SYSTEM AND METHOD FOR DETERMINING SPAM

• US 20090307313A1
• Filed: 06/04/2008
• Published: 12/10/2009
• Est. Priority Date: 06/04/2008
• Status: Active Grant

• Current Assignee: Yahoo Assets LLC
• Original Assignee: Yahoo! Inc. (Apollo Global Management, Inc.)
• Inventors: Wang, Tak Yin, Wong, Patrick
• Granted Patent: US 7,769,815 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

The disclosure describes systems and methods for determining spam. A spam detecting system identifies potential spam messages by checking the relationship between a sender of a message and a recipient of the message. The spam detecting system identifies the relationship between the sender and recipient as ‘unknown’ or ‘trusted’. If the message is ‘trusted’, the message is transmitted accordingly to the recipient. If the message is classified as ‘unknown’, then the message is analyzed in view of other identified potential spam messages where an count is tallied against a threshold value to keep track of the probability a message is spam.

Claims

1. A method comprising:

receiving in a messaging application an electronic message from a sender, the message comprising a message body and a sender address, the message identifying a recipient;

identifying the recipient as having a trusted account with a service provider, the account being identified in a trusted database, the account identifying a plurality of sender addresses as being trusted;

determining whether the sender address is a trusted sender address by determining if the sender address is identified as trusted in the recipient'"'"'s trusted account;

upon the determination that the sender address is not identified as a trusted sender, identifying the message as potential spam;

comparing the message body of the message with a message body of each of a corpus of existing messages in the database that are identified as potential spam;

determining if a match exists between the message body of the message and at least one message body of the existing messages;

if a match exists, incrementing a message body match counter, the message counter tallying a total number of determined matches;

comparing the counter'"'"'s value with a predetermined threshold value, the predetermined threshold value indicating a probability of a message being spam; and

identifying the message as spam based on the comparison.

2. The method of claim 1, wherein if the message counter value is greater than the predetermined threshold value, identifying the message as spam.

3. The method of claim 1, wherein if the message counter value is equal to or greater than the predetermined threshold value, identifying the message as spam.

4. The method of claim 1, further comprising:

if the message body match counter value is less than the predetermined threshold value, maintaining the message as potential spam.

5. The method of claim 1, further comprising:

if the message body match counter value is less than the predetermined threshold value, delivering the message to the recipient, the delivery of the message being transmitted along with an indication that the message is identified as potential spam.

6. The method of claim 1, further comprising:

upon determining the sender address being a trusted sender address, transmitting the message to the recipient, the message being identified as not spam.

7. The method of claim 1, further comprising:

upon the determination that the sender address is not a trusted sender address, incrementing a sender address match counter, the sender address match counter tallying a total number of identified potential spam messages transmitted from a specific sender'"'"'s address.

8. The method of claim 7, wherein if the sender address match counter value is greater than the predetermined threshold value, identifying the message as spam.

9. The method of claim 7, wherein if the sender address match counter value is equal to or greater than the predetermined threshold value, identifying the message as spam.

10. The method of claim 7, further comprising:

if the sender address match counter value is less than the predetermined threshold value, maintaining the message as potential spam, and

delivering the message to the recipient, the message being transmitted along with an indication that the message is being sent from a potential spammer.

11. The method of claim 1, wherein for each identified potential spam message having a unique message body, there exists a unique message body match counter.

12. The method of claim 7, wherein for each unique sender address not identified as being a trusted sender address, there exists a separate sender address match counter.

13. The method of claim 1, wherein the sender and the recipient are users within an email system, the users having a mailbox comprising messages.

14. The method of claim 1, wherein said identifying the recipient as having a trusted account comprises:

identifying a user from a plurality of users, the plurality of users running the messaging application, the plurality of users all having a mailbox;

determining if the user'"'"'s mailbox satisfies a selection criteria, the selection criteria identifying required activity of the user'"'"'s mailbox, the selection criteria comprises;

determining whether the mailbox has been active for at least a predetermined time period;

determining whether the mailbox comprises at least a predetermined number of messages; and

determining whether the messages comprise a number of unique senders being within a predetermined range, the predetermined range being a portion of the number of messages; and

creating the trusted account for the user'"'"'s mailbox; and

storing the account in the trusted database based upon the user'"'"'s mailbox satisfying all the selection criteria requirements.

15. The method of claim 14, further comprising:

if the user'"'"'s mailbox fails to meet at least one of the selection criteria, a trusted account is not created for the user'"'"'s mailbox.

16. The method of claim 14, further comprising

populating an account pool with a portion of the plurality of users, the portion of users having satisfied the selection criteria, the account pool being limited to a predetermined range of users based upon location.

17. The method of claim 14, wherein said storing is performed based upon a predetermined polling cycle in order to populate the database;

and

wherein said storing is based on space available in the database.

18. The method of claim 14, wherein the unique senders are identified in an address book in the user'"'"'s mailbox.

19. A computer-readable medium tangibly encoded with instructions for performing a method comprising:

receiving in a messaging application an electronic message from a sender, the message comprising a message body and a sender address, the message identifying a recipient;

identifying the recipient as having a trusted account with a service provider, the account being identified in a trusted database, the account identifying a plurality of sender addresses as being trusted;

determining whether the sender address is a trusted sender address by determining if the sender address is identified as trusted in the recipient'"'"'s trusted account;

upon the determination that the sender address is not identified as a trusted sender, identifying the message as potential spam;

comparing the message body of the message with a message body of each of a corpus of existing messages in the database that are identified as potential spam;

determining if a match exists between the message body of the message and at least one message body of the existing messages;

if a match exists, incrementing a message body match counter, the message counter tallying a total number of determined matches;

comparing the counter'"'"'s value with a predetermined threshold value, the predetermined threshold value indicating a probability of a message being spam; and

identifying the message as spam based on the comparison.

