Collecting, aggregating, and managing information relating to electronic messages

• US 20050193076A1
• Filed: 02/17/2005
• Published: 09/01/2005
• Est. Priority Date: 02/17/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Sprosts, Craig, Flury, Andrew, Peterson, Patrick R., Banister, Scott, Olivier, Michael V.
• Granted Patent: US 7,653,695 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages

Abstract

A method and apparatus for managing information relating to electronic messages is provided. A first set of data related to one or more message senders is obtained from a first source, such as an email sever or email gateway. Each message sender has sent one or more electronic messages. A second set of data related to the one or more message senders is obtained from a second source. Message volume information that describes the messages sent by the one or more message senders for a period of time is determined based on the first set of data and the second set of data. The message volume information may be used to determine whether a particular message sent by a particular message sender is unsolicited. If a particular message is determined to be unsolicited, various actions may be performed on messages sent by the sender of the particular message.

Claims

1. A method for managing information relating to electronic messages, comprising the steps of:

obtaining, from a first source, a first set of data describing characteristics of one or more message senders, wherein each of the one or more message senders has sent one or more electronic messages;

determining message volume information that describes the messages sent by the one or more message senders for a period of time based, at least in part, on the first set of data; and

predicting whether a particular message sent by a particular message sender, of the one or more message senders, is unsolicited based on, at least in part, the message volume information.

2. The method of claim 1, wherein the first set of data is obtained from an email gateway, an information request handler, or an email client.

3. The method of claim 1, wherein the step of determining the message volume information comprises the step of:

determining when a message was sent by the particular message sender.

4. The method of claim 1, wherein the step of determining the message volume information comprises the step of:

determining how many requests for information about the particular message sender were received during a particular period of time.

5. The method of claim 1, wherein:

the particular message sender is associated with a particular Internet Protocol (IP) address, and

the step of determining the message volume information comprises the steps of;

determining second message volume information for the particular message sender based on the particular IP address, and

determining a network topology for the particular message sender based on the particular IP address.

6. The method of claim 5, wherein:

the step of determining the network topology for the particular message sender comprises determining other EP addresses that share high-order significant bits with the particular IP address, and

the step of determining the second message volume information comprises determining third message volume information related to a set of message senders associated with the other IP addresses.

7. The method of claim 1, wherein:

the step of determining the message volume information comprises the step of determining a category associated with a particular message sender of the one or more message senders, and

the step of predicting whether the particular message is unsolicited is performed, at least in part, using the category.

8. The method of claim 1, wherein:

the step of determining the message volume information comprises determining second message volume information related to the particular message sender,

the particular message sender is associated with a network owner,

the network owner is associated with a category,

the step of determining the second message volume information comprises determining a second category for the particular message sender based on the category associated with the network owner, and

wherein the second message volume information reflects the second category.

9. The method of claim 8, further comprising the step of:

modifying the delivery of any messages sent from any message senders, of said one or more message senders, associated with the second category.

10. The method of claim 1, wherein the step of determining the message volume information comprises the step of:

determining a geographical location of the particular message sender.

11. The method of claim 10, wherein the step of determining the geographical location of the particular message sender is performed based on an IP address associated with the particular message sender.

12. The method of claim 1, wherein the step of determining message volume information comprises the steps of:

determining a set of geographical locations for a set of gateways through which a message from the particular message sender has traveled.

13. The method of claim 1, wherein the step of determining the message volume information comprises the step of:

determining whether a particular condition is satisfied by the message volume information.

14. The method of claim 13, further comprising the steps of:

receiving a request, from a user, to subscribe to a user alert, wherein said user alert is associated with the particular condition; and

if the message volume information indicates that the particular condition is satisfied, then sending a communication to the user indicating that the particular condition has been satisfied.

15. The method of claim 1, wherein the step of predicting whether the particular message is unsolicited is performed, at least in part, using information regarding the change in ownership of an EP address associated with the particular message sender.

16. The method of claim 1, further comprising the steps of:

receiving a request for information about the message volume information; and

displaying a graphical user interface that comprises one or more panels, wherein each is the one or more panels is created using, at least a portion of, the message volume information.

17. The method of claim 1, further comprising the steps of:

receiving a request for information about the message volume information; and

providing the message volume information through an electronic interface.

18. The method of claim 1, further comprising the step of:

estimating a volume of messages sent by the particular message sender during the particular period of time based on how many requests for information were made about the particular message sender during the particular time period.

19. The method of claim 1, further comprising the step of:

in response to predicting whether the particular message is unsolicited, determining whether to (a) label the particular message as spam, (b) throttle messages from the particular message sender based on the message volume information, or (c) block messages from the particular message sender from being delivered.

