E-mail management services

• US 20070156830A1
• Filed: 03/01/2007
• Published: 07/05/2007
• Est. Priority Date: 02/19/2002
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Postini Corporation
• Inventors: Cox, Fred, Akamine, Shinya, Lund, Peter, Oswall, Michael, Petry, Scott
• Granted Patent: US 8,725,889 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention provides an electronic message management system (EMS) that includes a real-time feedback loop where data is collected from the electronic messages on incoming connection attempts, outgoing delivery attempts, and message content analysis, and written to a centralized data matrix. A separate process accesses the data matrix and analyzes trends in that data. The detected data patterns, trends or behavior is based on configuration parameters for the recipient. Based on these determinations, the process is able to instruct components in the EMS to accept, redirect, refuse, modify, defer, or otherwise dispose of the connection request, the delivery attempt, or the message. Associated methods for managing the transmission of electronic messages are also disclosed.

Claims

1. A messaging system for managing the transmission of electronic messages from sending mail servers having a network domain associated therewith, comprising:

a data structure configured to store source data for at least some of the electronic messages and metadata derived from at least some of the electronic messages; and

a computer process operably coupled to the data structure, and configured to manage the transmission of a subsequent electronic message according, at least in part, to the source data and metadata in the data structure, thereby managing the transmission of the subsequent electronic message based on a reputation of the network domain associated therewith.

2. The messaging system of claim 1, wherein managing the transmission of the subsequent electronic message comprises determining a status of the electronic message to be one of spam email or not spam email.

3. The messaging system of claim 1, wherein the computer process is further configured to generate processing instructions for managing the transmission of the subsequent electronic message.

4. The messaging system of claim 3, wherein the processing instructions comprise disposition instructions.

5. The messaging system of claim 4, wherein the disposition instructions comprise instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message redirect;

connection rejection; and

black hole.

6. The messaging system of claim 1, wherein the reputation of the network domain is established by the computer process based, at least in part, on a number of electronic messages sent from an internet protocol address associated with the network domain using the stored source data.

7. The messaging system of claim 1, wherein the reputation of the network domain is established by the computer process based, at least in part, on a number of electronic messages sent from an internet protocol address associated with the network domain and identified as spam using the stored source data and metadata.

8. The messaging system of claim 1, wherein the reputation of the network domain is established by the computer process based, at least in part, on a number of electronic messages sent from an internet protocol address associated with the network domain and identified as having unwanted attachments or unwanted content using the stored source data and metadata.

9. The messaging system of claim 1, wherein the computer process further comprises:

a traffic monitor configured to collect incoming SMTP connection data, or message metadata, or both, associated with at least some of the electronic messages;

an interpreter process operably associated with the traffic monitor, and configured to recognize patterns in the traffic monitor data; and

a mail handler configured to block the transmission of the subsequent electronic message based on a relationship between the electronic message and a recognized pattern in the traffic monitor data.

10. The messaging system of claim 1, wherein the metadata derived from the electronic messages is selected from the group consisting of:

count of connection attempts from a source IP address;

count of current open connections form source IP address;

duration of connections from source IP address;

count of messages from source IP address;

count of messages from a network domain;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content; and

count of messages from source IP address against which the disposition option was blocked, black-holed spooled, or quarantined.

11. An email messaging system, comprising an email server configured to receive emails from a sending mail server having a network domain associated therewith, the email server comprising an email filter configured to manage the transmission of a subsequent email based on source data and metadata of received emails associated with the network domain.

12. The email messaging system of claim 11, wherein the source data and metadata are employed in establishing a reputation of the network domain, and wherein the email filter is configured to manage the transmission of the subsequent email as a function of the network domain reputation.

13. The email messaging system of claim 11, wherein the email server comprises:

a data structure configured to store source data for at least some of the emails and metadata derived from at least some of the emails; and

a computer process operably coupled to the data structure, and configured to manage the transmission of the subsequent email according, at least in part, on the source data and metadata in the data structure, thereby managing transmission of the email based on a reputation of the domain associated therewith.

