Automatic uniform resource locator-based message filter

• US 6,615,242 B1
• Filed: 12/28/1999
• Issued: 09/02/2003
• Est. Priority Date: 12/28/1998
• Status: Expired due to Term

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Riemers, Bill C.
• Primary Examiner(s): Geckil, Mehmet B.
• Application Number:
  US09/474,009
• Time in Patent Office: 1,344 Days
• Field of Search: 709/206, 709/225, 709/207, 709/229
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method for filtering messages to identify spam. A Uniform Resource Locator (URL) is identified in a message, and information is fetched from the site designated by the URL. The fetched information is analyzed to determine if the message that includes the URL is spam. If the message is spam, then a message filtering action is performed, such as deleting the message, displaying the message to the recipient with a flag, and sending the message to a third party.

Claims

1. A method for determining if an electronic message is spam including:

receiving a message;

identifying a URL included in the message;

fetching information corresponding to the identified URL; and

determining the likelihood that the message is spam based upon an analysis of the fetched information.

2. The method of claim 1, wherein the message is an electronic mail message.

3. The method of claim 1, wherein the message is a file.

4. The method of claim 1, wherein the Uniform Resource Locator corresponds to a web site.

5. The method of claim 1, wherein the Uniform Resource Locator corresponds to a file on a remote computer.

6. The method of claim 1, wherein the information corresponding to the Uniform Resource Locator is retrieved from a database at which the information has been previously stored.

7. The method of claim 1, wherein the information corresponding to the Uniform Resource Locator is retrieved from a remote computer whose location is designated by the Uniform Resource Locator.

8. The method of claim 1, wherein the information corresponding to the Uniform Resource Locator is analyzed by:

a. identifying a predetermined string that occurs in the information, wherein the predetermined string has a string score; and

b. calculating a Uniform Resource Locator score based at least partly on the string score of the predetermined string identified in the information.

9. The method of claim 8, wherein the Uniform Resource Locator score is proportionate to the maximum string score of identified predetermined strings in information from the site.

10. The method of claim 8, wherein the Uniform Resource Locator score is based upon the number of occurrences of a predetermined string in the site information.

11. The method of claim 8, wherein the Uniform Resource Locator score is proportionate to the average of the string scores of predetermined strings in the site information.

12. The method of claim 8, further including storing the Uniform Resource Locator score with the Uniform Resource Locator.

13. The method of claim 8, further including assigning a message score to the message, wherein the message score is based upon the Uniform Resource Locator score of a Uniform Resource Locator included in the message.

14. The method of claim 13, wherein the message score is proportionate to the maximum of the Uniform Resource Locator scores of Uniform Resource Locators identified in the message.

15. The method of claim 13, further including:

a. identifying a predetermined message string that occurs in the text of the message, wherein the predetermined message string has a message string score; and

b. calculating the message score based at least partly on a message string score.

16. The method of claim 15, wherein the message score is proportionate to the maximum of the message string scores of predetermined message strings identified in the message.

17. The method of claim of claim 1, further including performing a message filtering action based upon the results of determining the likelihood that the message is spam, wherein the message filtering action includes preventing the message from being delivered to its intended recipient.

18. The method of claim 1, further including performing a message filtering action based upon the results of determining the likelihood that the message is spam, wherein the message filtering action includes delivering the message to its intended recipient along with an indication that the message may be spam.

19. The method of claim 1, further including performing a message filtering action based upon the results of determining the likelihood that the message is spam, wherein the message filtering action includes delivering a copy of the message to a third party.

20. An apparatus for determining if an electronic message is spam, comprising:

a processor; and

a memory storing filtering instructions adapted to be executed by said processor to identify a URL in a message, fetch information corresponding to the URL, and automatically analyze the information to determine if the message in which the URL is included is likely to be spam, said memory coupled to said processor.

21. The apparatus of claim 20, wherein said filtering instructions are adapted to be executed by said processor to retrieve information corresponding to a Uniform Resource Locator from a remote computer through a network.

22. The apparatus of claim 20, wherein said filtering instructions are adapted to be executed by said processor to identify a predetermined string that occurs in the fetched information, wherein the predetermined string has a string score, and to calculate a Uniform Resource Locator score based at least partly on the string score of the predetermined string identified in the information.

23. The apparatus of claim 22, wherein said filtering instructions are adapted to be executed by said processor to store in said memory the Uniform Resource Locator score with the Uniform Resource Locator.

24. The apparatus of claim 22, wherein said filtering instructions are adapted to be executed by said processor to calculate a message score for the message, wherein the message score is based at least partly on the Uniform Resource Locator score of a Uniform Resource Locator included in the message.

25. The apparatus of claim 22, wherein said filtering instructions are adapted to be executed by said processor to identify a predetermined message string that occurs in the text of the message, wherein the predetermined message string has a message string score, and calculate a message score based at least partly on a message string score.

26. The apparatus of claim 25, wherein said filtering instructions are adapted to be executed by said processor to perform a message filtering action based upon the message score, wherein the message filtering action includes preventing a massage from being delivered to the intended recipient of the message.

27. The apparatus of claim 25, wherein said filtering instructions are apted to be executed by said processor to perform a message filtering action based upon the message score that includes delivering a message to the intended recipient of the message along with an indication that the message may include spam.

28. A medium storing instructions adapted to be executed by a processor to perform steps including:

receiving a message;

identifying a URL included in the message;

fetching information corresponding to the identified URL;

determining a message score based upon an analysis of the fetched information, wherein the message score relates the likelihood that the message is spam.

29. The medium of claim 28, wherein the message is an electronic mail message.

30. The medium of claim 28, wherein the message is a file.

31. The medium of claim 28, wherein the Uniform Resource Locator corresponds to a web site.

32. The medium of claim 28, wherein the Uniform Resource Locator corresponds to a file on a remote computer.

33. The medium of claim 28, wherein the information corresponding to the Uniform Resource Locator is retrieved from a database at which the information has been previously stored.

34. The medium of claim 28, wherein the information corresponding to the Uniform Resource Locator is analyzed by:

identifying a predetermined string that occurs in the information, wherein the predetermined string has a string score; and

calculating a Uniform Resource Locator score based at least partly on the string score of the predetermined string identified in the information.

35. The medium of claim 28, wherein the instructions are further adapted to be executed by the processor to store the Uniform Resource Locator score with the Uniform Resource Locator.

36. The medium of claim 28, wherein the message score is based upon the Uniform Resource Locator score of a Uniform Resource Locator included in the message.

37. The medium of claim 28, wherein the instructions are further adapted to be executed by a processor to perform a message filtering action based upon the results of determining the likelihood that the message is spam, wherein the message filtering action includes preventing the message from being delivered to its intended recipient.

38. The medium of claim 28, wherein the instructions are further adapted to be executed by the processor to perform a message filtering action based upon the results of determining the likelihood that the message is spam, wherein the message filtering action includes delivering the message to its intended recipient along with an indication that the message may be spam.

39. The medium of claim 28, wherein the instructions are further adapted to perform a message filtering action based upon the results of determining the likelihood that the message is spam, wherein the message filtering action includes delivering a copy of the message to a third party.

40. A system for determining if an electronic message is spam, comprising:

a. means for automatically identifying a URL included in a received message;

b. means for fetching information corresponding to the identified URL; and

c. means for determining if the message containing the URL is likely to be spam.

41. The system of claim 40, further comprising a database.

42. The system of claim 40, further comprising means for calculating a score for the message wherein the score relates the likelihood that the message is spam.

43. The system of claim 40, further comprising means for retrieving information that corresponds to a Uniform Resource Locator from a remote computer through a network.