Methods and apparatus for identifying spam email

• US 20070271343A1
• Filed: 05/17/2006
• Published: 11/22/2007
• Est. Priority Date: 05/17/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: George, David Alson, Jennings, Raymond Byars
• Granted Patent: US 9,152,949 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/234 for tracking messages

Abstract

Methods and apparatus of classifying received email are provided. At least one initial desirability scan is performed on a received email. When the received email passes the at least one initial desirability scan, it is determined if the received email comprises one or more browser-interpretable scripts. When the received email comprises one or more browser-interpretable scripts, a secondary desirability scan is performed on the received email as a function of the one or more browser-interpretable scripts. The received email is identified as undesirable email when the received email fails the at least one initial desirability scan, or the received email fails the secondary desirability scan. The received e-mail is identified as desirable email when the received email does not comprise one or more browser-interpretable scripts or the received email passes the secondary desirability scan.

Claims

1. A method of classifying received electronic mail (email) comprising the steps of:

performing at least one initial desirability scan on a received email;

determining if the received email comprises one or more browser-interpretable scripts when the received email passes the at least one initial desirability scan;

performing a secondary desirability scan on the received email as a function of the one or more browser-interpretable scripts when the received email comprises one or more browser-interpretable scripts;

identifying the received e-mail as undesirable email when the received email fails the at least one initial desirability scan, or the received email fails the secondary desirability scan; and

identifying the received e-mail as desirable email when the received email does not comprise one or more browser-interpretable scripts or the received email passes the secondary desirability scan.

2. The method of claim 1, further comprising the step of discarding the undesirable email.

3. The method of claim 1, wherein the step of performing at least one initial desirability scan comprises the steps of:

identifying one or more uniform resource locators (URLs) in the received e-mail;

determining if the one or more URLs are associated with at least one of an undesirable domain name and an undesirable Internet Protocol (IP) address;

failing the received email when the one or more URLs are associated with at least one of an undesirable domain name and an undesirable IP address; and

passing the received email when the one or more URLs are not associated with at least one of an undesirable domain name and an undesirable IP address.

4. The method of claim 3, wherein the step of determining if the one or more URLs are associated with at least one of an undesirable domain name and an undesirable IP address, comprises the steps of:

reducing the one or more URLs to at least one of a domain name and an IP address;

determining if the one or more reduced URLs match an undesirable domain name or an undesirable IP address from a maintained list of known domain names and IP addresses.

5. The method of claim 4, wherein, in the step of determining if the one or more reduced URLs match an undesirable domain name or an undesirable IP address, the maintained list of known domain names and IP addresses are comprised in a local cache.

6. The method of claim 5, wherein the local cache comprises maintained domain name server data zone transfers and domain name server protocol.

7. The method of claim 4, wherein, in the step of determining if the one or more reduced URLs match an undesirable domain name or an undesirable IP address, the maintained list of known domain names and IP addresses are comprised in an augmented domain name server.

8. The method of claim 7, wherein the step of determining if the one or more reduced URLs match an undesirable domain name or an undesirable IP address, comprises the steps of:

providing the one or more reduced URLs to the augmented domain name server;

determining if an entry exists in the augmented domain name server matching the one or more reduced URLs;

creating at least one entry matching the one or more reduced URLs when an entry does not exits in the augmented domain name server;

returning an entry having a desirability indicator when the entry exists in the augmented domain name server.

9. The method of claim 8, wherein the step of creating an entry further comprises the step of providing a creation time stamp with the entry.

10. The method of claim 8, wherein, in the step of returning an entry, the desirability indicator comprises a flag designating a state of the entry as it pertains to undesirable origination.

11. The method of claim 8, wherein, in the step of returning an entry, the desirability indicator is determined in accordance with a creation timestamp of the entry.

12. The method of claim 1, wherein the step of performing a secondary desirability scan comprises the steps of:

simulating an invocation of each of the one or more browser-interpretable scripts;

determining if content exposed from each simulation is associated with at least one of an undesirable domain name and an undesirable IP address;

failing the received email when the content is associated with at least one of an undesirable domain name and an undesirable IP address; and

passing the received email when the content is not associated with at least one of an undesirable domain name and an undesirable IP address.

