Method and apparatus for filtering e-mail

• US 6,654,787 B1
• Filed: 12/31/1998
• Issued: 11/25/2003
• Est. Priority Date: 12/31/1998
• Status: Expired

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Brightmail, Inc. (Gen Digital Inc.)
• Inventors: Khalsa, Kirpal Singh, Paul, Sunil, Pozar, Timothy Milan, Aronson, Daniel Alex
• Primary Examiner(s): Jaroenchonwanit, Bunjob
• Application Number:
  US09/224,378
• Time in Patent Office: 1,790 Days
• Field of Search: 709/206, 709/207, 709/217, 709/224, 707/3
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching

Abstract

A server is disclosed for filtering e-mail messages. The server receives requests to retrieve e-mail messages on behalf of a client and then retrieves e-mail messages from a mail server on behalf of the client. The server then filters the e-mail messages based on one or more rules and transfers the filtered e-mail messages to the client. In addition, the server continues to filter the e-mail messages after the client has disconnected from the server. In one embodiment of the invention the e-mail message recipient is sent a notification by the server indicating that messages have been filtered. The recipient is then able to scan the filtered messages and insure that the messages have been filtered correctly. In another embodiment, a third party scans the e-mail messages on behalf of the e-mail user to make this determination. Also disclosed is an e-mail filter comprising an application programming interface and a plurality of dynamically loaded rule modules adapted to interface with the API. The rule modules are activated and deactivated based on usage. Specifically, rule modules which have not been used for a predetermined period of time are deactivated. In addition, different rule modules are assigned different weighted values based on the probability that the rule module will accurately filter e-mail messages and/or on the content of the e-mail messages.

Claims

1. A server having a processor and a memory coupled to the processor, the memory having stored therein sequences of instructions which, when executed by the processor, cause the processor to perform the steps of:

creating at least one fictitious email probe email address selected to appear on spam email mailing lists and to receive sample spam email messages;

receiving a request to retrieve e-mail messages on behalf of a client;

retrieving one or more e-mail messages from a mail server on behalf of the client;

filtering the e-mail messages based on one or more rules to produce one or more filtered e-mail messages, the rules being dynamically established utilizing sample email messages retrieved from one or more probes and aged based on frequency of use; and

transferring one or more of the filtered e-mail messages to the client, while storing the e-mail messages not transferred to the client in a memory on the server.

2. The server as claimed in claim 1 including the initial step of receiving a user name and a password from the client and transmitting the user name and password to the mail server on behalf of the client.

3. The server as claimed in claim 1 wherein one or more of the filtered e-mail messages are transferred to the client before all of the e-mail messages stored on the mail server have been retrieved from the mail server.

4. The server as claimed in claim 1 wherein one or more of the filtered e-mail messages are transferred to the client before all of the e-mail messages have been filtered.

5. The server as claimed in claim 3 wherein the server continues to retrieve one or more e-mail messages from the mail server after the client has disconnected from the server.

6. The server as claimed in claim 4 wherein the server continues to filter one or more of the e-mail messages after the client has disconnected from the server.

7. The server as claimed in claim 1 wherein the e-mail messages are filtered based on information in the e-mail message header.

8. The server as claimed in claim 1 wherein the e-mail messages are filtered based on the address from which the e-mail messages originate.

9. The server as claimed in claim 1 wherein the e-mail messages are filtered based on keywords within the e-mail messages.

10. The server as claimed in claim 1 wherein the e-mail messages are filtered based on a mathematical signature of the e-mail messages.

11. The server as claimed in claim 1 wherein the e-mail messages are filtered based on whether the e-mail messages contains computer viruses.

12. The server as claimed in claim 1 wherein the e-mail messages are filtered based on an inclusion list.

13. The server as claimed in claim 1 wherein the filtering step is performed by a filter module comprised of an application programming interface (“

API”

) and one or more dynamically-linked rule modules.

