System and method for filtering unsolicited electronic mail messages using data matching and heuristic processing

• US 5,999,932 A
• Filed: 01/13/1998
• Issued: 12/07/1999
• Est. Priority Date: 01/13/1998
• Status: Expired due to Term

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Brightmail, Inc. (Gen Digital Inc.)
• Inventors: Paul, Sunil
• Primary Examiner(s): HOMERE, JEAN RAYMOND
• Application Number:
  US09/006,527
• Time in Patent Office: 693 Days
• Field of Search: 707/6, 707/10, 707/526, 707/102, 395/200.36, 395/200.37, 395/683, 395/200.53, 395/200.43
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: Y10S 707/99936 Pattern matching access

Abstract

A system for eliminating unsolicited electronic mail generates and stores a user inclusion list including identification data for identifying e-mail desired by the user. Data from one or more fields of incoming electronic mail messages are compared with the identification data stored in the user inclusion list. If the electronic mail message data matches corresponding identification data from the user inclusion list, the e-mail message is marked with a first display code, such as "OK." If no match is detected, the system performs at least one heuristic process to determine whether the electronic mail message may be of interest to the user. If the message satisfies one or more criteria as determined by the heuristic process and is therefore of potential interest to the user, the message is marked with a second display code, such as "NEW." If the e-mail message does not satisfy any of the heuristic criteria, the e-mail message may be marked with a third display code, such as "JUNK." The processed e-mail messages are displayed to the user in a display mode corresponding to the display codes respectively assigned to the messages.

Claims

1. A method for filtering electronic mail addressed to a user, comprising the steps of:

storing a user inclusion list including identification data for identifying e-mail desired by the user;

receiving an electronic mail message;

comparing data from said received electronic mail message with said identification data;

upon identifying a match between said electronic mail message data and said identification data, marking said electronic mail with a first display code;

displaying in a first display format said electronic mail message marked with the first display code to the user;

upon failing to detect a match between said electronic mail message data and said identification data, performing at least one heuristic process to determine whether said electronic mail message may be of interest to the user;

upon identifying an electronic mail message of interest to the user, marking said electronic mail with a second display code;

displaying said electronic mail message marked with said second display code to the user in a second display format;

upon failing to identify an electronic mail message of interest to the user, marking the electronic mail message with a third display code; and

displaying said electronic mail message marked with said third display code to the user in a third display format.

2. A method according to claim 1, wherein said inclusion list is created and updated based upon e-mail message data stored in the user'"'"'s e-mail inbox.

3. A method according to claim 1, wherein said inclusion list is created and updated based upon e-mail message data stored in the user'"'"'s e-mail outbox.

4. A method according to claim 1, wherein said inclusion list is created and updated based upon e-mail message data stored in the user'"'"'s e-mail address book.

5. A method according to claim 1, wherein said inclusion list is created and updated in response to e-mail message data stored in the user'"'"'s personal manager program.

6. A method according to claim 1, wherein said identification data includes a plurality of categories of data corresponding to selected fields of e-mail messages received by the user.

7. A method according to claim 6, wherein said electronic mail data is data stored in selected fields of said received electronic mail message.

8. A method according to claim 1, wherein said first display code indicates that said electronic mail message has a first status, said second display code indicates that said electronic mail message has a second status, and said third display code indicates said electronic mail message has a third status.

9. A method according to claim 1, further comprising the step of varying said inclusion list in response to data from received electronic mail messages marked with said first or second display code.

10. A method according to claim 1, wherein said at least one heuristic process includes at least one of the following tests:

(a) a test to determine whether a first field of said received electronic mail message matches a corresponding entry in said user inclusion list;

(b) a test to determine whether said first field of said received electronic mail message has a domain that matches an Internet domain of one or more entries in the corresponding category of said user inclusion list;

(c) a test to determine whether the first field of said received electronic mail message has a domain that matches one of a pre-defined list of domains;

or

(d) a test to determine whether a second field of said received electronic mail message matches a second entry in said user inclusion list.

11. A method according to claim 1, further comprising the step of filtering said electronic mail message using an exclusion list.

12. A method according to claim 11, wherein, when the data from said electronic mail message matches data stored in said exclusion list, said electronic mail message is marked with said third display code and displayed to the user in said third display mode.

13. A method according to claim 1, wherein said inclusion list is created and updated based upon e-mail message data stored in the user'"'"'s real-time awareness and notification system.

