DETERMINING EMAIL AUTHENTICITY

• US 20150373031A1
• Filed: 06/24/2014
• Published: 12/24/2015
• Est. Priority Date: 06/24/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hockings, Christopher J., Readshaw, Neil I.
• Granted Patent: US 10,003,602 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Monitoring across multiple-channels, used by multiple devices, to determine which email messages being sent to a user are solicited by the user. A broad spectrum of network and telephony access records are analyzed to determine whether an email message is likely being sent as a result of legitimate services access by the user.

Claims

1. A method comprising:

monitoring service access by a user to a plurality of internet-based services;

storing a service access dataset for the user;

receiving an email dataset from an email service that includes a uniform resource locator (URL); and

determining a correlation between the email dataset and the service access dataset.

2. The method of claim 1, wherein the internet-based services and the email service are provided by a same commercial entity.

3. The method of claim 1, further comprising:

determining a plurality of internet-based services provided to the user.

4. The method of claim 1, wherein the service access dataset includes one, or more, of the following:

an account name used to subscribe to an internet service provider (ISP) service, a channel used by the user, what time the channel is used, how long the channel is used, a content provider visited by the user, and/or a protocol used by the user.

5. The method of claim 1, wherein determining the correlation between the email dataset and the service access dataset includes the step of identifying email information in the email dataset including one, or more, of the following:

email metadata, email address, and/or email content.

6. The method of claim 5, wherein determining the correlation between the email dataset and the service access dataset includes the step of comparing the email information with the service access dataset that includes one of the following:

(i) network access records;

(ii) telephony access records; and

(iii) recent internet usage.

7. The method of claim 6, wherein the correlation is determined when one of the following is true:

the email information is delivered by a content provider identified in the service access dataset, and the URL has a domain name that is included in the service access dataset.

8. A computer program product comprising a computer readable storage medium having stored thereon:

first program instructions programmed to monitor service access by a user to a plurality of internet-based services;

second program instructions programmed to store a service access dataset for the user;

third program instructions programmed to receive an email dataset from an email service that includes a uniform resource locator (URL); and

fourth program instructions programmed to determine a correlation between the email dataset and the service access dataset.

9. The computer program product of claim 8, wherein the internet-based services and the email service are provided by a same commercial entity.

10. The computer program product of claim 8, further comprising:

fifth program instructions programmed to determine a plurality of internet-based services provided to the user.

11. The computer program product of claim 8, wherein the service access dataset includes one, or more, of the following:

an account name used to subscribe to an internet service provider (ISP) service, a channel used by the user, what time the channel is used, how long the channel is used, a content provider visited by the user, and/or a protocol used by the user.

12. The computer program product of claim 8, wherein determining the correlation between the email dataset and the service access dataset includes program instructions programmed to identify email information in the email dataset including one, or more, of the following:

email metadata, email address, and/or email content.

13. The computer program product of claim 12, wherein determining the correlation between the email dataset and the service access dataset includes program instructions programmed to compare the email information with the service access dataset that includes one of the following:

(i) network access records;

(ii) telephony access records; and

(iii) recent internet usage.

14. The computer program product of claim 13, wherein the correlation is determined when one of the following is true:

the email information is delivered by a content provider identified in the service access dataset, and the URL has a domain name that is included in the service access dataset.

15. A computer system comprising:

a processor(s) set; and

a computer readable storage medium;

wherein;

the processor set is structured, located, connected, and/or programmed to run program instructions stored on the computer readable storage medium; and

the program instructions include;

first program instructions programmed to monitor service access by a user to a plurality of internet-based services;

second program instructions programmed to store a service access dataset for the user;

third program instructions programmed to receive an email dataset from an email service that includes a uniform resource locator (URL); and

fourth program instructions programmed to determine a correlation between the email dataset and the service access dataset.

16. The computer system of claim 15, wherein the internet-based services and the email service are provided by a same commercial entity.

17. The computer system of claim 15, further comprising:

fifth program instructions programmed to determine a plurality of internet-based services provided to the user.

18. The computer system of claim 15, wherein the service access dataset includes one of the following:

an account name used to subscribe to an internet service provider (ISP) service, a channel used by the user, what time the channel is used, how long the channel is used, a content provider visited by the user, and/or a protocol used by the user.

19. The computer system of claim 15, wherein determining the correlation between the email dataset and the service access dataset includes program instructions programmed to identify email information in the email dataset including one, or more, of the following:

email metadata, email address, and/or email content.

20. The computer system of claim 19, wherein determining the correlation between the email dataset and the service access dataset includes program instructions programmed to compare the email information with the service access dataset that includes one of the following:

(i) network access records;

(ii) telephony access records; and

(iii) recent internet usage.