Blocking of spam e-mail at a firewall

• US 20060037070A1
• Filed: 10/06/2005
• Published: 02/16/2006
• Est. Priority Date: 05/20/2003
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Jeffries, Clark Debs, Himberger, Kevin David, Davis, John Fred, Jeremiah, Garreth Joseph
• Granted Patent: US 7,617,526 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 69/28 Timers or timing mechanisms used in protocols

Abstract

A method of blocking spam at a firewall involves applying blocking measures for an adaptively determined duration. The blocking measure is then suspended while determining whether the spam has ended. If so, the method resets to an initial state. Otherwise, the blocking measure is re-applied for a second duration.

Claims

1. A method of blocking spam at a firewall, comprising the steps of:

determining whether an e-mail message is spam;

if so, applying a blocking measure for a duration that is determined adaptively; and

suspending said blocking measure at the end of the duration.

2. The method of claim 1, wherein said determining detects identical text bodies in said e-mail message with a plurality of other e-mail messages.

3. The method of claim 2, further comprising using a hash function to determine said identical text bodies.

4. The method of claim 1, further comprising the step of providing a database to integrate said identical bodies and declare filter rules for said determining.

5. The method of claim 4, further comprising the step of dynamically adding and deleting said filter rules to a database of filter rules to be enforced.

6. The method of claim 1, wherein said duration is determined adaptively in response to a count of a number of times that the blocking measure has been applied.

7. The method of claim 6, wherein said duration is adapted according to a monotone non-decreasing function of said count.

8. The method of claim 1, wherein said duration is a count of e-mail messages.

9. The method of claim 1, further comprising the step of selecting a level of certainty of said determining by selecting an appropriately corresponding length of an initial period of rules enforcement.

11. The method of claim 1, including deploying process software for said blocking spam at a firewall, said deploying comprising;

installing said process software on at least one server; and

executing said process software on said server to perform the steps of claim 1.

10. A method of responding to spam in a network, comprising the steps of:

determining whether an e-mail message arriving from a network connection is spam;

if so, applying a blocking measure for a duration;

suspending said blocking measure at the end of said duration and re-determining whether a subsequent e-mail message is spam; and

if so as re-determined, adapting said duration and re-applying said blocking measure for the adapted duration.

12. A program storage device readable by a machine, embodying a program of instructions executable by said machine to perform method steps for blocking spam at a firewall, said method steps comprising:

determining whether an e-mail message is spam;

if so, applying a blocking measure for a duration that is determined adaptively; and

suspending said blocking measure at the end of the duration.