Method and system for recognizing spam email

• US 20070185960A1
• Filed: 02/03/2006
• Published: 08/09/2007
• Est. Priority Date: 02/03/2006
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Leiba, Barry, Segal, Richard, Rajan, Vadakkedathu, Ossher, Joel, Wegman, Mark
• Granted Patent: US 7,475,118 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A method includes steps of receiving an email message comprising a plurality of packets and delivery-path information; determining a path for the email using the delivery-path information; comparing the path with a plurality of prior email paths; determining a measure of similarity between the path of the email received and one or more of the plurality of prior email paths; and determining a spam score for the email received, based on the measure of similarity. Other embodiments include a computer readable medium comprising computer code for performing the above function and an information processing system including a processor configured (i.e., hard-wired or programmed) to perform the method.

Claims

1. A computer-implemented method comprising steps of:

receiving an email message comprising a plurality of packets, delivery-path information comprising one or more elements, and at least one recipient for the email message;

determining a network path for the email using the one or more elements of the delivery-path information;

comparing the path with a plurality of prior email paths;

determining a measure of similarity between the path of the email received and one or more of the plurality of prior email paths; and

determining a spam score for the email received, based on the measure of similarity.

2. The method of claim 1, further comprising not forwarding the email message to the at least one recipient when the email message is determined to comprise spam.

3. The method of claim 1, wherein the delivery-path information comprises received lines and the method further comprises:

analyzing the received lines in the email message header;

extracting from the received lines a list of IP addresses and mail domains through which the email purportedly passed, and

comparing the IP addresses with a learned database of delivery paths comprising IP addresses along each delivery path.

4. The method of claim 3, wherein, prior to receiving the email message, the method comprises:

creating the learned database for storing the plurality of prior email paths by training a starting set of sorted messages comprising spam and non-spam messages; and

storing a starting spam score for each IP address stored in the database, wherein the spam scores indicate a likelihood that the email received is spam.

5. The method of claim 4, further comprising updating the database by receiving votes from users receiving emails, wherein each vote indicates whether the user regards the email to be spam or non-spam.

6. The method of claim 5, further comprising combining portions of the IP addresses as they are stored.

7. The method of claim 6, further comprising aggregating IP addresses as the database is trained.

8. The method of claim 1, further comprising, after evaluating each address starting with the most recent, accumulating a weighted average, and giving more weight to exact database-matches than to those that were obtained only from other nearby addresses.

9. The method of claim 1 further comprising detecting and eliminating fake information, and providing a score for the message as a whole.

10. The method of claim 1 further comprising applying a credibility function on the network path followed by the email message.

11. The method of claim 1 further comprising:

applying a relationship function to the network path followed by the email message.

12. The method of claim 11 wherein the step of applying the credibility function comprises:

considering each node in the network path separately;

determining a preliminary credibility for each node;

using that preliminary credibility, and the credibility of one or more other nodes in the path, to determine the credibility of that node.

13. The method of claim 11 wherein the step of determining the preliminary credibility comprises counting the frequency of messages of each classification that were previously sent by each node.

14. The method of claim 7, wherein aggregating IP addresses is based on domain ownership.

15. The method of claim 11 wherein at least one node is represented by its IP address.

16. The method of claim 11 wherein at least one node is represented by the DNS name of the gateway computer.

17. The method of claim 12 wherein the step of using that preliminary credibility comprises examining the nodes from most recent to earliest;

assigning each node a credibility no better than that of the previously examined node.

18. The method of claim 12 wherein a node with insufficient history for an adequate count in the counting step is given low credibility.

19. A computer readable medium comprising program code for:

receiving an email message comprising a plurality of packets and delivery-path information;

determining a path for the email using the delivery-path information;

comparing the path with a plurality of prior email paths;

determining a measure of similarity between the path of the email received and one or more of the plurality of prior email paths; and

determining a spam score for the email received, based on the measure of similarity.

20. An information processing system comprising:

a processor configured for;

receiving an email message comprising a plurality of packets and delivery-path information;

determining a path for the email using the delivery-path information;

comparing the path with a plurality of prior email paths;

determining a measure of similarity between the path of the email received and one or more of the plurality of prior email paths; and

determining a spam score for the email received, based on the measure of similarity.