FILTERING ELECTRONIC MESSAGES BASED ON DOMAIN ATTRIBUTES WITHOUT REPUTATION

• US 20150052207A1
• Filed: 08/19/2013
• Published: 02/19/2015
• Est. Priority Date: 08/19/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Nikolayev, Alexander, Li, Weisheng, Gandhi, Mauktik
• Granted Patent: US 9,258,260 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A messaging application filters electronic messages based on domain attributes without a reputation. A message with a uniform resource identifier (URI) is received and determined to not be included within a trusted or a block list. A total score is computed from weighted scores assigned to factors associated with the message. The message is evaluated for an unsolicited message determination by comparing the total score against a predetermined threshold.

Claims

1. A method executed on a computing device for filtering electronic messages based on domain attributes without a reputation, the method comprising:

receiving a message with a uniform resource identifier (URI);

determining that the URI is not included within at least one of;

a trusted list and a block list;

assigning weighted scores to one or more factors associated with the message;

computing a total score from the weighted scores; and

evaluating the message for an unsolicited message determination by comparing the total score against a predetermined threshold.

2. The method of claim 1, further comprising:

retrieving the trusted list and the block list from one of;

a local resource and a trusted external resource.

3. The method of claim 1, further comprising:

determining the URI as lacking a reputation.

4. The method of claim 3, further comprising:

determining a size of the message; and

assigning a first weighted score to the size.

5. The method of claim 4, further comprising:

incrementing a URI count; and

assigning a second weighted score to the URI count.

6. The method of claim 5, further comprising:

determining a set of messages sent to other recipients within a predefined group having the URI.

7. The method of claim 6, further comprising:

computing a number of recipients of the set of messages; and

assigning a third weighted score to the number of recipients.

8. The method of claim 7, further comprising:

computing a number of recipient domains for the set of messages; and

assigning a fourth weighted score to the number of recipient domains.

9. The method of claim 8, further comprising:

computing at least one of;

a time of arrival and a rate of arrival of the set of messages; and

assigning a fifth weighted score to the at least one of;

the time of arrival and the rate of arrival of the set of messages.

10. The method of claim 9, further comprising:

determining a geo-location of a sender of the message; and

assigning a sixth weighted score to the geo-location.

11. The method of claim 10, further comprising:

adding two or more of the first weighted score, the second weighted score, the third weighted score, the fourth weighted score, the fifth weighted score, and the sixth weighted score to determine the total score.

12. A computing device for filtering electronic messages based on domain attributes without a reputation, the computing device comprising:

a memory configured to store instructions; and

a processor coupled to the memory, the processor executing a messaging application in conjunction with the instructions stored in the memory, wherein the messaging application is configured to;

receive a message with a uniform resource identifier (URI);

retrieve a trusted list and a block list from one of;

a local resource and a trusted external resource;

determine that the URI is not included within at least one of;

the trusted list and the block list;

determine the URI as lacking a reputation;

assign weighted scores to one or more factors associated with the message;

compute a total score from the weighted scores; and

evaluate the message for an unsolicited message determination by comparing the total score against a predetermined threshold.

13. The computing device of claim 12, wherein the messaging application is further configured to:

confirm the unsolicited message determination of the message in response to the total score exceeding the predetermined threshold.

14. The computing device of claim 12, wherein the messaging application is further configured to:

reject the unsolicited message determination of the message in response to the total score remaining within the predetermined threshold.

15. The computing device of claim 12, wherein the messaging application is further configured to:

dynamically adjust the predetermined threshold and the weighted scores based on at least one of;

a current unsolicited message activity and a recipient of the message.

16. The computing device of claim 12, wherein the messaging application is further configured to:

adjust the weighted scores over time based on at least one of;

accumulated data and statistics associated with the one or more factors.

17. The computing device of claim 16, wherein the messaging application is further configured to:

employ a machine-learning algorithm to adjust the weighted scores.

18. A computer-readable memory device with instructions stored thereon for filtering electronic messages based on domain attributes without a reputation, the instructions comprising:

receiving a message with a uniform resource identifier (URI);

retrieving a trusted list and a block list from one of;

a local resource and a trusted external resource;

determining that the URI is not included within at least one of;

the trusted list and the block list;

determining the URI as lacking a reputation;

assigning weighted scores to one or more factors associated with the message;

computing a total score from the weighted scores;

evaluating the message for an unsolicited message determination by comparing the total score against a predetermined threshold; and

dynamically adjusting the predetermined threshold and the weighted scores based on at least one of;

a current unsolicited message activity and a recipient of the message.

19. The computer-readable memory device of claim 18, wherein the instructions further comprise:

confirming the unsolicited message determination of the message in response to the total score exceeding the predetermined threshold; and

rejecting the unsolicited message determination of the message in response to the total score remaining within the predetermined threshold.

20. The computer-readable memory device of claim 19, wherein the instructions further comprise:

adjusting the weighted scores over time based on at least one of;

accumulated data and statistics associated with the factors; and

using a machine-learning algorithm to adjust the weighted scores.