14. The email messaging system of claim 13, wherein managing the transmission of the subsequent email comprises determining a status of the email to be one of spam email or not spam email.

15. The email messaging system of claim 13, wherein the computer process is further configured to generate processing instructions for managing the transmission of the subsequent email.

16. The email messaging system of claim 15, wherein the processing instructions comprise disposition instructions.

17. The email messaging system of claim 16, wherein the disposition instructions comprise instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message redirect;

connection rejection; and

black hole.

18. The email messaging system of claim 13, wherein the reputation of the network domain is established by the computer process based, at least in part, on a number of emails sent from an internet protocol address associated with the network domain using the stored source data.

19. The email messaging system of claim 13, wherein the reputation of the network domain is established by the computer process based, at least in part, on a number of emails sent from an internet protocol address associated with the network domain and identified as spam using the stored source data and metadata.

20. The email messaging system of claim 13, wherein the reputation of the network domain is established by the computer process based, at least in part, on a number of emails sent from an internet protocol address associated with the network domain and identified as having unwanted attachments or unwanted content using the stored source data and metadata.

21. The email messaging system of claim 13, wherein the computer process further comprises:

a traffic monitor configured to collect incoming SMTP connection data, or message metadata, or both, associated with at least some of the emails;

an interpreter process operably associated with the traffic monitor, and configured to recognize patterns in the traffic monitor data; and

a mail handler configured to block the transmission of the subsequent email based on a relationship between the subsequent email and a recognized pattern in the traffic monitor data.

22. The method of claim 11, wherein the metadata derived from the electronic messages is selected from the group consisting of:

count of connection attempts from a source IP address;

count of current open connections form source IP address;

duration of connections from source IP address;

count of messages from source IP address;

count of messages from a network domain;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content; and

count of messages from source IP address against which the disposition option was blocked, black-holed spooled, or quarantined.

23. A method of managing the transmission of incoming electronic messages from sending email servers having respective network domains associated therewith, wherein electronic messages from the sending mail servers comprise source data, comprising:

storing the source data for at least some of the incoming electronic messages;

supplementing the source data with metadata derived from at least some of the electronic messages; and

managing the transmission of a subsequent electronic message based on the stored source data and the metadata, thereby managing the transmission of the electronic message based on a reputation of the network domain associated therewith.

24. The method of claim 23, wherein managing the transmission of the subsequent electronic message comprises determining a status of the electronic message to be one of spam email or not spam email.

25. The method of claim 23, wherein managing the transmission of the subsequent electronic message comprises generating processing instructions for the management thereof.

26. The method of claim 25, wherein the processing instructions comprise disposition instructions.

27. The method of claim 26, wherein the disposition instructions comprise instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message redirect;

connection rejection; and

black hole.

28. The method of claim 23, wherein the metadata derived from the electronic messages is selected from the group consisting of:

count of connection attempts from a source IP address;

count of current open connections form source IP address;

duration of connections from source IP address;

count of messages from source IP address;

count of messages from a network domain;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content; and

count of messages from source IP address against which the disposition option was blocked, black-holed spooled, or quarantined.

29. A method for managing received emails, comprising:

receiving emails from a sending mail server having a network domain associated therewith;

storing source data for at least some of the received emails;

supplementing the stored source data with metadata associated with the received emails for at least some of the received emails; and

managing the transmission of a subsequent email based on the stored source data and metadata.

30. The method of claim 29, wherein managing the transmission of the subsequent email comprises determining a status of the subsequent email as spam email or not spam email.

31. The method of claim 29, wherein the stored source data and metadata, at least in part, reflect a reputation of the network domain associated with the sending mail server.

32. The method of claim 29, wherein the managing of the subsequent email is further based on metadata associated therewith.

33. The method of claim 29, wherein the metadata derived from the emails is selected from the group consisting of:

count of connection attempts from a source IP address;

count of current open connections form source IP address;

duration of connections from source IP address;

count of messages from source IP address;

count of messages from a network domain;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content; and

count of messages from source IP address against which the disposition option was blocked, black-holed spooled, or quarantined.