DELAY TECHNIQUE IN E-MAIL FILTERING SYSTEM

• US 20090157708A1
• Filed: 01/16/2009
• Published: 06/18/2009
• Est. Priority Date: 09/22/2003
• Status: Active Grant

• Current Assignee: Axway Incorporated (Axway Software SA)
• Original Assignee: Axway Incorporated (Axway Software SA)
• Inventors: Bandini, Jean-Christophe Denis, Odnert, Daryl
• Granted Patent: US 9,338,026 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A relay provides message filtering services to an e-mail network. The relay monitors incoming communication and intercepts e-mail messages. The relay applies a policy to received messages to determine whether a message should be delayed. The relay applies a policy to delayed messages by reference to a delayed processing event which triggers the delayed processing. The relay updates policy data in accordance by employing an update module. The relay then restricts the delivery of messages having attributes close to those of harmful data as provided by a policy database.

Claims

1. A method for controlling transmission of messages in a data communication network, the method comprising:

providing a store and forward relay associated with a plurality of recipients that receive messages in an e-mail network;

the relay receiving a message intended for a recipient;

the relay applying a first filtering policy to the message;

the relay delaying delivery of the message in response to at least one result of applying said first filtering policy;

the relay applying a second filtering policy to the message after a delay period, wherein the delay in applying said second filtering policy is with reference to a time based event; and

the relay delivering the message in response to at least one result of applying said second filtering policy.

2. The method of claim 1, wherein said first and second filter policies are different policies.

3. The method of claim 1, wherein said relay is an email relay applying e-mail filtering policies to the received messages.

4. The method of claim 1, wherein said relay is acting as an intermediate node for a store and forward email protocol.

5. The method of claim 1, wherein said relay is acting as a final node for a store and forward email protocol.

12. The method of claim 1, wherein the message is associated with an SMTP transmission protocol.

13. The method of claim 1, wherein the relay is the final destination server of the message and is further configured to manage delivery of the message to the recipient.

14. The method of claim 1, wherein the relay comprises components which are distributed across several physical computers but act logically as a single system.

15. The method of claim 1, wherein the public network is the Internet.

16. The method of claim 1, further comprising:

adding data corresponding to said message to an unsolicited bulk e-mail database.

17. The method of claim 1, wherein said applying a filtering policy comprises:

identifying a comparison for evaluating by reference to the message;

identifying at least one evaluation associated with the comparison;

for each evaluation associated with the comparison;

extracting data from the message in accordance with parameters associated with the identified evaluation;

executing the evaluation for the extracted data by comparing the extracted data to data from an unsolicited bulk e-mail database;

determining a new comparison score based on the executed evaluation; and

determining that the message is unsolicited bulk e-mail if the comparison score is beyond a threshold.

18. The method of claim 17, wherein the threshold is a threshold range.

19. The method of claim 17, wherein the relay combines the evaluations using a scoring formula with weighing associated with evaluations and employs resultant score to determine the action to take.

20. The method of claim 17, wherein the relay combines the condition using a statistical formula to determine the action to take.

21. The method of claim 17, wherein the relay combines the condition using a probabilistic formula to determine the action to take.

22. The method of claim 17, wherein the relay combines the condition using Bayesian statistical analysis.

23. The method of claim 17, wherein said at least one evaluation comprises comparing the sender address of the message to a sender address of records in the unsolicited bulk e-mail database.

24. The method of claim 17, wherein said at least one evaluation refers to at least one recipient of the message.

25. The method of claim 17, wherein said at least one evaluation refers to the header of the message.

26. The method of claim 17, wherein said at least one evaluation refers to the subject field of the message header.

27. The method of claim 17, wherein said at least one evaluation refers to the textual content of the message body including the presence of keywords.

28. The method of claim 17, wherein said at least one evaluation refers to the overall size of the message.

29. The method of claim 17, wherein said at least one evaluation refers to the message body format, including the presence of an HTML format.

30. The method of claim 17, wherein said at least one evaluation refers to the HTML construct if the HTML format is present.

31. The method of claim 17, wherein said at least one evaluation refers to a URL that may be present in the message body and attachments.

32. The method of claim 17, wherein said at least one evaluation refers to the number of attachments.

33. The method of claim 17, wherein said at least one evaluation refers to the size of attachments.

34. The method of claim 17, wherein said at least one evaluation refers to the type of attachments.

35. The method of claim 17, wherein said at least one evaluation refers to the name of attachments.

36. The method of claim 17, wherein said at least one evaluation refers to the content of attachments.

37. The method of claim 17, wherein said at least one evaluation refers to the validity of digital signatures in the message and attachments.

38. The method of claim 17, wherein said at least one evaluation refers to the fact that the message follows a standards format.

39. The method of claim 17, wherein said at least one evaluation refers to a hash of at least a portion of the message and comparison of the hash against a database of hash values.

40. The method of claim 17, wherein said at least one evaluation refers to the presence of malicious code in the message and attachments.

41. The method of claim 17, wherein said at least one evaluation refers to time indicators associated with the message.

42. The method of claim 17, wherein said at least one evaluation refers to the fact that the message is processed after delaying delivery of the message.

