Sender reputations for spam prevention

• US 20060168024A1
• Filed: 12/13/2004
• Published: 07/27/2006
• Est. Priority Date: 12/13/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mehr, John D., Rehfuss, Paul S., Howell, Nathan D.
• Granted Patent: US 7,610,344 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/306 User profiles

Abstract

Techniques are presented for assigning reputations to email senders. In one implementation, real-time statistics and heuristics are constructed, stored, analyzed, and used to formulate a sender reputation level for use in evaluating and controlling a given sender'"'"'s connection to an message transfer agent or email recipient. A sender with an unfavorable reputation may be denied a connection before resources are spent receiving and processing email messages from the sender. A sender with a favorable reputation may be rewarded by having safeguards removed from the connection, which also saves system resources. The statistics and heuristics may include real-time analysis of traffic patterns and delivery characteristics used by an email sender, analysis of content, and historical or time-sliced views of all of the above.

Claims

1. A method, comprising:

evaluating multiple characteristics of an email delivery to establish a reputation for a sender of the email; and

controlling a connection with the sender based on the reputation.

2. The method as recited in claim 1, wherein said evaluating multiple characteristics is performed in real time.

3. The method as recited in claim 1, wherein each of the multiple characteristics provides a heuristic to indicate a probability of a favorable or an unfavorable reputation.

4. The method as recited in claim 3, wherein said evaluating multiple characteristics includes determining a probability that the delivery is similar to a delivery of unsolicited commercial email resulting in an unfavorable reputation.

5. The method as recited in claim 1, wherein establishing a reputation includes:

evaluating a message content in addition to said evaluating multiple characteristics of a delivery; and

determining a similarity between the message content and an unsolicited commercial email content.

6. The method as recited in claim 1, wherein said evaluating multiple characteristics includes:

evaluating multiple characteristics of multiple delivery processes associated with multiple email messages from the sender;

counting instances of similarity between the evaluated characteristics and characteristics of unsolicited commercial email delivery; and

basing the reputation on the counted instances.

7. The method as recited in claim 1, wherein said evaluating multiple characteristics includes:

evaluating multiple delivery characteristics of multiple emails from the sender; and

establishing the reputation based on a statistical comparison between the evaluated multiple delivery characteristics and delivery characteristics of email sent by at least one different sender.

8. The method as recited in claim 1, wherein said evaluating multiple characteristics includes:

evaluating multiple delivery characteristics of multiple emails from the sender; and

comparing a quantity of the evaluated delivery characteristics with a threshold to determine a reputation.

9. The method as recited in claim 1, wherein said evaluating multiple characteristics includes:

evaluating multiple delivery characteristics of multiple emails from the sender; and

comparing a statistical distribution of the evaluated characteristics with a distribution profile of delivery characteristics associated with a sender of unsolicited commercial email.

10. The method as recited in claim 1, wherein said evaluating multiple characteristics includes:

evaluating multiple delivery characteristics of multiple emails from the sender; and

comparing a statistical distribution of the evaluated characteristics with a norm distribution profile of delivery characteristics associated with a mixture of different email senders.

11. The method as recited in claim 1, wherein controlling a connection with the sender comprises proactively filtering email from a sender with an unfavorable reputation.

12. The method as recited in claim 1, wherein controlling a connection with the sender comprises denying an SMTP simple mail transfer protocol connection with the sender if the sender has an unfavorable reputation.

13. The method as recited in claim 1, wherein controlling a connection with the sender comprises terminating an SMTP simple mail transfer protocol connection with the sender if the sender has an unfavorable reputation.

14. The method as recited in claim 1, wherein controlling a connection with the sender comprises removing a safeguard from the connection if the sender has a favorable reputation.

15. The method as recited in claim 14, wherein the safeguard comprises a spam filter.

16. The method as recited in claim 1, further comprising applying a machine learning process to said evaluating multiple characteristics.

17. The method as recited in claim 16, wherein the machine learning process classifies results of the evaluation of the delivery characteristics to establish the reputation.

