Method and apparatus for preventing outgoing spam e-mails by monitoring client interactions

• US 20070282955A1
• Filed: 05/31/2006
• Published: 12/06/2007
• Est. Priority Date: 05/31/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Lin, Frank C., Wang, Xiangrong, Shi, Hang
• Granted Patent: US 8,601,065 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Methods and apparatus for preventing spam e-mail messages from being propagated or transmitted by monitoring user interaction events associated with the system are disclosed. According to one aspect of the present invention, a method for processing a first e-mail message on a system that transmits e-mail message and has an input device includes identifying an attempt to transmit the first e-mail message; and determining whether a user interaction event has occurred within a given time interval. If it is determined that a user interaction event has not occurred within the given time interval, the first e-mail message is prevented from being transmitted.

Claims

1. A method for processing a first e-mail message on a system, the system being arranged to transmit e-mail messages, the system including at least one input device, the method comprising:

identifying an attempt to transmit the first e-mail message;

determining whether an interaction event has occurred within a given time interval; and

preventing the first e-mail message from being transmitted if it is determined that the interaction event has not occurred within the given time interval.

2. The method of claim 1 wherein identifying the attempt to transmit the first e-mail message includes:

capturing at least one packet associated with the first e-mail message; and

identifying the at least one packet as having a protocol associated with the e-mail messages.

3. The method of claim 2 wherein the protocol is one selected from the group including a simple mail transfer protocol (SMTP), an internet message access protocol (IMAP), a post office protocol (POP), an HTTP protocol, and a protocol associated with a messaging application programming interface (MAPI).

4. The method of claim 1 wherein the interaction event is a user interaction event, and determining whether the user interaction event has occurred within the given time interval includes:

obtaining a timestamp associated with the user interaction event, the timestamp being arranged to indicate a time associated with an occurrence of the user interaction event;

determining a first time, the first time being a time associated with the attempt to transmit the first e-mail message; and

determining if the difference between the first time and the timestamp exceeds the given time interval, wherein if the difference between the first time and the timestamp exceeds the given time interval, it is determined that the user interaction event has not occurred within the given time interval.

5. The method of claim 4 wherein the user interaction event is a most recent user interaction event associated with the system.

6. The method of claim 4 wherein the timestamp associated with the user interaction event is obtained from a database.

7. The method of claim 1 wherein the at least one input device is a keyboard, and the interaction event is a keyboard activity.

8. The method of claim 1 wherein the at least one input device is a mouse, and the interaction event is a mouse click.

9. The method of claim 1 further including:

transmitting the first e-mail message if it is determined that the interaction event has occurred within the given time interval.

10. The method of claim 1 further including identifying the first e-mail message as being a spam e-mail message if it is determined that the interaction event has not occurred within the given time interval.

11. The method of claim 1 wherein the interaction event is a user interaction event.

12. A system arranged to process a first e-mail message, the system being arranged to transmit e-mail messages, the system comprising:

means for identifying an attempt to transmit the first e-mail message;

means for determining whether an interaction event has occurred within a given time interval; and

means for preventing the first e-mail message from being transmitted if it is determined that the interaction event has not occurred within the given time interval.

13. A computer-program product for processing a first e-mail message comprising:

computer code that causes an attempt to transmit the first e-mail message to be identified;

computer code that causes a determination of whether an interaction event has occurred within a given time interval;

computer code that prevents the first e-mail message from being transmitted if it is determined that the interaction event has not occurred within the given time interval; and

a computer-readable medium that stores the computer codes.

14. The computer-program product of claim 13 further including:

computer code that causes a time associated with an occurrence of the interaction even to be recorded, wherein the time is recorded as a timestamp; and

computer code that causes the timestamp to be stored.

15. The computer-program product of claim 14 further including:

computer code that causes a first time to be identified, the first time being associated with a time at which the attempt to transmit the first e-mail message occurs.

16. The computer-program product of claim 15 wherein the computer code that causes the determination of whether the interaction event has occurred within the given time interval includes computer code that causes a comparison of a difference between the first time and the timestamp with the given time interval.

17. The computer-program product of claim 13 further including:

computer code that causes at least one packet associated with the first e-mail message to be intercepted.

18. The computer-program product of claim 17 further including:

computer code that causes wherein a protocol associated with the at least one packet to be identified, wherein if the protocol is identified as an e-mail protocol, the attempt to transmit the first e-mail message is detected.

19. The computer-program product of claim 13 further including:

computer code that causes the user interaction event to be captured.

20. The computer-program product of claim 13 further including:

computer code that causes a packet associated with the first e-mail message to be captured.

21. An apparatus for processing a first e-mail message generated by an application, the apparatus being arranged on a computing system, the apparatus comprising:

a first activity detector, the first activity detector being arranged to detect an attempt to transmit the first e-mail message; and

a second activity detector, the second activity detector being arranged to determine if an interaction event has occurred within a given time interval, wherein if it is determined that user interaction event has not occurred within the given time interval, the first e-mail message is identified as being a spam e-mail message.

22. A method for processing a first e-mail message on a system, the system being arranged to transmit e-mail messages, the method comprising:

identifying an attempt to transmit the first e-mail message;

determining whether an event has occurred within a given time interval; and

identifying the first e-mail message as being spam if it is determined that the event has not occurred within the given time interval.

23. The method of claim 22 wherein the e-mail messages include prescheduled e-mail messages, and determining whether the event has occurred within the given time interval includes determining whether a prescheduled event has occurred within the given time interval.

24. The method of claim 23 wherein identifying the first e-mail message as being spam if it is determined that the event has not occurred within the given time interval includes identifying the first e-mail message as being spam if it is determined that the prescheduled event has not occurred within the given time interval.

25. The method of claim 22 wherein determining whether the event has occurred within the given time interval includes determining whether a user interaction event has occurred within the given time interval.

26. A system arranged to process a first e-mail message, the system being arranged to transmit e-mail messages, the system comprising:

means for identifying an attempt to transmit the first e-mail message;

means for determining whether an event has occurred within a given time interval; and

means for identifying the first e-mail message as being spam if it is determined that the event has not occurred within the given time interval.

27. A computer-program product for processing a first e-mail message, the computer-program product comprising:

computer code that causes an attempt to transmit the first e-mail message to be identified;

computer code that causes a determination of whether an event has occurred within a given time interval;

computer code that causes the first e-mail message to be identified as being spam if it is determined that the event has not occurred within the given time interval; and

a computer-readable medium that stores the computer codes.

28. The computer-program product of claim 27 wherein the e-mail messages include prescheduled e-mail messages, and the computer code that causes the determination of whether the event has occurred within the given time interval includes computer code that causes a determination of whether a prescheduled event has occurred within the given time interval.

29. The computer-program product of claim 28 wherein the computer code that causes the first e-mail message to be identified as being spam if it is determined that the event has not occurred within the given time interval includes computer code that causes the first e-mail message to be identified as being spam if it is determined that the prescheduled event has not occurred within the given time interval.

30. The computer-program product of claim 27 wherein the computer code that causes the determination of whether the event has occurred within the given time interval includes computer code that causes a determination of whether a user interaction event has occurred within the given time interval.