MESSAGE FILTERING METHOD

• US 20110119342A1
• Filed: 11/15/2010
• Published: 05/19/2011
• Est. Priority Date: 09/03/2003
• Status: Active Grant

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Hoshiko LLC (Raoul Management LLC)
• Inventors: Shuster, Gary Stephen
• Granted Patent: US 8,194,564 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL

Abstract

A message filtering method makes use of a database in which domain names of a network, such as the Internet, are associated with IP addresses, or with geographic locations. Electronic messages are tested for authenticity by comparing domain names and IP addresses for a message being tested with information in the database. If the sender information in the message does not have the same associations as information in the database, the message may be blocked, flagged as spam, or subjected to further filtering.

Claims

1. A method comprising:

determining, by a computing device, sender information for an electronic mail message, wherein the sender information comprises a domain name within the sender'"'"'s email address and an originating IP address for at least one of the servers transmitting the electronic mail message;

determining one or more permitted users of at least a portion of the domain name;

determining one or more permitted users of the originating IP address;

comparing, by the computing device, the permitted users of the at least one portion of the domain name with the permitted users of the originating IP address; and

providing an indication of likelihood that the mail message constitutes spam based on at least said comparing, wherein the indication indicates a higher likelihood that the mail message constitutes spam if such permitted users do not match.

2. The method of claim 1, wherein the permitted users of at least one portion of the domain name include the owner of the domain name.

3. The method of claim 1, wherein the permitted users of the originating IP address include an entity associated with a range of IP addresses that includes the originating IP address.

4. The method of claim 1, further comprising:

determining a first geographic location associated with the domain name;

determining a second geographic location associated with the originating IP address; and

comparing the first geographic location and the second geographic location, wherein the indication of likelihood that the mail message constitutes spam is further based on said comparing the first geographic location and the section geographic location.

5. A tangible computer-readable medium storing instructions thereon, wherein the instructions are readable by a computing device in order to cause the computing device to perform operations comprising:

determining a domain name associated with a sender'"'"'s address of an electronic message;

determining an originating IP address for at least one server associated with transmission of the electronic message;

determining an owner of a range of IP addresses including the originating IP address;

comparing the domain name to the owner in order to generate a likelihood that the domain name is associated with the owner; and

based on said comparing, providing an indication of a likelihood that the electronic message includes spam.

6. The tangible computer-readable medium of claim 5, wherein the indication indicates a higher likelihood that the electronic message includes spam if the domain name and the owner do not substantially match.

7. The tangible computer-readable medium of claim 5, wherein said determining the owner of the range of IP addresses comprises accessing a data structure storing IP ranges and associated respective owners of the IP ranges.

8. The tangible computer-readable medium of claim 5, wherein the operations further comprise:

determining a first geographic location associated with the domain name;

determining a second geographic location associated with the originating IP address; and

comparing the first geographic location and the second geographic location, wherein the indication of likelihood that the mail message includes spam is further based on said comparing the first geographic location and the section geographic location.

9. A computing system comprising:

a processing unit configured to execute software instructions;

a computer readable medium storing software instructions for execution by the processing unit in order to cause the computing system to perform operations comprising;

determining sender information for an electronic message, wherein the sender information comprises a domain name associated with a sender of the electronic message and an originating IP address associated with at least one server involved in transmission of the electronic message;

determining one or more permitted users of at least a portion of the domain name;

determining one or more permitted users of the originating IP address;

comparing the permitted users of the at least one portion of the domain name with the permitted users of the originating IP address; and

providing an indication of likelihood that the electronic message constitutes spam based on at least said comparing, wherein the indication indicates a higher likelihood that the electronic message constitutes spam if such permitted users do not match.

10. The computing system of claim 9, wherein the indication indicates a higher likelihood that the electronic message includes spam if the domain name and the owner do not substantially match.

11. The computing system of claim 9, wherein said determining the permitted users of the originating IP address comprises accessing a data structure storing IP ranges and associated respective owners of the IP ranges.

12. The computing system of claim 9, wherein the operations further comprise:

determining a first geographic location associated with the domain name;

determining a second geographic location associated with the originating IP address; and

comparing the first geographic location and the second geographic location, wherein the indication of likelihood that the electronic message constitutes spam is further based on said comparing the first geographic location and the section geographic location.