14. The server as claimed in claim 1 wherein the server monitors how frequently each of the rules for filtering the e-mail messages are utilized.

15. The server as claimed in claim 14 wherein the rules for filtering the e-mail messages become inactive if not utilized for a predetermined period of time.

16. The server as claimed in claim 1 wherein the server performs the step of retrieving one or more e-mail messages from the mail server using the Post Office Protocol 3 (“

POP3”

).

17. The server as claimed in claim 1 wherein the server performs the step of retrieving one or more e-mail messages from the mail server using Interactive Mail Access Protocol (“

IMAP”

).

18. The server as claimed in claim 1 wherein the server performs the step of retrieving one or more e-mail messages from the mail server using Distributed Mail System Protocol (“

DMSP”

).

19. The server as claimed in claim 1 wherein the server communicates with the client using a different mail protocol it uses to communicate with the mail server.

20. A first server having a processor and a memory coupled to the processor, the memory having stored therein sequences of instructions which, when executed by the processor, cause the processor to perform the steps of:

creating at least one fictitious email probe email address selected to appear on spam email mailing lists and to receive sample spam email messages;

retrieving messages from a second server on behalf of a client;

sorting messages into two or more groups based on one or more rules, the rules being dynamically established utilizing sample email messages retrieved from one or more probes and aged based on frequency of use; and

forwarding messages sorted into one of the groups to the client, while storing the messages not forwarded to the client in a memory on the first server.

21. The first server as claimed in claim 20 wherein the stored messages are deleted after a predetermined period of time.

22. The first server as claimed in claim 20 including the initial step of receiving a user name and a password from the client and transmitting the user name and password to the second server on behalf of the client.

23. The first server as claimed in claim 20 wherein messages sorted into one of the groups are transferred to the client before all of the messages stored on the second server have been retrieved from the second server.

24. The first server as claimed in claim 20 wherein messages sorted into one of the groups are transferred to the client before all of the messages have been sorted.

25. The first server as claimed in claim 20 wherein the first server continues to retrieve one or more messages from the second server after the client has disconnected from the first server.

26. The first server as claimed in claim 20 wherein the first server continues to sort messages after the client has disconnected from the first server.

27. The first server as claimed in claim 20 wherein the rules are weighted.

28. The first server as claimed in claim 27 wherein the rules are weighted based on the likelihood that the means for filtering has accurately identified the e-mail message.

29. The first server as claimed in claim 28 wherein if more than one rule identifies the e-mail message as spam, the weights of the rules identifying the e-mail message as spam are added together to produce a cumulative weighted value.

30. The first server as claimed in claim 29 wherein the filter is set to filter e-mail messages based on a predetermined cumulative weighted value.

31. The first server as claimed in claim 20 wherein the messages stored in the memory of the first server are reviewed by message recipient to determine whether the messages have been grouped correctly.

32. The first server as claimed in claim 20 wherein the messages stored in the memory of the first server are reviewed by a third party to determine whether the messages have been grouped correctly.

33. An e-mail filter comprising:

an application programming interface (“

API”

);

a plurality of rule handling filter modules adapted to interface with the API, the plurality of rule handling filter modules adapted to filter e-mail messages based on one or more rules to produce one or more filtered e-mail messages, the filtered e-mail messages transferred to a client, the rules being dynamically established utilizing sample email messages retrieved from one or more probes and aged based on frequency of use, wherein one or more fictitious probes are created to appear on spam email mailing lists and to receive sample spam email messages; and

a storage module on a server to store e-mail messages not transferred to the client.

34. The e-mail filter as claimed in claim 33 wherein one of the plurality of rule handling filter modules filters e-mail messages based on a mathematical signature of the e-mail messages.

35. The e-mail filter as claimed in claim 34 wherein the mathematical signature is a checksum.

36. The e-mail filter as claimed in claim 33 wherein one of the plurality of rule handling filter modules filters e-mail messages based on one or more keywords within the e-mail messages.

