IDENTIFYING UNWANTED ELECTRONIC MESSAGES

• US 20080120704A1
• Filed: 01/28/2008
• Published: 05/22/2008
• Est. Priority Date: 04/30/2001
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: AOL LLC (Apollo Global Management, Inc.)
• Inventors: Sutton, Lorin, Adamski, Michael, Despeaux, Craig
• Granted Patent: US 7,954,155 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An unwanted message may be identified by inspecting the payload portion of a message being communicated, comparing the characteristics of the payload portion with stored data indicating characteristics of other messages, and identifying a security condition based on a comparison of the message inspected. The characteristics inspected may include the payload portion of a message or the whole message when the characteristics are being compared against messages being exchanged on more than one local exchanging system. Furthermore, the characteristics of messages may be tracked for comparison against the characteristics of future messages. A threshold number of those characteristics may subsequently implicate a hostile security condition, even if a current comparison of these characteristics does not reach the threshold necessary to implicate a hostile security condition.

Claims

1. A method of processing messages, the method comprising:

receiving a first electronic message sent to an intended recipient;

accessing, from electronic storage, data used to identify unacceptable messages;

analyzing the first electronic message with respect to the accessed data used to identify unacceptable messages;

determining that the first electronic message is presently acceptable based on the analysis of the first electronic message;

causing the first electronic message to be stored in electronic storage such that the intended recipient is able to access the first electronic message;

tracking a location of the first electronic message stored in the electronic storage;

receiving a second electronic message subsequent to receipt of the first electronic message;

inspecting the second electronic message;

updating the data used to identify unacceptable messages based on the inspection of the second electronic message;

reassessing whether the first electronic message is acceptable based on the update to the data used to identify unacceptable messages;

determining that the first electronic message is now unacceptable based on the reassessment of the first electronic message;

based on the determination that the first electronic message is now unacceptable, removing the first electronic message from the electronic storage using the tracked location of the first electronic message.

2. The method of claim 1 wherein causing the first electronic message to be stored in electronic storage such that the intended recipient is able to access the first electronic message comprises transmitting the first electronic message to the intended recipient for local storage of the first electronic message in a device associated with the intended recipient.

3. The method of claim 1 wherein:

causing the first electronic message to be stored in electronic storage such that the intended recipient is able to access the first electronic message comprises storing the first electronic message in the intended recipient'"'"'s inbox, and

removing the first electronic message from the electronic storage using the tracked location of the first electronic message comprises removing the first electronic message from the intended recipient'"'"'s inbox.

4. The method of claim 1 wherein removing the first electronic message from the electronic storage using the tracked location of the first electronic message comprises deleting the first electronic message.

5. The method of claim 1 wherein determining that the first electronic message is presently acceptable based on the analysis of the first electronic message comprises determining that a security condition of the first electronic message reflects an indeterminate state.

6. The method of claim 1 wherein determining that the first electronic message is presently acceptable based on the analysis of the first electronic message comprises determining that a security condition of the first electronic message does not reflect an unacceptable state.

7. The method of claim 1 wherein:

analyzing the first electronic message with respect to the accessed data used to identify unacceptable messages comprises identifying that the first electronic message has a particular characteristic; and

determining that the first electronic message is presently acceptable based on the analysis of the first electronic message comprises determining that a number of received messages that have the particular characteristic is less than a threshold.

8. The method of claim 7 wherein:

receiving the second electronic message subsequent to receipt of the first electronic message comprises receiving a second electronic message that has the particular characteristic;

updating the data used to identify unacceptable messages based on the inspection of the second one electronic message comprises updating data indicating the number of received messages that have the particular characteristic based on the second electronic message that has the particular characteristic;

reassessing whether the first electronic message is acceptable based on the update to the data used to identify unacceptable messages comprises comparing the updated data indicating the number of received messages that have the particular characteristic to the threshold; and

determining that the first electronic message is now unacceptable based on the reassessment of the first electronic message comprises determining that the number of received messages that have the particular characteristic is greater than the threshold.

9. A method of processing messages, the method comprising:

receiving, at an electronic messaging system, a first electronic message sent to an intended recipient;

analyzing the first electronic message with respect to data used to identify unacceptable messages;

based on the analysis of the first electronic message with respect to the data used to identify unacceptable messages, determining that more information is needed to determine whether the first electronic message is acceptable or unacceptable;

in response to determining that more information is needed to determine whether the first electronic message is acceptable or unacceptable, delaying delivery of the first electronic message by storing the first electronic message in electronic storage associated with the electronic messaging system;

receiving, at the electronic messaging system, a second electronic message subsequent to receipt of the first electronic message;

analyzing the second electronic message;

reassessing whether the first electronic message is acceptable or unacceptable based on the analysis of the second electronic message;

determining that the first electronic message is acceptable based on the reassessment of the first electronic message; and

in response to the determining that the first electronic message is acceptable;

accessing the first electronic message from the electronic storage associated with the first electronic messaging system; and

delivering the first electronic message to the intended recipient.

