EMAIL FILTERING USING RECIPIENT REPUTATION

• US 20090037469A1
• Filed: 12/05/2007
• Published: 02/05/2009
• Est. Priority Date: 08/02/2007
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Abaca Technology Corp. (Proofpoint Incorporated)
• Inventors: Kirsch, Steven T.
• Granted Patent: US 7,783,597 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

The present invention is an adaptive method for filtering spam by using the reputations associated with recipients of email messages to determine the reputations of message and content attributes, then using the attribute reputations to determine whether or not the email message is spam and then using the determination of spam to update the reputations associated with the recipients of the email message. The present invention can also be used in conjunction with existing spam algorithms. Optionally, training of existing spam algorithms may be implemented by the use of recipient reputations or training types derived from recipient reputations.

Claims

1. A method for determining whether an incoming email message entering an email system with a plurality of recipients addressed to one or more of the recipients is ham or spam, the method comprising:

accumulating counts of unsolicited ham email messages and unsolicited spam email messages received by each recipient;

calculating recipient reputations for recipients of email messages using the accumulated counts; and

calculating a message score for an email message using the recipient reputations of the recipients of the email message.

2. The method of claim 1 further comprising wherein the recipient reputations are likelihood ratios calculated from a ratio of the unsolicited ham email messages to the unsolicited spam email messages received by each recipient.

3. The method of claim 1 further comprising calculating a sender reputation for a sender of the email message by combining the recipient reputations of the unsolicited recipients associated with the sender.

4. The method of claim 3 further comprising calculating the message score using the sender reputation.

5. The method of claim 1 further comprising calculating an IP reputation for an IP address using counts of good and bad senders sending email messages from the IP address.

6. The method of claim 5 further comprising calculating the message score using the IP reputation.

7. The method of claim 1 further comprising storing and combining the recipient reputations in central network storage.

8. The method of claim 7 further comprising calculating the message score using the combined recipient reputations stored in the central network storage.

9. A method for determining whether an incoming email message entering an email system with a plurality of recipients addressed to one or more of the recipients is ham or spam comprising:

accumulating counts of unsolicited ham email messages and unsolicited spam email messages received by each recipient;

calculating recipient reputations for recipients of email messages using the accumulated counts;

calculating a sender reputation for a sender of an email message by combining the recipient reputations of the recipients associated with the sender;

calculating a message score for the email message using the calculations; and

updating the accumulated counts using the message score.

10. The method of claim 9 further comprising wherein the recipient reputations are likelihood ratios calculated from a ratio of the unsolicited ham email messages to the unsolicited spam email messages received by each recipient.

11. The method of claim 9 further comprising calculating the message score using the sender reputation.

12. The method of claim 9 further comprising calculating an IP reputation for an IP address using a ratio of good to bad senders sending email messages from the IP address.

13. The method of claim 12 further comprising calculating the message score using the IP reputation.

14. The method of claim 12 further comprising calculating the message score for the email message using the sender reputation and the IP reputation.

15. The method of claim 9 further comprising storing sender reputations and IP reputations at a central network location.

16. A method for determining whether an incoming email message entering an email system with a plurality of recipients addressed to one or more of the recipients is ham or spam comprising:

determining recipient reputations for recipients of email messages using ham and spam statistics for email messages received by each recipient;

updating a sender reputation for a sender of an email message using the recipient reputations of the recipients associated with the sender;

updating an IP reputation for an IP address from which senders send the email messages by using the updated sender reputation;

determining a message score for the email message using the sender reputation and the IP reputation; and

updating the ham and spam statistics using the message score.

17. A method for determining whether an incoming email message entering an email system with a plurality of recipients addressed to one or more of the recipients is ham or spam comprising:

accumulating ham and spam statistics for email messages received by each recipient;

modifying a sender reputation using the accumulated ham and spam statistics of recipients associated with a sender;

determining an IP reputation for an IP address from which senders send the email messages by using the sender reputation;

determining a message score for an email message using the sender reputation and the IP reputation; and

modifying the accumulated ham and spam statistics using the message score.

18. An adaptive spam filtering method for an existing spam algorithm used to determine whether an incoming email message entering an email system with a plurality of recipients addressed to one or more of the recipients is spam, the spam filtering method comprising:

accumulating counts of ham email messages and spam email messages received by each recipient, the accumulated counts of ham email messages and spam email messages determined by an existing spam algorithm;

calculating recipient reputations for recipients of email messages using the accumulated counts; and

using the calculated recipient reputations for the recipients of an email message for training the existing spam algorithm.

19. The method of claim 18 further comprising wherein the recipient reputations are likelihood ratios calculated using ratios of the ham email messages to the spam email messages received by each recipient.

20. The method of claim 18 further comprising calculating a sender reputation for a sender of the email message by combining the recipient reputations of each unique recipient associated with the sender.

21. The method of claim 20 further comprising training the existing spam algorithm using the sender reputation.

22. The method of claim 18 further comprising calculating an IP reputation for an IP address using a ratio of good to bad senders sending email messages from the IP address.

23. The method of claim 22 further comprising training the existing spam algorithm using the IP reputation.

24. The method of claim 22 further comprising training the existing spam algorithm using a sender reputation for a sender of the email message and the IP reputation, the sender reputation calculated by combining the recipient reputations of the recipients associated with the sender.