18. The method as recited in claim 1, further comprising comparing a first group of the evaluated delivery characteristics evaluated during a first time period with a second group of the evaluated delivery characteristics evaluated during a second time period to detect a change in a delivery behavior of the sender.

19. The method as recited in claim 1, wherein one of the characteristics of email delivery to be used as a heuristic for said establishing a reputation comprises an open proxy status of the sender.

20. The method as recited in claim 1, wherein one of the characteristics of email delivery to be used as a heuristic for said establishing a reputation comprises a number of unique values provided by the sender in HELO and EHLO commands of SMTP simple mail transfer protocol.

21. The method as recited in claim 1, wherein one of the characteristics of email delivery to be used as a heuristic for said establishing a reputation comprises a number of times the sender submits a HELO or a EHLO command of SMTP simple mail transfer protocol that includes an Internet protocol address that does not match the originating Internet protocol address of the SMTP session.

22. The method as recited in claim 1, wherein one of the characteristics of email delivery to be used as a heuristic for said establishing a reputation comprises a number of times the sender submits a HELO or a EHLO command of SMTP simple mail transfer protocol that includes a domain name that is included in a list of locally supported domains on a receiving message transfer agent.

23. The method as recited in claim 1, wherein one of the characteristics of email delivery to be used as a heuristic for said establishing a reputation comprises a number of times the sender submits a DATA command of SMTP simple mail transfer protocol followed by no subsequent information before being terminated.

24. The method as recited in claim 23, further comprising determining if said no information followed the DATA command by measuring a size of a received header and subtracting the size from an overall size of the of information included in the DATA command.

25. The method as recited in claim 1, further comprising establishing a baseline reputation for the sender, comprising:

evaluating a content of each email message from the sender;

evaluating a ratio of emails that include favorable content to emails that include unfavorable content, per unit of time; and

evaluating changes in the ratio over multiple units of time.

26. The method as recited in claim 1, further comprising using a trainable filter to perform said evaluating multiple characteristics of an email delivery to establish a reputation for the sender.

27. The method as recited in claim 26, further comprising training the trainable filter by analyzing email delivery used by multiple senders.

28. The method as recited in claim 27, further comprising assigning a reputation based on a single email message received from the sender, wherein the trainable filter compares delivery characteristics of the single email message to delivery characteristics of the multiple senders.

29. A method, comprising:

determining values for delivery characteristics of a collection of email messages sent by one or more senders of unsolicited commercial email;

determining a profile for senders of unsolicited commercial email from a statistical relation between the determined values;

producing a classification function based on the profile; and

applying the classification function to delivery of an email message from a new sender to determine a likelihood that the new sender is a sender of unsolicited commercial email.

30. The method as recited in claim 29, wherein one of the delivery characteristics comprises an open proxy status of the sender.

31. The method as recited in claim 29, wherein one of the delivery characteristics comprises a number of unique values provided by the sender in HELO and EHLO commands of SMTP simple mail transfer protocol.

32. The method as recited in claim 29, wherein one of the delivery characteristics comprises a number of times the sender submits a HELO or a EHLO command of SMTP simple mail transfer protocol that includes an Internet protocol address that does not match the originating Internet protocol address of the SMTP session.

33. The method as recited in claim 29, wherein one of the delivery characteristics comprises a number of times the sender submits a HELO or a EHLO command of SMTP simple mail transfer protocol that includes a domain name that is included in a list of locally supported domains on a receiving message transfer agent.

34. The method as recited in claim 29, wherein one of the delivery characteristics comprises a number of times the sender submits a DATA command of SMTP simple mail transfer protocol followed by no subsequent information before being terminated.

35. A sender reputation level engine, comprising:

a traffic monitor to connect to at least one layer of an email network and monitor delivery of email;

a sender analysis engine to gather heuristic indications associated with the email delivery process used by each sender of email, wherein each heuristic indication relates a probability that a sender sends malicious email or unsolicited commercial email; and

a statistics engine to determine a reputation level for each sender from statistical analysis of the gathered heuristic indications, wherein a sender of malicious email or unsolicited commercial email is allotted an unfavorable reputation level.

36. The sender reputation level engine as recited in claim 35, further comprising a mail blocker to block communication from senders with unfavorable reputations.