20. The computer-readable medium of claim 19, wherein if the message counter value is greater than the predetermined threshold value, identifying the message as spam.

21. The computer-readable medium of claim 19, wherein if the message counter value is equal to or greater than the predetermined threshold value, identifying the message as spam.

22. The computer-readable medium of claim 19, further comprising:

if the message body match counter value is less than the predetermined threshold value, maintaining the message as potential spam.

23. The computer-readable medium of claim 19, further comprising:

if the message body match counter value is less than the predetermined threshold value, delivering the message to the recipient, the delivery of the message being transmitted along with an indication that the message is identified as potential spam.

24. The computer-readable medium of claim 19, further comprising:

upon determining the sender address being a trusted sender address, transmitting the message to the recipient, the message being identified as not spam.

25. The computer-readable medium of claim 19, further comprising:

upon the determination that the sender address is not a trusted sender address, incrementing a sender address match counter, the sender address match counter tallying a total number of identified potential spam messages transmitted from a specific sender'"'"'s address.

26. The computer-readable medium of claim 25, wherein if the sender address match counter value is greater than the predetermined threshold value, identifying the message as spam.

27. The computer-readable medium of claim 25, wherein if the sender address match counter value is equal to or greater than the predetermined threshold value, identifying the message as spam.

28. The computer-readable medium of claim 25, further comprising:

if the sender address match counter value is less than the predetermined threshold value, maintaining the message as potential spam, and

delivering the message to the recipient, the message being transmitted along with an indication that the message is being sent from a potential spammer.

29. The computer-readable medium of claim 19, wherein for each identified potential spam message having a unique message body, there exists a unique message body match counter.

30. The computer-readable medium of claim 25, wherein for each unique sender address not identified as being a trusted sender address, there exists a separate sender address match counter.

31. The computer-readable medium of claim 19, wherein the sender and the recipient are users within an email system, the users having a mailbox comprising messages.

32. The computer-readable medium of claim 19 wherein said identifying the recipient as having a trusted account comprises:

identifying a user from a plurality of users, the plurality of users running the messaging application, the plurality of users all having a mailbox;

determining if the user'"'"'s mailbox satisfies a selection criteria, the selection criteria identifying required activity of the user'"'"'s mailbox, the selection criteria comprises;

determining whether the mailbox has been active for at least a predetermined time period;

determining whether the mailbox comprises at least a predetermined number of messages; and

determining whether the messages comprise a number of unique senders being within a predetermined range, the predetermined range being a portion of the number of messages; and

creating the trusted account for the user'"'"'s mailbox; and

storing the account in the trusted database based upon the user'"'"'s mailbox satisfying all the selection criteria requirements.

33. The computer-readable medium of claim 32, further comprising:

if the user'"'"'s mailbox fails to meet at least one of the selection criteria, a trusted account is not created for the user'"'"'s mailbox.

34. The computer-readable medium of claim 32, further comprising

populating an account pool with a portion of the plurality of users, the portion of users having satisfied the selection criteria, the account pool being limited to a predetermined range of users based upon location.

35. The computer-readable medium of claim 32, wherein said storing is performed based upon a predetermined polling cycle in order to populate the database;

and

wherein said storing is based on space available in the database.

36. The computer-readable medium of claim 32, wherein the unique senders are identified in an address book in the user'"'"'s mailbox.

37. A system comprising:

a plurality of processors;

a server for receiving an electronic message from a sender, the message comprising a message body and a sender address, the message identifying a recipient;

a selection engine implemented on one of the plurality of processors for identifying the recipient as having a trusted account identified in a trusted database, the account identifying a plurality of sender addresses as being trusted;

a determination engine implemented on one of the plurality of processors for determining whether the sender address is an identified trusted sender address in the recipient'"'"'s trusted account, wherein if the sender address is not identified as a trusted sender, the message is identified as potential spam;

the determination engine configured for comparing the message body of the message with a message body of each of a corpus of existing messages in the database that are identified as potential span, wherein if a match exists between the message body of the message and at least one message body of the existing messages, a message body match counter is incremented;

the determination engine configured for comparing the counter'"'"'s value with a predetermined threshold value, the predetermined threshold value indicating a probability of a message being spam; and

the determination engine configured for identifying the message as spam based on the comparison.

38. The system of claim 37, further comprising:

the server, upon the determination engine determining the sender address being a trusted sender address, transmitting the message to the recipient, the message being identified as not spam.

39. The system of claim 37, further comprising:

the selection engine identifying the recipient as running a messaging application, the recipient having a mailbox within said messaging application;

the selection engine determining if the recipient'"'"'s mailbox satisfies a selection criteria, the selection engine performing the steps comprising;

determining whether the mailbox has been active for at least a predetermined time period;

determining whether the mailbox comprises at least a predetermined number of messages; and

determining whether the messages comprise a number of unique senders being within a predetermined range, the predetermined range being a portion of the number of messages; and

the selection engine creating the trusted account for the user'"'"'s mailbox; and

the selection engine storing the account in the trusted database based upon the user'"'"'s mailbox satisfying all the selection criteria requirements.

40. The system of claim 39, further comprising:

the selection engine populating an account pool with a plurality of users, the portion of users having satisfied the selection criteria, the account pool being limited to a predetermined range of users based upon location.