FILTERING ELECTRONIC MESSAGES BASED ON DOMAIN ATTRIBUTES WITHOUT REPUTATION

• US 20160072752A1
• Filed: 11/16/2015
• Published: 03/10/2016
• Est. Priority Date: 08/19/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Nikolayev, Alexander V., Li, Weisheng, Gandhi, Mauktik
• Granted Patent: US 9,979,685 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A messaging application filters electronic messages based on domain attributes without a reputation. A message with a uniform resource identifier (URI) is received and determined to not be included within a trusted or a block list. A total score is computed from weighted scores assigned to factors associated with the message. The message is evaluated for an unsolicited message determination by comparing the total score against a predetermined threshold.

Claims

1. A method executed on a computing device for filtering an electronic message based on domain attributes, the method comprising:

receiving the electronic message with a uniform resource identifier (URI);

determining whether the Lai is associated with a reputation, wherein the URI is associated with the reputation when a domain of the URI is located within a list of trusted domains and a list of untrusted domains;

in response to a determination that the URI lacks an association with the reputation, assigning weighted scores to one or more factors associated with the electronic message;

computing a total score from the weighted scores; and

evaluating the electronic message to determine an unsolicited electronic message by comparing the total score against a predetermined threshold.

2. The method of claim 1, further comprising:

confirming the unsolicited message determination of the electronic message in response to the total score exceeding the predetermined threshold.

3. The method of claim 1, further comprising:

rejecting the unsolicited message determination of the electronic message in response to the total score remaining within the predetermined threshold.

4. The method of claim 1, wherein assigning weighted scores to one or more factors associated with the electronic message comprises:

determining a size of the electronic message; and

assigning a first weighted score to the size.

5. The method of claim 1, wherein assigning weighted scores to one or more factors associated with the electronic message comprises:

incrementing a URI count; and

assigning a second weighted score to the URI count.

6. The method of claim 5, wherein the URI count is a number of URIs without reputations:

located within the electronic message.

7. The method of claim 1, wherein assigning weighted scores to one or more factors associated with the electronic message comprises:

determining a set of electronic messages sent to other recipients within a predefined group having the URI;

computing a number of recipients of the set of electronic messages; and

assigning a third weighted score to the number of recipients.

8. The method of claim 7, further comprising;

computing a number of recipient domains for the set of electronic messages; and

assigning a fourth weighted score to the number of recipient domains.

9. The method of claim 7, further comprising:

computing at least one of a time of arrival and a rate of arrival of the set of electronic messages; and

assigning a fifth weighted score to the at least one of the time of arrival and the rate of arrival of the set of electronic messages.

10. The method of claim 1, wherein assigning weighted scores to one or more factors associated with the electronic message comprises:

determining a geo-location of a sender of the electronic message; and

assigning a sixth weighted score to the geo-location.

11. A computing device for filtering an electronic message based on domain attributes, the computing device comprising:

a memory configured to store instructions; and

a processor coupled to the memory, the processor executing a messaging application in conjunction with the instructions stored in the memory, wherein the messaging application is configured to;

receive the electronic message with a uniform resource identifier (URI) from another computing device;

determine whether the URI is associated with a reputation, wherein the URI is associated with the reputation when a domain of the URI is located within a list of trusted domains and a list of untrusted domains;

in response to a determination that the URI lacks an association with the reputation, assign weighted scores to one or more factors associated with the electronic message;

compute a total score from the weighted scores; and

evaluate the electronic message to determine an unsolicited electronic message by comparing the total score against a predetermined threshold.

12. The computing device of claim 11, wherein the messaging application is further configured to:

in response to a determination that the URI is associated with the reputation, determine whether the URI is associated with one of a positive reputation and a negative reputation.

13. The computing device of claim 12, wherein the URI is associated with the positive reputation when the domain of the URI is located within the list of trusted domains and the URI is associated with the negative reputation when the domain of the URI is located within the list of untrusted domains.

14. The computing device of claim 11, wherein the messaging application is further configured to:

forward the electronic message to another computing device for display in response to a determination that the total score remains within the predetermined threshold and the electronic message is not unsolicited electronic message.

15. The computing device of claim 11, wherein the messaging application is further configured to:

dynamically adjust the predetermined threshold and the weighted scores based on at least one of a current unsolicited message activity and a recipient of the message.

16. The computing device of claim 11, wherein the messaging application is further configured to:

adjust the weighted scores over time based on at least one of;

accumulated data and statistics associated with the one or more factors.

17. A system for filtering an electronic message based on domain attributes, the system comprising:

a communication module configured to facilitate transmission of the electronic message between one or more servers over a network;

an external message server configured to provide the electronic message with a uniform resource identifier (URI) to a local message server; and

the local message server configured to;

determine whether the URI is associated with a reputation, wherein the URI is associated with the reputation when a domain of the URI is located within a list of trusted domains and a list of untrusted domains;

in response to a determination that the URI lacks an association with the reputation, assign weighted scores to one or more factors associated with the electronic message;

compute a total score from the weighted scores; and

evaluate the electronic message to determine an unsolicited electronic message by comparing the total score against a predetermined threshold.

18. The system of claim 17, wherein the messaging application is configured to receive the list of trusted domains and the list of untrusted domains from one of a local resource and a trusted external resource.

19. The system of claim 17, wherein the one or more factors include statistics associated with the URI, a sender, a geo-location of the sender, a site oldie message, a recipient, a recipient count, a recipient domain, a recipient domain count, and a number or additional messages comprising the URI.

20. The system of claim 17, wherein at least two of the assigned weighted scores are added to compute the total score.