20. The method of claim 1, wherein:

the method further comprises the step of obtaining, from a second source, a second set of data related to the one or more message senders, and

the message volume information is based, at least in part, on the second set of data.

21. The method of claim 20, wherein the first source and the second source are the same source;

and wherein the step of obtaining the first set of data and the step of obtaining the second set of data are performed at different points in time.

22. The method of claim 1, wherein the step of determining the message volume information comprises:

determining a first volume of messages sent by the particular message sender during a first time period;

determining a second volume of messages sent by the particular message sender during a second time period; and

determining a change in volume during the first time period as compared to the second time period.

23. The method of claim 22, wherein:

the step of determining the first volume of messages comprises determining a first relative magnitude of volume of messages sent by the particular message sender in relation to other message senders during the first time period,

the step of determining the second volume of messages further comprises determining a second relative magnitude of volume of messages sent by the particular message sender in relation to the other message senders during the second time period, and

the step of predicting whether the particular message is unsolicited is performed, at least in part, by consulting the first relative magnitude of volume of messages and the second relative magnitude of volume of messages.

24. The method of claim 1, wherein the step of determining the message volume information comprises:

determining a percentage of messages sent by the particular message sender relative to the messages sent by a set of other message senders.

25. The method of claim 1, wherein the step of determining the message volume information comprises:

determining a logarithm of the percentage of messages sent by the particular message sender relative to the messages sent by other message senders.

26. A method of managing information relating to electronic messages, comprising the steps of:

receiving, from a particular message sender, one or more messages;

sending a request for message volume information related to the particular message sender;

receiving the message volume information related to the particular message sender; and

modifying the delivery of a particular message from the particular message sender based on the received message volume information.

27. The method of claim 26, wherein the step of modifying the delivery of the particular message comprises (a) automatically associating the particular message with a particular folder of an email client, (b) deleting the particular message, (c) indicating that the particular message is bulk mail, or (d) indicating that the particular message is unsolicited.

28. The method of claim 26, further comprising the steps of:

receiving one or more messages from a second message sender;

determining that the particular message sender is related to the second message sender; and

blocking delivery of a second message from the second message sender based on the message volume information related to the particular message sender.

29. A machine-readable medium carrying one or more sequences of instructions for managing information relating to electronic messages, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

obtaining, from a first source, a first set of data describing characteristics of one or more message senders, wherein each of the one or more message senders has sent one or more electronic messages;

determining message volume information that describes the messages sent by the one or more message senders for a period of time based, at least in part, on the first set of data; and

predicting whether a particular message sent by a particular message sender, of the one or more message senders, is unsolicited based on, at least in part, the message volume information.

30. The machine-readable medium of claim 29, wherein the first set of data is obtained from an email gateway, an information request handler, or an email client.

31. The machine-readable medium of claim 29, wherein the step of determining the message volume information comprises the step of:

determining when a message was sent by the particular message sender.

32. The machine-readable medium of claim 29, wherein the step of determining the message volume information comprises the step of:

determining how many requests for information about the particular message sender were received during a particular period of time.

33. The machine-readable medium of claim 29, wherein:

the particular message sender is associated with a particular Internet Protocol (IP) address, and

the step of determining the message volume information comprises the steps of;

determining second message volume information for the particular message sender based on the particular IP address, and

determining a network topology for the particular message sender based on the particular IP address.

34. The machine-readable medium of claim 33, wherein:

the step of determining the network topology for the particular message sender comprises determining other IP addresses that share high-order significant bits with the particular IP address, and

the step of determining the second message volume information comprises determining third message volume information related to a set of message senders associated with the other IP addresses.

35. The machine-readable medium of claim 29, wherein:

the step of determining the message volume information comprises the step of determining a category associated with a particular message sender of the one or more message senders, and

the step of predicting whether the particular message is unsolicited is performed, at least in part, using the category.

36. The machine-readable medium of claim 29, wherein:

the step of determining the message volume information comprises determining second message volume information related to the particular message sender,

the particular message sender is associated with a network owner,

the network owner is associated with a category,

the step of determining the second message volume information comprises

determining a second category for the particular message sender based on the category associated with the network owner, and

wherein the second message volume information reflects the second category.

37. The machine-readable medium of claim 36, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the step of:

modifying the delivery of any messages sent from any message senders, of said one or more message senders, associated with the second category.

38. The machine-readable medium of claim 29, wherein the step of determining the message volume information comprises the step of:

determining a geographical location of the particular message sender.

39. The machine-readable medium of claim 38, wherein the step of determining the geographical location of the particular message sender is performed based on an IP address associated with the particular message sender.

