METHOD AND SYSTEM FOR HANDLING UNWANTED EMAIL MESSAGES

• US 20130346528A1
• Filed: 08/27/2013
• Published: 12/26/2013
• Est. Priority Date: 11/14/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Shinde, Rajesh, Awasthi, Harish Mohan
• Granted Patent: US 9,419,927 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method, system, and computer program product for scanning incoming emails reduces the server resources needed, which improves server throughput and reduces costs. A method for processing incoming email messages comprised the steps of scanning incoming email messages to obtain an address of a sender of each incoming email message and to determine whether the email message is spam, for each email message that is determined to be spam, incrementing a count of email messages that are spam for a sender of the email message, determining that a count of email messages that are spam for a sender of an email message has exceeded a threshold, and thereafter, discarding all incoming email messages from the sender for which the count of email messages that are spam for a sender of an email message has exceeded a threshold without scanning the email messages to determine whether they are spam.

Claims

1-42. -42. (canceled)

43. A method, comprising:

scanning incoming email messages from an email address of a sender previously identified as a source of spam;

determining that a count, of email messages from the email address of the sender that are clean, has exceeded a threshold over a predefined time period; and

placing the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender.

44. The method of claim 43, further comprising:

scanning new email messages to identify traits that are typical of spam email messages, wherein at least one of the traits is associated with patterns in respective headers of the new email messages.

45. The method of claim 43, wherein the scanning further comprises:

scanning a first name and a last name of the sender.

46. The method of claim 43, further comprising:

counting spam and clean characteristics of new email messages; and

storing results of the counting in a database.

47. The method of claim 46, wherein the database includes a selected one or more of a group of columns, the group consisting of:

a) an email address column;

b) a count of email messages marked spam column;

c) a count of email messages quarantined column; and

d) a count of clean email messages column.

48. The method of claim 46, wherein the database is to be accessed by an email server using a particular email address of a particular sender.

49. The method of claim 46, wherein the columns in the database are incremented based on results associated with scanning the new email messages.

50. The method of claim 43, further comprising:

evaluating new email messages;

obtaining respective email addresses for each of the new email messages;

evaluating a spam list and the clean list of a database to determine whether the respective email addresses are present in either of the lists;

discarding a first group of the new email messages based on the first group having corresponding email addresses that are present on the spam list; and

delivering a second group of the new email messages based on the second group having corresponding email addresses that are present on the clean list.

51. One or more computer-readable storage media storing instructions that, when executed, cause a computing device to perform a method, the method comprising:

scanning incoming email messages from an email address of a sender previously identified as a source of spam;

determining that a count, of email messages from the email address of the sender that are clean, has exceeded a threshold over a predefined time period; and

placing the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender.

52. The one or more computer-readable storage media of claim 51, the method further comprising:

scanning new email messages to identify traits that are typical of spam email messages, wherein at least one of the traits is associated with patterns in respective headers of the new email messages.

53. The one or more computer-readable storage media of claim 51, the method further comprising:

scanning a first name and a last name of the sender.

54. The one or more computer-readable storage media of claim 51, the method further comprising:

counting spam and clean characteristics of new email messages; and

storing results of the counting in a database.

55. The one or more computer-readable storage media of claim 54, wherein the database includes a selected one or more of a group of columns, the group consisting of:

a) an email address column;

b) a count of email messages marked spam column;

c) a count of email messages quarantined column; and

d) a count of clean email messages column.

56. The one or more computer-readable storage media of claim 54, wherein the database is to be accessed by an email server using a particular email address of a particular sender.

57. The one or more computer-readable storage media of claim 54, wherein the columns in the database are incremented based on results associated with scanning the new email messages.

58. The one or more computer-readable storage media of claim 51, the method further comprising:

evaluating new email messages;

obtaining respective email addresses for each of the new email messages;

evaluating a spam list and the clean list of a database to determine whether the respective email addresses are present in either of the lists;

discarding a first group of the new email messages based on the first group having corresponding email addresses that are present on the spam list; and

delivering a second group of the new email messages based on the second group having corresponding email addresses that are present on the clean list.

59. A server, comprising:

a processor; and

a memory coupled to the processor, wherein the server is configured to;

scan incoming email messages from an email address of a sender previously identified as a source of spam;

determine that a count, of email messages from the email address of the sender that are clean, has exceeded a threshold over a predefined time period; and

place the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender.

60. The server of claim 59, wherein the server is further configured to:

scan new email messages to identify traits that are typical of spam email messages, wherein at least one of the traits is associated with patterns in respective headers of the new email messages.

61. The server of claim 59, wherein the scanning further comprises:

scanning a first name and a last name of the sender.

62. The server of claim 59, wherein the server is further configured to:

count spam and clean characteristics of new email messages; and

store results of the counting in a database.

63. The server of claim 62, wherein the database includes a selected one or more of a group of columns, the group consisting of:

a) an email address column;

b) a count of email messages marked spam column;

c) a count of email messages quarantined column; and

d) a count of clean email messages column.

64. The server of claim 62, wherein the database is to be accessed by the server using a particular email address of a particular sender.

65. The server of claim 62, wherein the columns in the database are incremented based on results associated with scanning the new email messages.

66. The server of claim 59, wherein the server is further configured to:

evaluate new email messages;

obtain respective email addresses for each of the new email messages;

evaluate a spam list and the clean list of a database to determine whether the respective email addresses are present in either of the lists;

discard a first group of the new email messages based on the first group having corresponding email addresses that are present on the spam list; and

deliver a second group of the new email messages based on the second group having corresponding email addresses that are present on the clean list.