Method and system for identifying and blocking spam email messages at an inspecting point

• US 20060075048A1
• Filed: 12/07/2004
• Published: 04/06/2006
• Est. Priority Date: 09/14/2004
• Status: Abandoned Application

• Current Assignee: Aladdin Knowledge Systems Limited (Thales SA)
• Original Assignee: Aladdin Knowledge Systems Limited (Thales SA)
• Inventors: Gruper, Shimon, Margalit, Yanki, Margalit, Dany
• Application Number:
  US11/004,942
• Publication Number:
  US 20060075048A1
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

In one aspect, the present invention is directed to a method for identifying and blocking spam email messages at an inspecting point, the method comprises the steps of: measuring the flow rate of email messages sent from an originator through the inspecting point; and if the measured flow rate exceeds a given threshold, email messages transmitted from the originator are classified as spam and/or the originator is classified as a spammer. In another aspect, the present invention is directed to a system for identifying and blocking spam email messages at an inspecting point, the system comprising: a spam detector, for classifying an email message as spam-suspected; a flow rate calculator, for calculating a flow rate of spam-suspected email messages that have reached the inspecting point; a spam indicator, for classifying spam-suspected email messages as spam by their flow rate and a threshold thereof.

Claims

1. A method for identifying and blocking spam email messages at an inspecting point, the method comprising the steps of:

a. measuring a flow rate of email messages sent from an originator through said inspecting point;

b. if the measured flow rate exceeds a given threshold, performing at least one action selected from the group consisting of classifying email messages transmitted from said originator as spam, and classifying said originator as a spammer.

2. A method according to claim 1, further comprising:

c. holding spam suspected email messages at said inspecting point, and

d. releasing said spam suspected email messages upon indicating said messages as non-spam email messages.

3. A method according to claim 1, wherein said flow rate is based on a number of email messages received at said gateway from said originator in a time period.

4. A method according to claim 1, wherein said flow rate is based on a number of email messages received from two or more originators having a common denominator at said gateway in a time period.

5. A method according to claim 4, wherein said common denominator is selected from a group comprising:

a domain, an email address, at least one keyword within texts of said email messages, at least one keyword within titles of said email messages, at least one keyword within an email address of the originator of said email messages, at least one keyword within an email address of at least one recipient of said email messages.

6. A method according to claim 1, wherein said inspecting point is selected from a group comprising:

a gateway server, a mail server, a firewall server, a proxy server, an ISP server, a VPN server, and a server that filters incoming data to an organization network.

7. A system for identifying and blocking spam email messages at an inspecting point, the system comprising:

a spam detector, for classifying an email message as spam-suspected;

a flow rate calculator, for calculating a flow rate of spam-suspected email messages that have arrived at said inspecting point;

a spam indicator, for classifying spam-suspected email messages as spam by their flow rate and a threshold of said flow rate.

8. A system according to claim 7, wherein said flow rate calculator comprises:

a clock device, for indicating a time period;

a counter, for counting spam-suspected email messages;

said flow rate then being computed from said time period and from a count produced by said counter.

9. A system according to claim 7, wherein said flow rate calculator comprises:

a clock device, for indicating a time period;

a database, for storing information about spam-suspected email messages that have reached to said inspecting point;

said flow rate then being calculated from said time period and from said information.

10. A system according to claim 7, wherein said spam detector is a computerized facility.

11. A system according to claim 7, wherein said flow rate calculator is a computerized facility.

12. A system according to claim 7, wherein said spam indicator is a computerized facility.