TECHNIQUES TO FILTER ELECTRONIC MAIL BASED ON LANGUAGE AND COUNTRY OF ORIGIN

• US 20130339456A1
• Filed: 06/29/2012
• Published: 12/19/2013
• Est. Priority Date: 06/15/2012
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gandhi, Mauktik, Sundaram, Manivannan, Nikolayev, Alexander, Beher, Mukesh, Zink, Terence
• Granted Patent: US 9,412,096 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Techniques to detect spam using language and a country of origin of an e-mail may include receiving an e-mail message for a recipient, detecting a country of origin for the e-mail message and detecting a language of the e-mail message. A technique may further include determining a country frequency with which the recipient communicates with the country of origin by e-mail, and a language frequency with which the recipient communicates in the language by e-mail. A technique may assign a first score to the message according to the country frequency, and a second score to the message according to the language frequency. The scores may used to determine whether the e-mail message is spam. Other embodiments are described and claimed.

Claims

1. An apparatus, comprising:

a logic circuit; and

spam filtering logic operative on the logic circuit to;

detect a country of origin for an e-mail message to a recipient;

detect a language of the e-mail message;

assign a first score to the message according to a country frequency, wherein the country frequency indicates a frequency with which the recipient communicates with a country of origin by e-mail;

assign a second score to the message according to a language frequency, wherein the language frequency indicates a frequency with which the recipient communicates in a language by e-mail; and

filter the e-mail message according to the first score and the second score.

2. The apparatus of claim 1, comprising a history component operative on the logic circuit to store a profile for a recipient including data about a country of origin and a language each time an e-mail message is sent, read or deleted.

3. The apparatus of claim 2, the history component operative to aggregate the profile to calculate the country frequency for each country to which the recipient sends e-mail and from which the recipient receives e-mail, and to calculate the language frequency for each language used in an e-mail sent by or received for the recipient.

4. The apparatus of claim 2, the history component operative to calculate the country frequency and the language frequency from profile data within a time window, wherein profile data from within the time window has greater weight that profile data from older than the time window.

5. The apparatus of claim 1, the spam filtering logic operative to:

detect a plurality of languages from the content of the e-mail message;

determine a separate language frequency for each language; and

assign a separate score for each of the separate language frequencies.

6. The apparatus of claim 1, the spam filtering logic operative to:

assign the first score to a value inversely proportional to the country frequency;

assign the second score to a value inversely proportional to the language frequency; and

wherein a higher score indicates a higher probability that the e-mail message is spam.

7. The apparatus of claim 6, the spam filtering logic further to:

determine a set of languages common to the country of origin;

determine whether the detected language is in the set; and

assign a third score according to whether the detected language is in the set, wherein the third score indicates a higher probability that the message is spam when the detected language is not in the set.

8. A computer-implemented method, comprising:

receiving an e-mail message for a recipient;

detecting a country of origin for the e-mail message;

detecting a language of the e-mail message;

determining at least one of a country frequency with which the recipient communicates with a country of origin by e-mail, or a language frequency with which the recipient communicates in a language by e-mail;

assigning a first score to the message according to the country frequency;

assigning a second score to the message according to the language frequency; and

using the first score and the second score to determine whether the e-mail message is spam.

9. The computer-implemented method of claim 8, comprising using network address of the e-mail message to determine the country of origin.

10. The computer-implemented method of claim 8, comprising detecting a language from the content of the e-mail message.

11. The computer-implemented method of claim 10, comprising:

detecting a plurality of languages from the content of the e-mail message;

determining a separate language frequency for each language; and

assigning a score for each of the separate language frequencies.

12. The computer-implemented method of claim 8, comprising applying an additional filter rule to determine whether the e-mail message is spam, when the first and second scores do not cause the e-mail message to be determined to be spam.

13. The computer-implemented method of claim 8, comprising:

determining the country frequency and the language frequency from a profile of the recipient; and

updating the profile of the recipient with data about a country of origin and a language each time an e-mail message is sent, read or deleted.

14. The computer-implemented method of claim 8, wherein:

the first score is inversely proportional to the country frequency;

the second score is inversely proportional to the language frequency; and

a higher score indicates a higher probability that the e-mail message is spam.

15. The computer-implemented method of claim 14, comprising:

determining a set of languages common to the country of origin;

determining whether the detected language is in the set; and

assigning a third score according to whether the detected language is in the set, wherein the third score indicates a high probability that the message is spam when the detected language is not in the set.

16. At least one computer-readable storage medium comprising instructions that, when executed, cause a system to:

detect a country of origin for a received e-mail message;

detect a language of the e-mail message;

determining at least one of a country frequency with which the recipient communicates with the country of origin by e-mail or a language frequency with which the recipient communicates in the language by e-mail;

assigning a first score to the message according to the country frequency;

assigning a second score to the message according to the language frequency; and

using the first score and the second score to determine whether the e-mail message is spam.

17. The computer-readable storage medium of claim 16, comprising instructions that when executed cause the system to:

add the first score and second score to generate a total score;

compare the total score to a threshold; and

determine the e-mail message to be spam when the total score exceeds the threshold.

18. The computer-readable storage medium of claim 16, wherein:

a first range of country frequencies is associated with a first country score;

a second range of country frequencies is associated with a second country score;

a first range of language frequencies is associated with a first language score;

a second range of language frequencies is associated with a second language score; and

the medium comprising instructions that when executed cause the system to;

assign the first country score to the message when the determined country frequency is in the first range of country frequencies and the second country score when the determined country frequency is in the second range of country frequencies; and

assign the first language score to the message when the determined language frequency is in the first range of language frequencies and the second language score when the determined language frequency is in the second range of language frequencies.

19. The computer-readable storage medium of claim 16, comprising instructions that when executed cause the system to:

determine a set of languages common to the country of origin;

determine whether the detected language is in the set; and

assign a third score according to whether the detected language is in the set, wherein the third score indicates a higher probability that the message is spam when the detected language is not in the set.

20. The computer-readable storage medium of claim 16, comprising instructions that when executed cause the system to:

detect a plurality of languages from the content of the e-mail message;

determine a separate language frequency for each language; and

assign a separate score for each of the separate language frequencies