43. The method of claim 17, wherein said at least one evaluation refers to the time period since delivery delay was initiated for the message.

44. The method of claim 17, wherein said at least one evaluation refers to the IP and domain of the sender.

45. The method of claim 17, wherein said at least one evaluation refers to the transport protocol session, including envelope sender and recipient.

46. The method of claim 1, wherein the relay is further configured to take an action in response to applying said first policy, said action is selected from the group consisting of deliver normally, return to sender, copy to a recipient, send a blind copy to a recipient, forward to a recipient, delete the message, delay delivery and move to an area for review by an administrator, delay delivery and move to an area for future review by an external user, delay delivery and move to an area for future review by a recipient, save a copy of the message, and move the message to a delayed delivery area.

47. The method of claim 46, wherein evaluations and corresponding actions are different at least between two recipients.

48. The method of claim 46, wherein the relay is further configured to modify attributes of the message, including subject, headers, body, and attachments.

49. The method of claim 46, wherein the modifying is on copies of the message when applying the policy results in different modification for different recipients.

50. The method of claim 46, wherein the modifying of the message consists of removing malicious code in the message.

51. The method of claim 46, wherein the association between evaluations and actions is configurable by an administrator.

52. The method of claim 46, wherein the association between evaluations and actions is configured by the recipient of the message.

6. A method for controlling transmission of messages in a data communication network, the method comprising:

providing a store and forward relay associated with a plurality of recipients that receive messages in an e-mail network;

the relay receiving messages intended for respective recipients thereof;

the relay applying a first filtering policy to the received messages;

the relay delaying delivery of at least some of the received messages in response to at least one result of applying said first filtering policy;

the relay applying a second filtering policy to the delayed messages after a delay period; and

the relay delivering at least one of the delayed message in response to at least one result of applying said second filtering policy, wherein said second filter policy is provided by updating at least some data associated with a previous version thereof based on data received from a third party server during the delay period.

7. The method of claim 6, wherein the updating of said second filter policy includes updating code employed by an anti-virus program module.

8. The method of claim 6, wherein the updating of said second filter policy is by periodic data downloads from one or more servers.

9. The method of claim 6, wherein the updating of said second filter policy is by automatic update messages from a third party.

10. The method of claim 6, wherein the updating of said second filter policy is by a manual request from an administrator.

11. A method for controlling transmission of messages in a data communication network, the method comprising:

providing a store and forward relay associated with a plurality of recipients that receive messages in an e-mail network;

the relay receiving messages intended for respective recipients thereof,

the relay applying a first filtering policy to the received messages;

the relay delaying delivery of at least some of the received messages in response to at least one result of applying said first filtering policy;

the relay applying a second filtering policy to the delayed messages after a delay period, wherein the delayed applying of said second filtering policy is at a time based on at least one condition selected from the group consisting of time since the applying of said first filtering policy, time since the applying of said first filtering policy, wherein the delay period is a function of the current time, update of said second filtering policy since the message was delayed, current time, current date, and current day of the week; and

the relay delivering at least one of the delayed messages in response to at least one result of applying said second filtering policy.

53. A method for controlling transmission of messages in a data communication network, the method comprising:

using a store and forward relay to receive messages intended for respective recipients thereof;

applying a first filtering policy to the received messages and based on one or more results thereof, delaying delivery of at least some of the received messages; and

after a delay period, applying a second filtering policy to the delayed messages and based on one or more results thereof delivering at least one, but not another, of the delayed messages to its intended recipient, wherein the delay period is based on at least one condition selected from a group consisting of (i) time elapsed since the applying of the first filtering policy;

(ii) time elapsed since the applying of the first filtering policy, wherein the delay period is a function of current time date or day of week;

(iii) update of the second filtering policy or of data used in the applying of the second filtering policy; and

(iv) current time, date or day of week.

54. The method of claim 53,

wherein the first and second filtering policies are different policies.

55. The method of claim 53,

wherein the second filtering policy is either an updated version of the first filtering policy or a subsequent application of the first filtering policy based on updated data.

57. The method of claim 53, wherein the applying of at least one of the first and second filtering policies comprises:

identifying a comparison for evaluating by reference to the received message;

identifying at least one evaluation associated with the comparison;

for each evaluation associated with the comparison;

extracting data from the received message in accordance with parameters associated with the identified evaluation;

executing the evaluation for the extracted data by comparing the extracted data to data from an unsolicited bulk e-mail database;

determining a new comparison score based on the executed evaluation; and

determining that the received message is unsolicited bulk e-mail if the comparison score is beyond a threshold.

58. The method of claim 53, wherein the relay is configured to take action based on the first filtering policy and wherein the action taken includes one or more actions selected from a group consisting of:

delay delivery of the received message;

deliver the received message normally;

return the received message to sender;

send a copy or blind copy of the received message to an additional recipient;

forward the received message; and

delete the received message, and

wherein the delay delivery action, when performed, includes one or more additional actions selected from a group consisting of;

move the received message to an area for review by an administrator;

move the received message to an area for future review by an external user;

move the received message to an area for future review by a recipient;

save a copy of the received message; and

move the received message to a delayed delivery area.

56. (canceled)