13. The method of claim 12, wherein, in the step of simulating an invocation, a receiver of the received email is protected from effects when invoking each of the one or more browser-interpretable scripts.

14. The method of claim 12, wherein the step of determining if the content exposed from each simulation is associated with at least one of an undesirable domain name and an undesirable IP address, comprises the steps of:

reducing the content to at least one of a domain name and an IP address;

determining if the reduced content matches an undesirable domain name or an undesirable IP address from a maintained list of known domain names and IP addresses.

15. The method of claim 14, wherein, in the step of determining if the reduced content matches an undesirable domain name or an undesirable IP address, the maintained list of known domain names and IP addresses are comprised in a local cache.

16. The method of claim 14, wherein, in the step of determining if the reduced content matches an undesirable domain name or an undesirable IP address, the maintained list of known domain names and IP addresses are comprised in an augmented domain name server.

17. The method of claim 16, wherein the step of determining if the reduced content matches an undesirable domain name or an undesirable IP address, comprises the steps of:

providing the reduced content to the augmented domain name server;

determining if an entry exists in the augmented domain name server matching the reduced content;

creating an entry matching the reduced content when an entry does not exits in the augmented domain name server;

returning an entry having a desirability indicator when the entry exists in the augmented domain name server.

18. Apparatus for classifying received electronic mail (email), comprising:

a memory; and

at least one processor coupled to the memory and operative to;

(i) perform at least one initial desirability scan on a received email;

(ii) determine if the received email comprises one or more browser-interpretable scripts when the received email passes the at least one initial desirability scan;

(iii) perform a secondary desirability scan on the received email as a function of the one or more browser-interpretable scripts when the received email comprises one or more browser-interpretable scripts;

(iv) identify the received e-mail as undesirable email when the received email fails the at least one initial desirability scan, or the received email fails the secondary desirability scan; and

(v) identify the received e-mail as desirable email when the received email does not comprise one or more browser-interpretable scripts or the received email passes the secondary desirability scan.

19. An article of manufacture for classifying received electronic mail (email), comprising a machine readable medium containing one or more programs which when executed implement the steps of:

performing at least one initial desirability scan on a received email;

determining if the received email comprises one or more browser-interpretable scripts when the received email passes the at least one initial desirability scan;

performing a secondary desirability scan on the received email as a function of the one or more browser-interpretable scripts when the received email comprises one or more browser-interpretable scripts;

identifying the received e-mail as undesirable email when the received email fails the at least one initial desirability scan, or the received email fails the secondary desirability scan; and

identifying the received e-mail as desirable email when the received email does not comprise one or more browser-interpretable scripts or the received email passes the secondary desirability scan.

20. A method for maintaining one or more entries on a domain name server (DNS) comprising the steps of:

receiving an update to the DNS;

determining if the update comprises a new entry for the DNS;

creating a new entry comprising a creation timestamp and a desirability indicator designating a state of the entry as it pertains to undesirable origination when the update comprises a new entry for the DNS;

modifying or deleting an existing entry on the DNS when the update does not comprise a new entry for the DNS.

21. The method of claim 20, wherein the step of modifying or deleting an existing entry comprises the steps of:

determining if the update comprises a modification of the existing entry when the update does not comprise a new entry for the DNS;

modifying the existing entry and retaining a creation timestamp of the existing entry when the update comprises a modification of an existing entry;

determining if the update comprises a deletion of the existing entry when the update does not comprise a modification of an existing entry; and

marking the existing entry as deleted and retaining the creation timestamp of the existing entry when the update comprises a deletion of the existing entry.

22. The method of claim 20, wherein a likelihood of the entry pertaining to undesirable origin is determined in accordance with the creation timestamp of the entry.

23. The method of claim 22, wherein the entry is less likely to pertain to undesirable origination as time increases from the creation timestamp of the entry.