Automatic Isolation and Detection of Outbound Spam

• US 20150020193A1
• Filed: 07/10/2013
• Published: 01/15/2015
• Est. Priority Date: 07/10/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Yost, David Nicholas, Nikolayev, Alexander
• Granted Patent: US 9,455,989 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5084 Providing for device mobility network addressing or numbering for mobility support in wireless networks H04W8/26; mobile IP H04W80/04
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Embodiments provide IP address partitioning features that can be used to source outbound email communications, but the embodiments are not so limited. In an embodiment, a computer-based method operates to identify and/or isolate one or more customers that may be misusing one or more IP addresses of a partition. A system of an embodiment is configured in part to divide a partition that includes one or more potentially misused IP addresses into one or more levels of sub-partitions as part of identifying offending or potentially offending customers. Other embodiments are included.

Claims

1. A system comprising:

at least one server computer configured to;

use a partition associated with a plurality of Internet Protocol (IP) addresses used for outbound email communications;

if the partition is blocked from sending outbound email communications generate rules to;

divide the partition into a plurality of sub-partitions;

assign individual IP addresses to each of the plurality of sub-partitions;

monitor the plurality of sub-partitions to detect when a sub-partition is blocked from sending outbound email communications and continue to divide any blocked sub-partition until there are no blocked sub-partitions or a single customer exists in a blocked sub-partition; and

recombine any unblocked sub-partitions into a new partition and source reputable IP addresses from other unblocked partitions for sending outbound email communications.

2. The system of claim 1, wherein the server computer is further configured to assign new IP addresses for the new partition.

3. The system of claim 1, wherein the server computer is further configured to receive IP address reputation information from a reputation component as part of determining a blocked status of a partition or a sub-partition.

4. The system of claim 1, wherein the server computer is further configured to monitor reputations of blocked sub-partitions for a designated amount of time before allowing outbound email communications from the blocked sub-partitions.

5. The system of claim 1, wherein the server computer is further configured to automatically mitigate outbound customer email from being blocked.

6. The system of claim 1, wherein the server computer is further configured to generate rules that assign known reputable IP addresses from one or more different partitions for each of the plurality of sub-partitions.

7. The system of claim 1, wherein the server computer is further configured to generate rules that randomly assign one or more customers associated with the partition to each of the plurality of sub-partitions as part of isolating spamming customers.

8. The system of claim 1, wherein the server computer is further configured to monitor the new partition to determine whether the new partition is blocked.

9. The system of claim 1, wherein the server computer is further configured to receive reputation information associated with each IP address as part of identifying spamming customers.

10. The system of claim 1, wherein the server computer is further configured to isolate spamming customers to prevent sending of outbound email from the spamming customers.

11. A method comprising:

using a partition that includes a plurality of IP addresses used for outbound email communications for a group of customers;

determining if the partition is blocked from sending outbound email communications;

if the partition is blocked from sending outbound email communications;

dividing the blocked partition into a plurality of sub-partitions and randomly assigning one or more customers of the group of customers to each sub-partition;

sourcing reputable IP addresses to each of the plurality of sub-partitions;

detecting when a sub-partition is blocked from sending outbound email communications and continue to divide any blocked sub-partition until there are no blocked sub-partitions or a single customer exists in a blocked sub-partition; and

recombining any unblocked sub-partitions.

12. The method of claim 11, further comprising recombining unblocked sub-partitions into a new partition and sourcing good IP addresses from other unblocked partitions.

13. The method of claim 11, further comprising monitoring the plurality of sub-partitions for a designated amount of time to identify further spamming.

14. The method of claim 11, further comprising:

if one or more first sub-partitions are blocked from sending outbound email communications for more than one customer of the group of customers;

dividing each of the first sub-partitions that are blocked into a plurality of second sub-partitions and assigning one or more customers of the group of customers in each of the second sub-partitions;

assigning a good IP address to each of the plurality of second sub-partitions;

monitoring the plurality of second sub-partitions to identify if one or more of the second sub-partitions are blocked from sending outbound email communications; and

identifying a customer of one of the second sub-partitions that are being blocked from sending outbound email communications.

15. The method of claim 11, further comprising contacting a spamming customer to inform of a blocked status.

16. The method of claim 11, further comprising allowing one or more customers not identified as spammers to send outbound email communications.

17. Computer storage which stores executable instructions that operate to:

receive blocked partition information associated with a plurality of IP addresses;

divide a blocked partition into a plurality of first sub-partitions;

assign a reputable IP address for each of the plurality of first sub-partitions;

monitor a status of each of the plurality of first sub-partitions to identify if a first sub-partition is blocked from sending outbound email communications;

if a first sub-partition is blocked and includes more than one customer, then;

divide the first sub-partition that is blocked into a plurality of second sub-partitions;

assign new IP addresses for each of the plurality of second sub-partitions;

monitor a status of each of the plurality of second sub-partitions to identify if a second sub-partition is blocked from sending outbound email communications;

if a blocked second sub-partition exists and includes one customer then identify the one customer as a spamming source; and

resolve the blocked partition by recombining unblocked ones of the first and second sub-partitions into a new partition.

18. The computer storage of claim 17, wherein the instructions operate further to contact a customer of a blocked sub-partition to inform of a spamming issue.

19. The computer storage of claim 17, wherein the instructions operate further to automatically mitigate outbound customer email from being blocked.

20. The computer storage of claim 17, wherein the instructions operate further to randomly assign one or more customers associated with the partition to each of the plurality of sub-partitions as part of isolating spamming customers while reducing disruption of other customer email.