40. The machine-readable medium of claim 29, wherein the step of determining message volume information comprises the steps of:

determining a set of geographical locations for a set of gateways through which a message from the particular message sender has traveled.

41. The machine-readable medium of claim 29, wherein the step of determining the message volume information comprises the step of:

determining whether a particular condition is satisfied by the message volume information.

42. The machine-readable medium of claim 41, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the steps of:

receiving a request, from a user, to subscribe to a user alert, wherein said user alert is associated with the particular condition; and

if the message volume information indicates that the particular condition is satisfied, then sending a communication to the user indicating that the particular condition has been satisfied.

43. The machine-readable medium of claim 29, wherein the step of predicting whether the particular message is unsolicited is performed, at least in part, using information regarding the change in ownership of an EP address associated with the particular message sender.

44. The machine-readable medium of claim 29, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the steps of:

receiving a request for information about the message volume information; and

displaying a graphical user interface that comprises one or more panels, wherein each is the one or more panels is created using, at least a portion of, the message volume information.

45. The machine-readable medium of claim 29, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the steps of:

receiving a request for information about the message volume information; and

providing the message volume information through an electronic interface.

46. The machine-readable medium of claim 29, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the step of:

estimating a volume of messages sent by the particular message sender during the particular period of time based on how many requests for information were made about the particular message sender during the particular time period.

47. The machine-readable medium of claim 29, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the step of:

in response to predicting whether the particular message is unsolicited, determining whether to (a) label the particular message as spam, (b) throttle messages from the particular message sender based on the message volume information, or (c) block messages from the particular message sender from being delivered.

48. The machine-readable medium of claim 29, wherein:

the method further comprises the step of obtaining, from a second source, a second set of data related to the one or more message senders, and

the message volume information is based, at least in part, on the second set of data.

49. The machine-readable medium of claim 48, wherein the first source and the second source are the same source;

and wherein the step of obtaining the first set of data and the step of obtaining the second set of data are performed at different points in time.

50. The machine-readable medium of claim 29, wherein the step of determining the message volume information comprises:

determining a first volume of messages sent by the particular message sender during a first time period;

determining a second volume of messages sent by the particular message sender during a second time period; and

determining a change in volume during the first time period as compared to the second time period.

51. The machine-readable medium of claim 50, wherein:

the step of determining the first volume of messages comprises determining a first relative magnitude of volume of messages sent by the particular message sender in relation to other message senders during the first time period,

the step of determining the second volume of messages further comprises determining a second relative magnitude of volume of messages sent by the particular message sender in relation to the other message senders during the second time period, and

the step of predicting whether the particular message is unsolicited is performed, at least in part, by consulting the first relative magnitude of volume of messages and the second relative magnitude of volume of messages.

52. The machine-readable medium of claim 29, wherein the step of determining the message volume information comprises:

determining a percentage of messages sent by the particular message sender relative to the messages sent by a set of other message senders.

53. The machine-readable medium of claim 29, wherein the step of determining the message volume information comprises:

determining a logarithm of the percentage of messages sent by the particular message sender relative to the messages sent by other message senders.

54. A machine-readable medium carrying one or more sequences of instructions for managing information relating to electronic messages, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

receiving, from a particular message sender, one or more messages;

sending a request for message volume information related to the particular message sender;

receiving the message volume information related to the particular message sender; and

modifying the delivery of a particular message from the particular message sender based on the received message volume information.

55. The machine-readable medium of claim 54, wherein the step of modifying the delivery of the particular message comprises (a) automatically associating the particular message with a particular folder of an email client, (b) deleting the particular message, (c) indicating that the particular message is bulk mail, or (d) indicating that the particular message is unsolicited.

56. The machine-readable medium of claim 54, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to further perform the steps of:

receiving one or more messages from a second message sender;

determining that the particular message sender is related to the second message sender; and

blocking delivery of a second message from the second message sender based on the message volume information related to the particular message sender.

57. A system for managing information relating to electronic messages, comprising:

a plurality of message information collectors, wherein each of the plurality of message information collectors are configured to transmit information about received messages to a data processing unit; and

the data processing unit, wherein the data processing unit is configured to perform the steps of;

receiving, from a particular message information collector of the plurality of message information collectors, a first set of data regarding a particular message received at the particular message information collector;

processing the first set of data with a second set of data regarding messages received at other message information collectors, of the plurality of message information collectors, besides the particular message information collector, to form a set of message volume information;

determining a prediction as to whether the particular message is spam based, at least in part, on the message volume information; and

providing the prediction to the particular message information collector.