source IP address;

count of messages from the source IP address;

message size;

count of recipients on messages;

count of spam messages from the source IP address;

count of virus infected messages from the source IP address;

count of messages from the source IP address with unwanted binary attachment;

count of messages from the source IP address with unwanted content;

count of messages from the source IP address against which the disposition option was blocked, black-holed, spooled, or quarantined;

count of current open connections to the destination IP address;

duration of connections to the destination IP address;

count of failed connections to the destination IP address;

count of temporary deferral errors from the destination IP address; and

count of unknown user errors from the destination IP address.

26. A system according to claim 21, wherein the intermediate service is configured to intercept the at least one incoming message between the sending mail server and the receiving mail server.

27. A system according to claim 26, wherein the intermediate service comprises an intermediate mail server.