Spam filter with sender ranking system

• US 20060031373A1
• Filed: 06/10/2005
• Published: 02/09/2006
• Est. Priority Date: 06/28/2004
• Status: Active Grant

• Current Assignee: Dropbox, Inc.
• Original Assignee: Internet Security Systems Incorporated (International Business Machines Corporation)
• Inventors: Werner, Carsten, Usher, Mark
• Granted Patent: US 7,552,186 B2
• Time in Patent Office: Days
• US Class Current: 709/207
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases

Abstract

A spam detection system can monitor incoming and outgoing email messages and prevent email messages from being delivered. This spam detection system incorporates a sender ranking system that maintains prior sender'"'"'s email addresses and an associated reliability value in a database. If an email message is categorized as spam, the system searches to see if the sender is located in the database. If the sender is located in the database and their reliability value is above a certain threshold, the sender'"'"'s reliability value is decreased and the email message is treated as not spam. If the sender is not located in the database, the email message is discarded as spam. If an email message is not categorized as spam, prior users located in the database will have their reliability values increased, while new users will be entered into the database at a default level.

Claims

1. A computer implemented method for evaluating electronic mail messages, comprising the steps of:

identifying an electronic mail message from a particular sender as spam;

determining whether the particular sender of the electronic mail message identified as spam is stored in a database comprising;

a plurality of electronic mail addresses; and

a plurality of current reliability values, each associated with one of the electronic mail addresses;

reading from the database the current reliability value associated with the electronic mail address of the particular sender stored in the database;

determining whether the current reliability value associated with the electronic mail address of the particular sender is greater than a predefined threshold;

calculating a new reliability value for the electronic mail address of the particular sender by decreasing the particular sender'"'"'s current reliability value in response to the determination that the current reliability value associated with the particular sender is greater than a predefined threshold; and

changing the identification of the electronic mail message to not spam in response to the determination that the current reliability value associated with the particular sender is greater than the predefined threshold.

2. The method of claim 1, further comprising the step of:

accepting the email message for presentation in response to changing the identification of the electronic mail message to not spam.

3. The method of claim 1, wherein the step of calculating a new reliability value by decreasing the particular sender'"'"'s current reliability value is calculated by multiplying the sender'"'"'s current reliability value by a predefined real number between zero and one.

4. The method of claim 1, wherein the step of calculating a new reliability value by decreasing the particular sender'"'"'s current reliability value is determined by choosing the greater value between the minimum possible reliability value and the current reliability value minus a predefined value.

5. The method of claim 1 further comprising the step of:

calculating a new reliability value by decreasing the particular sender'"'"'s current reliability value in response to the determination that the current reliability value is less than the predefined threshold.

6. The method of claim 1 further comprising the steps of:

identifying an electronic mail message from a particular sender as not spam;

determining whether the electronic mail address of the particular sender of the electronic mail message identified as not spam is stored in the database;

calculating a new reliability value by increasing the particular sender'"'"'s current reliability value for the electronic mail address of the particular sender of an electronic mail message stored in the database.

7. The method of claim 6, wherein the step of calculating a new reliability value by increasing the particular sender'"'"'s current reliability value is determined by the formula v_new=f*(1−

a)+a*v_old, wherein

v_new is the new reliability value;

f is a real number greater than zero;

a is a real number between zero and one; and

v_old is the current reliability value.

8. The method of claim 6, wherein the step of calculating a new reliability value by increasing the particular sender'"'"'s current reliability value is determined by choosing the lesser value between the maximum possible reliability value and the current reliability value plus a predefined value.

9. The method of claim 1 further comprising:

identifying an electronic mail message from a particular sender as not spam;

determining whether the particular sender of the electronic mail message identified as not spam is stored in the database; and

creating a new entry in the database for the electronic mail address of the particular sender of the electronic mail message that is not stored in the database.

10. The method of claim 9, wherein the step of creating a new entry comprises:

adding the particular sender'"'"'s electronic mail address to the database;

determining the particular sender'"'"'s default reliability value; and

associating the particular sender'"'"'s electronic mail address with the particular sender'"'"'s default reliability value.

11. The method of claim 9, wherein the step of determining the particular sender'"'"'s default reliability value is calculated by using the formula v_new=f*(1−

a)+a*v_min, wherein

v_new is the default reliability value;

f is a real number greater than 0;

a is a real number between zero and one; and

v_‘

min is the minimum possible reliability value.

12. A system for filtering unsolicited electronic mail messages, comprising:

a spam detection module operative to identify an electronic mail message from a particular sender as spam;

a sender ranking database comprising;

a plurality of electronic mail addresses; and

a plurality of current reliability values, each associated with one of the electronic mail addresses;

the friendly sender detection module operative to;

reading the current reliability value associated with the electronic mail address of the particular sender stored in the sender ranking database; and

determining whether the current reliability value associated with the electronic mail address of the particular sender is less than a predefined threshold; and

a sender ranking database update module operative to calculating a new reliability value for the electronic mail address of the particular sender by decreasing the particular sender'"'"'s current reliability value in response to the determination that the current reliability value associated with the electronic mail address of the particular sender is less than a predefined threshold.

13. The system of claim 12, wherein the sender ranking database update module is operative to perform the step of calculating a new reliability value by decreasing the particular sender'"'"'s current reliability value which is calculated by multiplying the sender'"'"'s current reliability value by a predefined real number between zero and one.

14. The system of claim 12, wherein the sender ranking database update module is operative to perform the step of calculating a new reliability value by decreasing the particular sender'"'"'s current reliability value which is determined by choosing the greater value between the minimum possible reliability value and the current reliability value minus a predefined value.

