Method and System for Filtering Electronic Messages

• US 20080256187A1
• Filed: 06/22/2006
• Published: 10/16/2008
• Est. Priority Date: 06/22/2005
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Blackspider Technologies
• Inventors: Kay, James
• Granted Patent: US 8,015,250 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Embodiments of the invention are concerned with filtering emails having data therein identifying a link to a remote processing system, which, when activated, causes the recipient to retrieve data from the remote processing system.

Embodiments of the invention provide a method of modifying an electronic message during transmission through a communications network, said electronic message having a source address and a recipient address, the method comprising:

• • interrupting transmission of the electronic message;
  • identifying a link specified within the electronic message;
  • analyzing the electronic message on the basis of at least an attribute intrinsic to the received electronic message so as to classify the received message as either a first type of message or a second, different, type of message;
  • if the received message is classified as the first type of message, modifying the received electronic message so as to replace the link with an alternative network location, said alternative network location corresponding to a remote processing system different to that corresponding to the link; and
  • transmitting the modified electronic message.

In comparison to known methods, which either modify the links blindly or which perform analysis of the data to which the link is connected, embodiments of the invention selectively modify the link on the basis of various tests relating to attributes intrinsic to the email. This means that only those emails that present some sort of risk to the recipient are modified, and, because the criteria for performing the modification relate to attributes intrinsic to the emails instead of the content associated with the link, the delivery of emails is not significantly delayed by processes involved in retrieval and analysis of data from third party sites.

Claims

1. A method of modifying an electronic message during transmission through a communications network, said electronic message having a source address and a recipient address, the method comprising:

interrupting transmission of the electronic message;

identifying a link specified within the electronic message;

analyzing the electronic message on the basis of at least an attribute intrinsic to the received electronic message so as to classify the received message as either a first type of message or a second, different, type of message;

if the received message is classified as the first type of message, modifying the received electronic message so as to replace the link with an alternative network location, said alternative network location corresponding to a remote processing system different to that corresponding to the link; and

transmitting the modified electronic message.

2. A method according to claim 1, in which the link comprises a network location and the method further comprises associating, within the modified electronic message, data indicative of the network location with the alternative network location.

3. A method according to claim 2, including encoding the network location so as to generate said associated data.

4. A method according to claim 2, including assigning an alias to the network location so as to generate said associated data.

5. A method according to claim 2, comprising containing the associated data within the alternative network location so as to associate said data with the alternative network location.

6. A method according to claim 1, including analysing the transmitted electronic message on the basis of a criterion unrelated to the network location.

7. A method according to claim 6, including analysing the transmitted electronic message on the basis of a criterion relating to the network location specified within the electronic message.

8. A method according to claim 1, including analysing the transmitted electronic message on the basis of a criterion relating to at least one other attribute of the electronic message.

9. A method according to claim 8, in which the criterion includes the sender address and/or the recipient address.

10. A method according to claim 1, including comparing the network location with network locations contained within electronic messages that have previously been identified as of the unsolicited type.

11. A method according to claim 1, including transmitting the modified electronic message to the recipient address.

12. A method according to claim 1, in which, if the received message is classified as the second type of message, the method includes transmitting the received electronic message without modification thereto.

13. A method of identifying an electronic message as an unsolicited electronic message on the basis of a network location specified therein, wherein data indicative of the electronic message are stored in association with the network location, the method comprising:

responsive to a request for access to the network location from a recipient of the electronic message, accessing data indicative of a classification of said electronic message;

retrieving data associated with said network location and analysing said retrieved data so as to validate said classification of said electronic message as unsolicited or solicited.

14. A method according to claim 13, in which, responsive to said request, the method includes accessing a processing system corresponding to said network location so as to retrieve said data.

15. A method according to claim 13, in which, responsive to said request, the method includes retrieving data previously accessed from a processing system corresponding to said network location

16. A method according to claim 13, in which said request for access to the network location comprises encoded data corresponding to the network location.

17. A method according to claim 13, in which said request for access to the network location comprises an alias corresponding to the network location, and the method comprises identifying the network location from the alias.

18. A method according to claim 13, including notifying the recipient of the classification of the electronic message.

19. A method according to claim 13, including transmitting data retrieved from the network location to the recipient in the event that the electronic message is classified as being of the solicited type.

20. A method of modifying an electronic message transmitted through a communications network, the method comprising:

receiving a said electronic message;

identifying first data indicative of a first network location, said first network location being specified within the received electronic message;

analyzing the electronic message on the basis of at least an attribute intrinsic to the message and unrelated to the first network location so as to classify the received message as either a first type of message or a second, different, type of message;

if the received message is classified as the first type of message, associating the first data with second data indicative of a second network location, said second network location corresponding to a remote processing system different to that corresponding to the first network location;

modifying the received electronic message so as to include the second data; and

transmitting the modified electronic message.

21. A system for modifying an electronic message during transmission through a communications network, said electronic message having a source address and a recipient address, the system comprising:

an interface for receiving the electronic message before it has been delivered to a device corresponding to the recipient address;

the system comprising a function arranged to identify a link specified within the received electronic message and to analyze the electronic message on the basis of at least an attribute intrinsic to the received electronic message so as to classify the received message as either a first type of message or a second, different, type of message;

wherein, if the received message is classified as the first type of message, the system is arranged to modify the received electronic message so as to replace the link with an alternative network location, said alternative network location corresponding to a remote processing system different to that corresponding to the link.