Multipurpose internet mail extension (MIME) analysis

• US 20070061402A1
• Filed: 09/15/2005
• Published: 03/15/2007
• Est. Priority Date: 09/15/2005
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mehr, John, Howell, Nathan
• Application Number:
  US11/228,032
• Publication Number:
  US 20070061402A1
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Techniques that are employable to perform multipurpose internet mail extension (MIME) analysis are presented herein.

Claims

1. A method comprising:

deriving one or more expressions that represent a multipurpose internet mail extension (MIME) structure of an email; and

determining whether the email is spam based at least in part on the derived expressions.

2. A method as described in claim 1, wherein the one or more expressions represent media types and subtypes of portions included in the email and an arrangement of the portions, one to another.

3. A method as described in claim 2, wherein at least one said portion is designated as a beginning of the arrangement and another said portion is designated as an end of the arrangement.

4. A method as described in claim 1, wherein:

the derived expression represents an ordering of relative richness of media types of corresponding portions of the email; and

the determining is based at least in part on the ordering.

5. A method as described in claim 1, wherein the deriving includes:

constructing a virtual tree that represents the MIME structure of the email; and

generating the expressions as representations of individual features used in describing the virtual tree.

6. A method as described in claim 5, wherein:

the deriving includes constructing a virtual tree that represents the MIME structure of the email using a plurality of nodes; and

the ordering makes distinct a first and last child said node of each parent said node in the virtual tree.

7. A method as described in claim 1, wherein the determining includes executing one or more filters created based on an analysis of a multipurpose internet mail extension (MIME) structure of a plurality of other email.

8. A method comprising:

analyzing a multipurpose internet mail extension (MIME) structure of each of a plurality of email; and

creating a filter, based on the analysis, to identify unsolicited commercial email.

9. A method as described in claim 8, wherein:

the analyzing includes creating one or more expressions which represent the multipurpose internet mail extension (MIME) structure of each of the plurality of email; and

the one or more expressions represent media types and subtypes of portions included in each said email and an arrangement of the portions, one to another.

10. A method as described in claim 9, wherein at least one said portion is designated as a beginning of the arrangement and another said portion is designated as an end of the arrangement.

11. A method as described in claim 9, wherein:

the derived expression represents an ordering of relative richness of media types of corresponding portions of the email; and

the creating is performed such that the filter addresses the ordering when processing email.

12. A method as described in claim 8, wherein the analyzing includes:

constructing a virtual tree that represents the MIME structure of each said email; and

generating the expressions as representations of individual features used in describing the virtual tree.

13. A method as described in claim 8, wherein:

wherein the analyzing includes constructing a virtual tree that represents the MIME structure of the email using a plurality of nodes; and

the ordering makes distinct a first and last child said node of each parent said node in the virtual tree.

14. A method as described in claim 8, wherein the creating is performed using machine learning.

15. One or more computer readable media comprising computer executable instructions that, when executed on a computer, direct the computer to process email using a filter configured to identify unsolicited commercial email based at least in part on arrangement of media types of portions of an email, one to another.

16. One or more computer-readable media as described in claim 15, wherein the arrangement of the media types of the portions of the email is derived from a multipurpose internet mail extension (MIME) structure of the email

17. One or more computer-readable media as described in claim 15, wherein the computer-executable instructions direct the computer to identify unsolicited commercial email by:

deriving one or more expressions that represent a multipurpose internet mail extension (MIME) structure the email; and

compute a relative likelihood that the email is unsolicited commercial email based at least in part on the derived expressions.

18. One or more computer-readable media as described in claim 17, wherein the one or more expressions represent media types and subtypes of portions included in the email and an arrangement of the portions, one to another.

19. One or more computer-readable media as described in claim 18, wherein at least one said portion is designated as a beginning of the arrangement and another said portion is designated as an end of the arrangement.

20. One or more computer-readable media as described in claim 18, wherein the arrangement represents an ordering of relative richness of media types of corresponding portions of the email.