15. The system of claim 12, wherein the sender ranking database update module is operative to perform the step of calculating a new reliability value by decreasing the particular sender'"'"'s current reliability value in response to the determination that the current reliability value is greater than the predefined threshold.

16. The system of claim 12, wherein

the spam detection module identifies an electronic mail message from a electronic mail address of the particular sender as not spam;

the friendly sender detection module determines whether the electronic mail address of the particular sender of the electronic mail message identified as not spam is stored in the sender ranking database;

the sender ranking database update module is operative to perform the step of calculating a new reliability value by increasing the particular sender'"'"'s current reliability value for the electronic mail address of the particular sender of an electronic mail message stored in the database.

17. The system of claim 16, wherein the sender ranking database update module is operative to perform the step of calculating a new reliability value by increasing the particular sender'"'"'s current reliability value by the formula v_new=f*(1−

a)+a*v_old, wherein

v_new is the new reliability value;

f is a real number greater than zero;

a is a real number between zero and one; and

v_old is the current reliability value.

18. The system of claim 16, wherein the sender ranking database update module is operative to perform the step of calculating a new reliability value by increasing the particular sender'"'"'s current reliability value which is determined by choosing the lesser value between the maximum possible reliability value and the current reliability value plus a predefined value.

19. The system of claim 12 further comprising:

the spam detection module identifying an electronic mail message from the electronic mail address of the particular sender as not spam;

the friendly sender detection module determining whether the electronic mail address of the particular sender of the electronic mail message identified as not spam is stored in the sender ranking database; and

the sender ranking database update module operative to perform the step of creating a new entry in the database for the electronic mail address of the particular sender of the electronic mail message that is not stored in the database.

20. The system of claim 19, wherein the step of creating a new entry comprises:

adding the particular sender'"'"'s electronic mail address to the sender ranking database;

determining the particular sender'"'"'s default reliability value; and

associating the particular sender'"'"'s electronic mail address with the particular sender'"'"'s default reliability value.

21. The system of claim 20, wherein the sender ranking database update module is operative to perform the step of determining the particular sender'"'"'s default reliability value using the formula

v_new=f*(1−

a)+a*v_min, wherein

v_new is the default reliability value;

f is a real number greater than 0;

a is a real number between zero and one; and

v_min is the minimum possible reliability value.

22. A computer implemented method for filtering unsolicited electronic mail messages, comprising the steps of:

identifying an electronic mail message from a particular sender as not spam;

determining whether the particular sender of the electronic mail message identified as not spam is stored in a database comprising;

a plurality of electronic mail addresses; and

a plurality of current reliability values, each associated with one of the electronic mail addresses;

creating a new entry in the database for the electronic mail address of the particular sender of the electronic mail message that is not stored in the database.

23. The method of claim 22, wherein the step of creating a new entry comprises:

adding the particular sender'"'"'s electronic mail address to the database;

determining the particular sender'"'"'s default reliability value; and

associating the particular sender'"'"'s electronic mail address to the particular sender'"'"'s default reliability value.

24. The method of claim 23, wherein the step of determining the particular sender'"'"'s default reliability value is calculated by using the formula

v_new=f*(1−

a)+a*v_min, wherein

v_new is the default reliability value;

f is a real number greater than 0;

a is a real number between zero and one; and

v_min is the minimum possible reliability value.

25. The method of claim 22 further comprising the steps of:

identifying an electronic mail message from the electronic mail address of the particular sender as not spam;

determining whether the electronic mail address of the particular sender of the electronic mail message identified as not spam is stored in the database;

calculating a new reliability value by increasing the particular sender'"'"'s current reliability value for the electronic mail address of the particular sender of an electronic mail message stored in the database.

26. The method of claim 25, wherein the step of calculating a new reliability value by increasing the particular sender'"'"'s current reliability value is determined by the formula v_new=f*(1−

a)+a*v_old, wherein

v_new is the new reliability value;

f is a real number greater than zero;

a is a real number between zero and one; and

v_old is the current reliability value.

27. The method of claim 25, wherein the step of calculating a new reliability value by increasing the particular sender'"'"'s current reliability value is determined by choosing the lesser value between the maximum possible reliability value and the current reliability value plus a predefined value.

28. The method of claim 22 further comprising the steps of:

identifying an electronic mail message from the electronic mail address of the particular sender as spam;

determining whether the electronic mail address of the particular sender of the electronic mail message identified as spam is stored in the database;

reading the current reliability value associated with the electronic mail address of the particular sender stored in the database;

determining whether the current reliability value associated with the electronic mail address of the particular sender is greater than a predefined threshold;

calculating a new reliability value for the electronic mail address of the particular sender by decreasing the particular sender'"'"'s current reliability value in response to the determination that the current reliability value associated with the electronic mail address of the particular sender is greater than a predefined threshold; and

changing the identification of the electronic mail message as not spam in response to the determination that the current reliability value associated with the electronic mail address of the particular sender is greater than the predefined threshold.

29. The method of claim 28, wherein the step of calculating a new reliability value by decreasing the particular sender'"'"'s current reliability value is calculated by multiplying the sender'"'"'s current reliability value by a predefined real number between zero and one.

30. The method of claim 28, wherein the step of calculating a new reliability value by decreasing the particular sender'"'"'s current reliability value is determined by choosing the greater value between the minimum possible reliability value and the current reliability value minus a predefined value.

31. The method of claim 22 further comprising calculating a new reliability value by decreasing the particular sender'"'"'s current reliability value in response to the determination that the current reliability value is less than the predefined threshold.