Recognizing Spam Email

• US 20090094342A1
• Filed: 12/15/2008
• Published: 04/09/2009
• Est. Priority Date: 02/03/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wegman, Mark N., Rajan, Vadakkedathu Thomas, Leiba, Barry, Segal, Richard, Ossher, Joel
• Granted Patent: US 8,549,081 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A system includes at least one router for routing email messages from a sender node to a destination node; a system memory; a network interface; a database; and a processor configured for: extracting the delivery path information from the email message; determining a network path for the email message using delivery path information; comparing the delivery path information with the plurality of prior delivery paths; determining a measure of similarity between the network path of the received email message and one or more of the plurality of prior email paths; and determining a spam score for the email received, based on the measure of similarity.

Claims

1. An information processing system comprising:

at least one router configured for;

routing an email message from a sender node to a destination node; and

adding information to the email message, said information comprising delivery path information of the email from the sender node to the destination node;

a system memory;

a network interface for receiving the email message, said email message comprising a plurality of packets and delivery path information;

a database for storing a plurality of prior delivery paths from previously analyzed emails;

a processor configured for;

extracting the delivery path information from the email message;

determining a network path for the email message using the delivery path information;

comparing the delivery path information with the plurality of prior delivery paths;

determining a measure of similarity between the network path of the received email message and one or more of the plurality of prior email paths; and

determining a spam score for the email received, based on the measure of similarity.

2. The information processing system of claim 1 wherein the database comprises a starting set of sorted messages comprising spam and non-spam messages;

and a starting spam score for each IP address stored in the database, wherein the spam scores indicate a likelihood that an email message received is spam.

3. The information processing system of claim 2 wherein the database further comprises votes on spam content of the prior emails submitted by end-user recipients.

4. The information processing system of claim 2 wherein the processor is further configured for ordering the stored email paths according to judgments of their reliability.

5. The information processing system of claim 4 wherein the processor is further configured for assigning a score to each stored email based on the spam and non-spam email messages that have come from its IP address.

6. The information processing system of claim 5 wherein the processor is further configured for assigning a score to each stored email based on a combination of scores in an overall score for the message.

7. The information processing system of claim 5 wherein the processor is further configured for evaluating each IP address in the database by finding its node in the database, along with its parent node and nodes that are nearby in order to produce a score for that IP address.

8. The information processing system of claim 7 wherein the processor is further configured for, after evaluating each IP address starting with a most recent, accumulating a weighted average, giving more weight to exact database matches than to those that are obtained only from other nearby addresses, resulting in a score for the email message as a whole.

9. The information processing system of claim 1 wherein, in determining the network path, the processor is further configured for:

applying a credibility function to the network path to determine the credibility of the nodes along the path from which the email message was received.

10. The information processing system of claim 9, wherein the processor is further configured to apply the credibility function by:

considering each node in the network path separately;

determining a preliminary credibility for each node; and

using that preliminary credibility, and credibilities of one or more other nodes in the path, to determine the credibility of that node.

11. The information processing system of claim 10, wherein the processor is further configured for:

assigning a low credibility function to a node with insufficient history for an adequate count of messages.

12. The information processing system of claim 10, wherein the processor is further configured for:

comparing each previously unseen node with known nodes with similar IP addresses.

13. The information processing system of claim 1 wherein the processor is further configured for not forwarding the email message to an at least one recipient when the email message comprises the spam score indicating that it is likely to be spam email.

14. A computer readable storage medium comprising program code that, when executed, enables a computer to perform steps of:

receiving an email message comprising delivery path information;

extracting the delivery path information from the email message;

determining a network path for the email message using the delivery path information;

comparing the delivery path information to a plurality of prior delivery paths;

determining a measure of similarity between the network path of the received email message and one or more of the plurality of prior delivery paths; and

determining a spam score for the email received, based on the measure of similarity, wherein the spam score indicates a likelihood that the email message is spam email.

15. The computer readable storage medium of claim 14 wherein the program code further enables the computer to not forward the email message to an at least one recipient when the email message comprises the spam score indicating that it is likely to be spam email.