10. The method of claim 9 wherein determining that more information is needed to determine whether the first electronic message is acceptable or unacceptable comprises determining that a security condition of the first electronic message reflects an indeterminate state.

11. The method of claim 9 wherein delaying delivery of the first electronic message by storing the first electronic message in electronic storage associated with the electronic messaging system comprises tracking a location of the first electronic message in the electronic storage associated with the electronic messaging system.

12. The method of claim 9 wherein delaying delivery of the first electronic message by storing the first electronic message in electronic storage associated with the electronic messaging system comprises tracking an instance of the first electronic message being stored in an outbox of sent messages.

13. The method of claim 9 wherein delivering the first electronic message to the intended recipient comprises transmitting the first electronic message to the intended recipient.

14. The method of claim 9 wherein delivering the first electronic message to the intended recipient comprises storing the first electronic message in the intended recipient'"'"'s inbox.

15. The method of claim 9 wherein determining that the first electronic message is acceptable based on the reassessment of the first electronic message comprises determining that the second electronic message indicates that the first electronic message is valid.

16. A method of processing electronic messages in an electronic messaging system that includes multiple local exchanging systems, the method comprising:

maintaining first stored data indicating characteristics of electronic messages inspected by a first local exchanging system included in an electronic messaging system;

maintaining second stored data indicating characteristics of electronic messages inspected by a second local exchanging system included in the electronic messaging system, the second local exchanging system being different than the first local exchanging system;

receiving, at the first local exchanging system, an electronic message;

inspecting, at the first local exchanging system, the electronic message to identify characteristics of the electronic message;

accessing the first stored data indicating characteristics of electronic messages inspected by the first local exchanging system;

accessing the second stored data indicating characteristics of electronic messages inspected by the second local exchanging system;

comparing the identified characteristics of the electronic message with the accessed first stored data indicating characteristics of electronic messages inspected by the first local exchanging system and the accessed second stored data indicating characteristics of electronic messages inspected by the second local exchanging system;

based on comparison results, identifying a security condition for the electronic message; and

processing the electronic message based on the security condition.

17. The method of claim 16 wherein:

maintaining first stored data indicating characteristics of electronic messages inspected by a first local exchanging system included in an electronic messaging system comprises maintaining first stored data indicating characteristics of electronic messages inspected by a first local exchanging system configured to exchange messages sent by users located in a first geographic region; and

maintaining second stored data indicating characteristics of electronic messages inspected by a second local exchanging system included in the electronic messaging system comprises maintaining second stored data indicating characteristics of electronic messages inspected by a second local exchanging system configured to exchange messages sent by users located in a second geographic region, the second geographic region being different than the first geographic region.

18. The method of claim 17 wherein identifying a security condition for the electronic message comprises identifying a hostile security condition for the electronic message received at the first local exchanging system based on the comparison of the identified characteristics of the electronic message with the accessed second stored data indicating characteristics of electronic messages inspected by the second local exchanging system.

19. The method of claim 18 wherein the security condition of the electronic message would not be identified as hostile based solely on the comparison of the identified characteristics of the electronic message with the accessed first stored data indicating characteristics of electronic messages inspected by the first local exchanging system.

20. The method of claim 16 wherein:

based on comparison results, identifying the security condition for the electronic message comprises identifying a security condition that reflects an indeterminate state; and

processing the electronic message based on the security condition comprises;

causing the electronic message to be stored in electronic storage such that a recipient is able to access the electronic message;

tracking a location of the electronic message stored in the electronic storage;

receiving, at either or both of the first local exchanging system and the second local exchanging system, at least one additional electronic message subsequent to receipt of the electronic message;

inspecting the received at least one additional electronic message;

updating either or both of the first stored data and the second stored data based on the inspection of the received at least one additional electronic message;

reassessing whether the electronic message is acceptable based on the update to either or both of the first stored data and the second stored data;

determining that the electronic message is now unacceptable based on the reassessment of the electronic message;

based on the determination that the first electronic message is now unacceptable, removing the electronic message from the electronic storage using the tracked location of the electronic message.