System for email processing and analysis

• US 20050262209A1
• Filed: 03/08/2005
• Published: 11/24/2005
• Est. Priority Date: 03/09/2004
• Status: Active Grant

• Current Assignee: Gozoom.com, Inc.
• Original Assignee: Mailshell, Inc.
• Inventors: Yu, Tony
• Granted Patent: US 8,918,466 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases

Abstract

Various features are provided for analyzing and processing email messages including determining if an email message is unwanted, and blocking unwanted messages. Email traffic is monitored by analyzing email messages addressed to known invalid email addresses. Email messages addressed to invalid email addresses are sent to a central control site for analysis. One embodiment tries to ensure that the distance between the invalid addresses and closest valid addresses is significant enough so that the invalid addresses are not inadvertently used for non-spam purposes. Another embodiment of the invention provides for distributed “thin client” processes to run on computer systems or other processing platforms. The thin clients emulate an open relay computer. Attempts at exploiting the apparent open relay computer are reported to a control center and the relay of email messages can be inhibited. Another embodiment provides for analysis and tuning of rules to detect spam and legitimate email. The approach adjusts various factors according to changing, current email data that is gathered from present, or recent, email traffic. Another embodiment takes into account statistics of erroneous and intentional misspellings. Groups of similar content items (e.g., words, phrases, images, ASCII text, etc.) are correlated and analysis can proceed after substitution of items in the group with other items in the group so that a more accurate detection of “sameness” of content can be achieved. Another embodiment uses authentication and security methods for validating email senders, detecting the sameness of messages, tracking the reputation of the sender, and tracking the behavior of the sender. Another embodiment profiles users to intelligently organize user data, including adapting spam detection according to a user'"'"'s perceived interests.

Claims

1. A method for analyzing email, the method comprising

analyzing email messages sent to known invalid email address;

and

using information about the detected email message.

2. The method of claim 1, wherein the known invalid email address is greater than a predetermined distance from a closest valid email address.

3. The method of claim 1, wherein using information includes

determining if the email message is spam.

4. The method of claim 3, wherein if the email message is determined to be spam then

preventing similar email messages from delivery to intended recipients.

5. The method of claim 3, further comprising

sending information about the detected email message to a central server for purposes of processing the information to determine if the email message is spam.

6. A method for analyzing spammer computer systems in a digital network, the method comprising

loading a process onto a target computer system, whereby execution of the process by the target computer system allows an external computer system to perceive the target computer system as exploitable;

and

using a control center to receive email messages received by the target computer.

7. The method of claim 6, further comprising

using the control center to analyze the received email messages to determine if the email messages are spam;

and

sending data from the control center to the target computer system to direct the target computer system to block the spam email messages.

8. A method for analyzing email messages to determine if the email messages are spam, the method comprising

determining the frequency of occurrence of spam attributes of email messages;

determining the frequency of occurrence of non-spam attributes of email messages; and

using the determined frequencies to classify an email message as spam, wherein predetermined attribute categories are used to adjust a weighting of the determined frequencies in the classification.

9. The method of claim 8, wherein a predetermined attribute category includes attributes that more difficult to falsify than other attribute categories.

10. The method of claim 8, wherein recent messages are weighted more highly than older messages.

11. A method for analyzing email messages to determine if the email messages are spam, the method comprising

assigning a higher weight to email attributes that are difficult to modify and/or viewable in email clients;

and using the assigned weights in an analysis to determine a likelihood that an email message is spam.

12. A method for analyzing email messages, comprising

predefining a group of two or more items that have similar meaning;

determining when an item in the group is present in an email message;

substituting the identified item with another item in the group; and

analyzing the email message using the substituted item.

13. The method of claim 12, wherein an item includes a word.

14. The method of claim 12, wherein an item includes a phrase.

15. The method of claim 12, wherein an item includes an image.

16. The method of claim 12, wherein an item includes a symbol.

17. The method of claim 16, wherein an item includes ASCII art.

18. A method for analyzing email messages to determine if the email messages are spam, by determining the presence of intentionally misspelled spam-like words.

19. A method to determine if two messages are the same by comparing parts of the messages which are difficult to modify.

20. A method to determine if two messages are the same by comparing parts of the messages which are viewable in email clients.

21. A method to determine if two messages are the same by comparing % of rules and words which match weighed by the probability of spam of the rules and words.

22. A method for presenting information to a user on a computer system, wherein the computer system includes a user input device, the method comprising

determining the user'"'"'s interests by obtaining data from the user input device;

and

using the determined interests in ranking an email message according to the user'"'"'s interests; and

if the ranking is above a predetermined threshold then providing the email message to the user, otherwise filtering the email message from the user.