37. The sender reputation level engine as recited in claim 35, further comprising a sender reputation database to store reputations and reputation statistics of multiple senders of email.

38. A computing device comprising the sender reputation level engine as recited in claim 35.

39. A system, comprising:

means for evaluating multiple characteristics of an email delivery to establish a reputation for a sender of the email based on the evaluated characteristics; and

means for controlling a connection with the sender based on the reputation.

40. The system as recited in claim 39, wherein the means for establishing a reputation includes means for comparing a quantity of the evaluated delivery characteristics with a threshold to determine a reputation.

41. The system as recited in claim 40, wherein the means for establishing a reputation includes means for comparing a statistical distribution of the evaluated characteristics with a distribution profile of delivery characteristics associated with a sender of unsolicited commercial email.

42. The system as recited in claim 39, wherein the means for establishing a reputation includes means for comparing a statistical distribution of the evaluated characteristics with a norm of delivery characteristics associated with a mixture of different email senders.

43. The system as recited in claim 39, wherein the means for controlling a connection includes means for proactively filtering email from a sender with an unfavorable reputation.

44. The system as recited in claim 39, wherein the means for controlling a connection includes means for denying an SMTP simple mail transfer protocol connection with the sender if the sender has an unfavorable reputation.

45. The system as recited in claim 39, wherein the means for evaluating includes a means for applying a machine learning process to said evaluating multiple characteristics, wherein the machine learning process classifies results of the evaluation of the delivery characteristics.

46. The system as recited in claim 39, further comprising means for comparing a first group of the evaluated delivery characteristics evaluated during a first time period with a second group of the evaluated delivery characteristics evaluated during a second time period to detect a change in a delivery behavior of the sender.

47. A readable medium including instructions capable of being read by a computing device to execute actions, including:

evaluating aspects of email delivery used by a sender of email messages;

comparing a statistical distribution of the evaluated aspects with a profile of delivery characteristics associated with a sender of unsolicited commercial email;

establishing a reputation for the sender based on said comparing; and

controlling a connection with the sender based on the reputation.

48. The readable medium as recited in claim 47, further including instructions to use an open proxy status of the sender as one of the aspects of email delivery to be used as a heuristic for establishing the reputation.

49. The readable medium as recited in claim 47, further including instructions to use a quantity of unique values provided by the sender in HELO and EHLO commands of SMTP simple mail transfer protocol as one of the aspects of email delivery to be used as a heuristic for establishing the reputation.

50. The readable medium as recited in claim 47, further including instructions to use a number of times the sender submits a HELO or a EHLO command of SMTP simple mail transfer protocol that includes an Internet protocol address that does not match the originating Internet protocol address of the SMTP session as one of the aspects of email delivery to be used as a heuristic for establishing the reputation.

51. The readable medium as recited in claim 47, further including instructions to use a number of times the sender submits a HELO or a EHLO command of SMTP simple mail transfer protocol that includes a domain name that is included in a list of locally supported domains on a receiving message transfer agent as one of the aspects of email delivery to be used as a heuristic for establishing the reputation.

52. The readable medium as recited in claim 47, further including instructions to use a number of times the sender submits a DATA command of SMTP simple mail transfer protocol followed by no subsequent information before being terminated as one of the aspects of email delivery to be used as a heuristic for establishing the reputation.

53. The readable medium as recited in claim 47, further including instructions to establish a baseline reputation for the sender, comprising:

evaluating a content of each email message from the sender;

evaluating a ratio of emails that include favorable content to emails that include unfavorable content, per unit of time; and

evaluating changes in the ratio over multiple units of time.

54. The readable medium as recited in claim 47, further including instructions to use a trainable filter to perform said evaluating multiple aspects of an email delivery to establish a reputation for the sender.

55. The readable medium as recited in claim 47, further including instructions to train the trainable filter by analyzing email delivery used by multiple senders.

56. The readable medium as recited in claim 55, further including instructions to assign a reputation based on a single email message received from the sender, wherein the trainable filter compares delivery characteristics of the single email message to delivery characteristics of the multiple senders.