14. A system for eliminating unsolicited electronic mail, comprising:

an inclusion list processor for storing identification data for identifying e-mail desired by the user;

an e-mail storage unit for storing incoming electronic mail messages;

an e-mail filter for filtering said stored incoming electronic mail messages in accordance with said identification data stored in said inclusion list processor and for marking each of said electronic mail messages with one of a plurality of display codes to indicate a status of each of said messages; and

a user interface for displaying said filtered electronic mail messages to a user in accordance with said display codes;

wherein said filtering performed by said e-mail filter includes the steps of

(a) comparing data from said incoming electronic mail messages with said identification data;

(b) upon identifying a match between said electronic mail message data and said identification data, marking said electronic mail with a first display code;

(c) transmitting said electronic mail message marked with the first display code to said user interface;

(d) upon failing to detect a match between said electronic mail message data and said identification data, performing at least one heuristic process to determine whether said electronic mail message may be of interest to the user;

(e) upon identifying an electronic mail message of interest to the user, marking said electronic mail message with a second display code; and

(f) transmitting said electronic mail message marked with said second display code to said user interface.

15. A system according to claim 14, wherein said user interface further enables the user to modify said identification data stored in said inclusion list processor.

16. A system according to claim 14, wherein said filtering further comprises the steps of:

upon failing to identify an electronic mail of interest to the user, marking the electronic mail message with a third display code; and

transmitting said electronic mail message marked with said third display code to said user interface.

17. The system according to claim 14, wherein said system is implemented within a user terminal.

18. The system according to claim 14, wherein said system is implemented within a central network server.

19. A system according to claim 14, wherein said inclusion list is created and updated based upon e-mail message data stored in the user'"'"'s e-mail inbox.

20. A system according to claim 14, wherein said inclusion list is created and updated based upon e-mail message data stored in the user'"'"'s e-mail outbox.

21. A system according to claim 14, wherein said inclusion list is created and updated based upon e-mail message data stored in the user'"'"'s e-mail address book.

22. A system according to claim 14, wherein said inclusion list is created and updated in response to e-mail message data stored in the user'"'"'s personal manager program.

23. A system according to claim 14, wherein said identification data includes a plurality of categories of data corresponding selected fields of incoming e-mail messages.

24. A system according to claim 23, wherein said electronic mail data is data stored in said selected fields of said received electronic mail message.

25. A system according to claim 16, wherein said first display code indicates that said electronic mail message has a first status, said second display code indicates that said electronic mail message has a second status, and said third display code indicates that said electronic mail message has a third status.

26. A system according to claim 14, wherein said inclusion list processor varies said inclusion list in response to data from received electronic mail messages marked with said first or second display code.

27. A system according to claim 14, wherein said at least one heuristic process includes one or more of the following tests:

(a) a test to determine whether a first field of said received electronic mail message matches a corresponding entry in said user inclusion list;

(b) a test to determine whether said first field of said received electronic mail message has a domain that matches an Internet domain of one or more entries in the corresponding category of said user inclusion list;

or

(c) a test to determine whether said first field of said received electronic mail message has a domain that matches one of a pre-defined list of domains.

28. A system according to claim 14, further comprising the step of filtering said electronic mail message using an exclusion list, wherein, when the data from said electronic mail message matches data stored in said exclusion list, said electronic mail message is marked with said third display code and displayed to the user in said third display mode.

29. A system according to claim 14, wherein said inclusion list is created and updated based upon e-mail message data stored in the user'"'"'s real-time awareness and notification system.

30. A method for filtering electronic mail addressed to a user, comprising the steps of:

storing a user inclusion list including identification data for identifying e-mail desired by the user;

receiving an electronic mail message;

comparing data from said received electronic mail message with said identification data;

upon identifying a match between said electronic mail message data and said identification data, marking said electronic mail with a first display code;

displaying in a first display format said electronic mail message marked with the first display code to the user;

upon failing to detect a match between said electronic mail message data and said identification data, performing at least one heuristic process to determine whether said electronic mail message may be of interest to the user;

upon identifying an electronic mail message of interest to the user, marking said electronic mail with a second display code;

displaying said electronic mail message marked with said second display code to the user in a second display format; and

upon failing to identify an electronic mail message of interest to the user, marking the electronic mail message with a third display code such that said electronic mail message is not displayed to the user.

31. A method according to claim 30, wherein said at least one heuristic process includes at least one of the following tests:

(a) a test to determine whether a first field of said received electronic mail message matches a corresponding entry in said user inclusion list;

(b) a test to determine whether said first field of said received electronic mail message has a domain that matches an Internet domain of one or more entries in the corresponding category of said user inclusion list;

(c) a test to determine whether the first field of said received electronic mail message has a domain that matches one of a pre-defined list of domains;

or

(d) a test to determine whether a second field of said received electronic mail message matches a second entry in said user inclusion list.