REAL-TIME SPAM LOOK-UP SYSTEM

• US 20100332601A1
• Filed: 06/26/2009
• Published: 12/30/2010
• Est. Priority Date: 06/26/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Hines, Douglas John, Davis, Malcolm Hollis, Walter, Jason D., Gillum, Eliot C., Mills, Chad W., McCann, Robert Lee, Drinic, Milenko, Bidgoli, Mehrdad, Vitaldevara, Krishna C., Korb, Joshua David, Colvin, Ryan Charles
• Granted Patent: US 8,959,157 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method of managing unsolicited email sent to an email system over a network. Email messages are received at an message at an inbound mail transfer agent. A determination is made as to whether the email message is suspected to be an unsolicited suspect message. One or more queries for additional information on one or more characteristics of the message is initiated. Determinations are made based on replies to the queries before issuing a message accepted for delivery indication to a sending server.

Claims

1. A method of managing unsolicited email sent to an email system over a, the system including a plurality of inbound mail servers, comprising:

(a) receiving an email message at an inbound mail transfer agent;

(b) determining whether the email message is suspected to be an unsolicited suspect message;

(c) initiating a query for additional information on one or more characteristics of the message, the query returning information on the characteristic based on the network;

(d) receiving a response to at lease one of the searches on the physical characteristic;

(e) determining whether the message is unsolicited bulk email based on the result of the at least one search;

(f) acting on the message as based on the determining step.

2. The method of claim 1 wherein the step (b) includes determining whether the message is suspect based on the results of a previous query.

3. The method of claim 1 wherein the method further includes storing the results of each query for use in the step (b).

4. The method of claim 1 wherein the method step (e) includes using the updated search results from a plurality of concurrent searches to perform the determining step.

5. The method of claim 1 wherein the step (b) comprises at least one of:

determining the true source IP for a message and whether that IP is associated with known spam senders;

determining the source IP for a message and whether that Ip is associated with a block of IPs associated with known spam senders;

determining the source IP and whether a registrant of a domain associated with the source IP is IPs associated with known spam senders;

determining for a domain name the authoritative name server for the domain and whether the ANS is associated with a known spammer;

determining the MX record associated with a sender and whether domains or IP addresses in the MX record are associated with known spam senders;

determining a host name associated with a known IP address of an email source and determining whether the host name server IPs are associated with known spam senders;

determining a name server associated with a sending domain and determining whether the name server is associated with known spam senders.

6. The method of claim 1 wherein the step of initiating includes performing a plurality of queries on multiple characteristics of the message.

7. The method of claim 1 wherein the method includes performing the plurality of queries asynchronously.

8. The method of claim 1 further including receiving a reply to one of the plurality of quires and determining whether the reply is determinative of whether the message is spam before receiving replies to others of said queries.

9. The method of claim 1 wherein the step (f) include one or more of:

determining to reject the message and not issuing a message accepted for delivery message;

determining to reject the message by issuing an SMTP level 500 error;

determining to accept the message and route the message to a junk folder,

determining to accept the message and automatically deleting the message;

determining to accept the message and rendering the message differently.

10. A method for determining whether to issue a mail accepted for delivery message for an email message received over a network, comprising:

determining whether the email message has spam characteristic;

issuing a plurality queries one or more components of the message to determine whether the message shares network infrastructure characteristics with messages previously determined to be spam;

receiving a reply to one or more of the plurality of queries;

determining if the reply received is sufficient to determine whether the message is or is not spam;

if the reply received is sufficient to determine whether the message is or is not spam, determining, based on said reply, whether the message is or is not spam, and if not waiting for one or more additional replies;

issuing or withholding a message accepted for delivery message based on one or more reply'"'"'s sufficient to determine whether the message is or is not spam.

11. The method of claim 10 wherein the method further includes storing reply queries for use in each determining step, issuing includes determining whether the message is suspect based on the results of a previous query.

12. The method of claim 11 wherein issuing or withholding includes using updated search results from a plurality of concurrent queries to perform the determining step.

13. The method of claim 12 wherein determining whether a message has a spam characteristic includes determining one or a sender classification, whether the message is authenticated or determining a spam probability based on assigning a spam score.

14. The method of claim 13 wherein the step of determining whether the message is or is not spam includes at least one of:

determining the true source IP for a message and whether that IP is associated with known spam senders;

determining the source IP for a message and whether that Ip is associated with a block of IPs associated with known spam senders;

determining the source IP and whether a registrant of a domain associated with the source IP is IPs associated with known spam senders;

determining for a domain name the authoritative name server for the domain and whether the ANS is associated with a known spammer;

determining the MX record associated with a sender and whether domains or IP addresses in the MX record are associated with known spam senders;

determining a host name associated with a known IP address of an email source and determining whether the host name server IPs are associated with known spam senders;

determining a name server associated with a sending domain and determining whether the name server is associated with known spam senders.

15. The method of claim 14 wherein the step of initiating includes performing a plurality of queries on an multiple characteristics of the message.

16. The method of claim 15 wherein the method includes performing the plurality of queries asynchronously.

17. The method of claim 10 further including receiving a reply to one of the plurality of queries and determining whether the reply is determinative of whether the message is spam before receiving replies to others of said queries.

18. A messaging system comprising a processing device including code providing instructions to the processing device to implement the steps of;

providing a message transfer agent managing connections to the messaging system;

an inbound email parsing agent including a mail component extraction module;

a suspect email determination module including which includes code performing the steps of;

determining whether an email message has spam characteristic;

issuing a plurality queries one or more components of the message to determine whether the message shares characteristics with messages previously determined to be spam or not spam based on network infrastructure characteristics are shared by the message;

receiving a reply to one or more of the plurality of queries;

issuing or withholding a message accepted for delivery message based on one or more reply'"'"'s sufficient to determine whether the message is or is not spam.

19. The system of claim 18 wherein the suspect email determination module further includes code performing the steps of:

determining if the reply received is sufficient to determine whether the message is or is not spam;

if the reply received is sufficient to determine whether the message is or is not spam, determining, based on said reply, whether the message is or is not spam, and if not waiting for one or more additional replies.

20. The system of claim 18 wherein the code issuing a plurality of queries includes issuing a query for at least one of:

determining the true source IP for a message and whether that IP is associated with known spam senders;

determining the source IP for a message and whether that Ip is associated with a block of IPs associated with known spam senders;

determining the source IP and whether a registrant of a domain associated with the source IP is IPs associated with known spam senders;

determining for a domain name the authoritative name server for the domain and whether the ANS is associated with a known spammer;

determining the MX record associated with a sender and whether domains or IP addresses in the MX record are associated with known spam senders;

determining a host name associated with a known IP address of an email source and determining whether the host name server IPs are associated with known spam senders;

determining a name server associated with a sending domain and determining whether the name server is associated with known spam senders.