Method, system, apparatus, and software product for filtering out spam more efficiently

• US 20060277264A1
• Filed: 06/07/2005
• Published: 12/07/2006
• Est. Priority Date: 06/07/2005
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Nokia Corporation
• Inventors: Rainisto, Jonni
• Granted Patent: US 8,135,779 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method, network element, system, and software product are presented for differentiating spam from email so that the spam can be deleted, or placed in a separate location, or identified as spam. Email is received at a server, and the email is initially filtered to differentiate at least part of the spam from the other email. Then the filter is improved, for example by using an updated database to identify spam. Subsequently, the email is intermediately filtered to differentiate further spam at least once before a user device attempts to access the email. Some of the further spam was overlooked by the initial filtering, but not overlooked by the intermediate filtering.

Claims

1. A method for differentiating spam from non-spam, comprising:

receiving email at a server,

initially filtering the email to differentiate at least part of the spam from the non-spam,

improving the filtering over time by using an updated spam filter, and

intermediately filtering the email to differentiate further spam at least once before a user device attempts to access the email,

wherein at least part of the further spam was overlooked by the initial filtering.

2. The method of claim 1, wherein the step of intermediately filtering is performed while maintaining filter processing demand below a filter processing power threshold.

3. The method of claim 1,

wherein each of the intermediate filterings only filters a portion of electronic mail that was received at the server recently enough to substantially avoid redundant effective filtering, and

wherein the portion of electronic email was also received at the server a long enough time ago to substantially ensure effective filtering due to the improving step.

4. The method of claim 1, further comprising the step of finally filtering the email in response to the user device attempting to access the email.

5. The method of claim 4,

wherein the email is unopened email that excludes previously filtered spam, and

wherein the intermediate filtering only occurs if there is more than a particular amount of the email to be filtered, or if an email storage threshold is reached at the server.

6. The method of claim 4, wherein the intermediate filtering only occurs if available processing capability exceeds a particular amount that is above average.

7. The method of claim 1, wherein the initial filtering and the intermediate filtering have at least one filtering technique in common.

8. The method of claim 1, wherein commencement of the initial filtering and each of said intermediate filterings are separated by at least a minimum period of time for any single piece of the email.

9. The method of claim 7, wherein the at least one filtering technique is enhanced between said initial filtering and at least one of said intermediate filtering, at least by using an improved database.

10. The method of claim 9, wherein the improved database is developed at least partly by using information gleaned from the initial filtering.

11. A system for differentiating spam from non-spam, comprising:

a server for receiving email,

a filter, responsive to receipt of the email, for initially filtering the email to differentiate at least part of the spam from the non-spam,

a filter improvement module, for improving the filter over time, in response to a filter improvement signal, and

a user device, for accessing the email,

wherein the filter is also for intermediately filtering the email to differentiate further spam at least once before the user device attempts to access the email, and

wherein at least part of the further spam was overlooked by the initial filtering.

12. The system of claim 11, wherein the filter is responsive to a threshold signal indicating that filter processing demand is above a filter processing power threshold, and wherein the filter is configured to postpone the intermediate filtering due to the threshold signal.

13. The system of claim 11,

wherein the intermediate filtering only filters a portion of electronic mail that was received at the server recently enough to substantially avoid redundant effective filtering, and

wherein the portion of electronic email was also received at the server a long enough time ago to substantially ensure effective filtering due to the improving of the filter.

14. The system of claim 11, wherein the filter is also for finally filtering the email in response to the user device attempting to access the email.

15. The system of claim 11, wherein the initial filtering and the intermediate filtering have at least one filtering technique in common.

16. The system of claim 11, wherein commencement of the initial filtering and each of said intermediate filtering are separated by at least ten minutes for any single piece of the email.

17. A network element for differentiating spam from email received by a server, comprising:

a filter, responsive to receipt of email, for initially filtering the email to differentiate at least part of the spam from the non-spam, and

a filter improvement module, for improving the filter in response to a filter improvement signal,

wherein the filter is also for intermediately filtering the email to differentiate further spam at least once before the network element detects an attempt to access the email by a user device, and

wherein at least part of the further spam was overlooked by the initial filtering.

18. The network element of claim 17, wherein the filter is responsive to a threshold signal indicating that filter processing demand is above a filter processing power threshold, and wherein the filter is configured to postpone the intermediate filtering due to the threshold signal.

19. The network element of claim 17,

wherein the intermediate filtering only filters a portion of electronic mail that was received recently enough to substantially avoid redundant effective filtering, and

wherein the portion of electronic email was also received a long enough time ago to substantially ensure effective filtering due to the improving of the filter.

20. The network element of claim 17, wherein the initial filtering and the intermediate filtering have at least one filtering technique in common.

21. The network element of claim 17, wherein commencement of the initial filtering and each of said intermediate filtering are separated by at least ten minutes for any single piece of the email.

22. A software product for differentiating spam from non-spam received by a server, the software product comprising a computer readable medium having executable codes embedded therein;

the codes, when executed, being adapted to carry out the steps of;

initially filtering the email to differentiate at least part of the spam from the non-spam,

improving the filter, and

intermediately filtering the email to differentiate further spam at least once before a user device attempts to access the email,

wherein at least part of the further spam was overlooked by the initial filtering.

23. The software of claim 22, wherein the step of intermediately filtering is performed while maintaining filter processing demand below a filter processing power threshold.

24. The software product of claim 22,

wherein each of the intermediate filterings only filters a portion of electronic mail that was received at the server recently enough to substantially avoid redundant effective filtering, and

wherein the portion of electronic email was also received at the server a long enough time ago to substantially ensure effective filtering due to the improving step.

25. The software product of claim 22, wherein the product is also for finally filtering the email in response to the user device attempting to access the email.

26. The software product of claim 22, wherein the initial filtering and the intermediate filtering have at least one filtering technique in common.

27. The software product of claim 22, wherein commencement of the initial filtering and each of said intermediate filtering are separated by at least ten minutes for any single piece of the email.