37. The e-mail filter as claimed in claim 33 wherein one of the plurality of rule handling filter modules filters e-mail messages based on information within the e-mail message headers.

38. The e-mail filter as claimed in claim 33 wherein one of the plurality of rule handling filter modules filters e-mail messages based on the network address form which the e-mail messages originate.

39. The e-mail filter as claimed in claim 33 wherein the rule handling filter modules are weighted based on the likelihood that they will accurately filter the e-mail messages.

40. The e-mail filter as claimed in claim 39 wherein if more than one rule handling filter module identifies the email message as spam, the weights of the rule handling filter modules identifying the e-mail message as spam are added together to produce a cumulative weighted value.

41. The e-mail filter as claimed in claim 39 wherein the email filter is configured to filter e-mail messages based on a predetermined cumulative weighed value.

42. A server having a processor and a memory coupled to the processor, the memory having stored therein sequences of instructions which, when executed by the processor, cause the processor to perform the steps of:

creating at least one fictitious email probe email address selected to appear on spam email mailing lists and to receive sample spam email messages;

receiving a request to retrieve e-mail messages on behalf of a client;

retrieving one or more e-mail messages from a mail server on behalf of the client;

filtering the e-mail messages based on one or more rules to produce one or more filtered e-mail messages, the rules being dynamically established utilizing sample email messages retrieved from one or more probes and aged based on frequency of use; and

transferring one or more of the filtered e-mail messages to the client, while storing the e-mail messages not transferred to the client in a memory on the server.

43. The server as claimed in claim 42 including the initial step of receiving a user name and a password from the client and transmitting the user name and password to the mail server on behalf of the client.

44. The server as claimed in claim 42 wherein one or more of the filtered e-mail messages are transferred to the client before all of the e-mail messages stored on the mail server have been retrieved from the mail server.

45. The server as claimed in claim 42 wherein one or more of the filtered e-mail messages are transferred to the client before all of the e-mail messages have been filtered.

46. The server as claimed in claim 45 wherein the server continues to retrieve one or more e-mail messages from the mail server after the client has disconnected from the server.

47. The server as claimed in claim 46 wherein the server continues to filter one or more of the e-mail messages after the client has disconnected from the server.

48. The server as claimed in claim 42 wherein the e-mail messages are filtered based on information in the e-mail message header.

49. The server as claimed in claim 42 wherein the e-mail messages are filtered based on the address from which the e-mail messages originate.

50. The server as claimed in claim 42 wherein the e-mail messages are filtered based on keywords within the e-mail messages.

51. The server as claimed in claim 42 wherein the e-mail messages are filtered based on a mathematical signature of the e-mail messages.

52. The server as claimed in claim 42 wherein the e-mail messages are filtered based on whether the e-mail messages contains computer viruses.

53. The server as claimed in claim 42 wherein the e-mail messages are filtered based on an inclusion list.

54. The server as claimed in claim 42 wherein the filtering step is performed by a filter module comprised of an application programming interface (“

API”

) and one or more dynamically linked rule modules.

55. The server as claimed in claim 42 wherein the server monitors how frequently each of the rules for filtering the e-mail messages are utilized.

56. The server as claimed in claim 55 wherein the rules for filtering the e-mail messages become inactive if not utilized for predetermined period of time.

57. The server as claimed in claim 42 wherein the server performs the step of retrieving one or more e-mail messages from the mail server using the Post Office Protocol 3 (“

POP3”

).

58. The server as claimed in claim 42 wherein the server performs the step of retrieving one or more e-mail messages from the mail server using Interactive Mail Access Protocol (“

IMAP”

).

59. The server as claimed in claim 42 wherein the server performs the step of retrieving one or more e-mail messages from the mail server using Distributed Mail System Protocol (“

DMSP”

).

60. The server as claimed in claim 42 wherein the server communicates with the client using a different mail protocol it uses to communicate with the mail server.