Using IP address and domain for email spam filtering

• US 20060168041A1
• Filed: 01/07/2005
• Published: 07/27/2006
• Est. Priority Date: 01/07/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hulten, Geoffrey J., Goodman, Joshua T., Mishra, Manav, Murphy, Elissa E.S., Yih, Wen-Tau
• Granted Patent: US 7,689,652 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 61/4555 Directories for electronic mail or instant messaging
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Email spam filtering is performed based on a combination of IP address and domain. When an email message is received, an IP address and a domain associated with the email message are determined. A cross product of the IP address (or portions of the IP address) and the domain (or portions of the domain) is calculated. If the email message is known to be either spam or non-spam, then a spam score based on the known spam status is stored in association with each (IP address, domain) pair element of the cross product. If the spam status of the email message is not known, then the (IP address, domain) pair elements of the cross product are used to lookup previously determined spam scores. A combination of the previously determined spam scores is used to determine whether or not to treat the received email message as spam.

Claims

1. A method, comprising:

receiving an email message that is assumed to be non-spam;

determining an IP address associated with a sender of the email message;

determining a domain from which the email message appears to have been sent;

automatically determining an IP/domain spam score; and

automatically associating the IP/domain spam score with a combination of the IP address and the domain.

2. The method as recited in claim 1, wherein the email message is received via user feedback.

3. The method as recited in claim 1, wherein automatically determining the IP/domain spam score comprises utilizing a machine learning algorithm.

4. The method as recited in claim 1, wherein determining the IP address comprises determining one or more IP address portions based on the IP address associated with the sender of the email message.

5. The method as recited in claim 1, wherein determining the domain comprises determining one or more domain portions based on the domain from which the email message appears to have been sent.

6. The method as recited in claim 1, wherein automatically determining the IP/domain spam score comprises:

identifying a previously generated spam score associated with the domain;

determining a message spam score that is based on the email message assumed to be non-spam; and

combining the message spam score with the previously generated spam score to generate the IP/domain spam score.

7. The method as recited in claim 6, wherein the combining comprises calculating a sum of the previously generated spam score and the message spam score.

8. The method as recited in claim 1, further comprising:

generating an IP address set comprising one or more portions of the IP address;

generating a domain set comprising one or more portions of the domain;

generating an IP/domain set by computing a cross-product of the IP address set and the domain set; and

for each element of the IP/domain set;

determining an element spam score; and

associating the element spam score with the element of the IP/domain set.

9. An electronic mail server system configured to implement the method as recited in claim 1.

10. An electronic mail client application configured to implement the method as recited in claim 1.

11. A method comprising:

receiving an email message;

determining an IP address associated with a sender of the email message;

determining a domain from which the email message appears to have been sent;

generating an IP address set comprising multiple portions of the IP address;

generating a domain set comprising one or more portions of the domain;

generating an IP/domain set by computing a cross-product of the IP address set and the domain set;

for each element of the IP/domain set, identifying a previously determined element spam score;

determining a message spam score by combining the previously determined element spam scores; and

determining whether to treat the email message as spam based on the message spam score.

12. The method as recited in claim 11, wherein determining the message spam score further comprises combining the previously determined element spam scores with a previously determined spam score associated with the IP address associated with the sender of the email message.

13. The method as recited in claim 11, wherein determining the message spam score further comprises combining the previously determined element spam scores with a previously determined spam score associated with the domain from which the email message appears to have been sent.

14. The method as recited in claim 11, wherein combining the previously determined element spam scores comprising calculating a sum of the previously determined element spam scores.

15. The method as recited in claim 11, wherein determining whether to treat the email message as spam comprises:

comparing the message spam score to a spam score threshold; and

in an event that the message spam score is greater than the spam score threshold, processing the email message by performing at least one of;

deleting the email message, delivering the email message as junk mail, or flagging the email message as spam.

16. An electronic mail server system configured to implement the method as recited in claim 11.

17. An electronic mail client application configured to implement the method as recited in claim 11.

18. A system, comprising:

a sender IP determination module configured to determine an IP address from which a received email message was sent;

a sender domain determination module configured to determine a domain from which the received email message appears to have been sent;

an IP X domain generation module configured to;

expand the IP address into a set of partial IP addresses;

expand the domain into a set of domain portions; and

generate a cross product of the set of partial IP address and the set of domain portions (IP X Domain);

a machine learning algorithm configured to calculate a spam score to be associated with an element of (IP X Domain); and

a data repository configured to maintain an association between the element of (IP X Domain) and the spam score.

19. The system as recited in claim 18, further comprising:

a filtering module configured to classify a received email message as good or spam based, at least in part, on the previously determined spam score.

20. The system as recited in claim 18, embodied as an electronic mail spam filter.