Systems and methods for managing the transmission of electronic messages through active message date updating

• US 6,941,348 B2
• Filed: 02/19/2003
• Issued: 09/06/2005
• Est. Priority Date: 02/19/2002
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Postini, Inc. (Alphabet Inc.)
• Inventors: Cox, Fred, Akamine, Shinya, Petry, Scott M., Lund, Peter Kevin, Oswall, Michael John
• Primary Examiner(s): Thompson, Marc D.
• Application Number:
  US10/370,118
• Publication Number:
  US 20030158905A1
• Time in Patent Office: 930 Days
• Field of Search: 709/223, 709/224, 709/202, 709/206, 709/229, 707/102, 715/530, 715/531
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention provides an electronic message management system (EMS) that includes a real-time feedback loop where data is collected from the electronic messages on incoming connection attempts, outgoing delivery attempts, and message content analysis, and written to a centralized data matrix. A separate process accesses the data matrix and analyzes trends in that data. The detected data patterns, trends or behavior is based on configuration parameters for the recipient. Based on these determinations, the process is able to instruct components in the EMS to accept, redirect, refuse, modify, defer, or otherwise dispose of the connection request, the delivery attempt, or the message. Associated methods for managing the transmission of electronic messages are also disclosed.

Claims

1. A traffic monitor for use with a computer process managing the transmission of electronic messages from sending mail servers to receiving mail servers, wherein messages sent from the sending mail servers comprise source data associated with the sending mail servers and destination data associated with the receiving mail servers, comprising:

a data matrix for storing the source and destination data for a plurality of incoming electronic messages; and

an interface coupled to the matrix and configured to facilitate supplementing of the source and destination data with metadata provided by the computer process and based on the plurality of electronic messages, and to facilitate access to the source and destination data and the metadata for use in the managing of the transmission of the plurality of electronic messages.

2. The traffic monitor as recited in claim 1, wherein the interface is configured to facilitate access to the source and destination data and metadata for use in generating processing instructions for the managing of the transmission of the plurality of electronic messages.

3. The traffic monitor as recited in claim 2, wherein the processing instructions are disposition instructions for the plurality of incoming electronic messages.

4. The traffic monitor as recited in claim 3, wherein the disposition instructions are selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

5. The traffic monitor as recited in claim 1, wherein the interface is configured to facilitate supplementing of the source and destination data with metadata derived from the plurality of electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

6. The traffic monitor as recited in claim 1, wherein the metadata derived from the plurality of electronic messages is selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

7. The traffic monitor as recited in claim 1, wherein the data matrix comprises a data table mapping source data for the plurality electronic messages against destination data for the plurality of electronic messages.

8. A method for use with a computer process in managing the transmission of electronic messages from sending mail servers to receiving mail servers, wherein messages sent from the sending mail servers comprise source data associated with the sending mail servers and destination data associated with the receiving mail servers, comprising:

storing the source and destination data for a plurality of incoming electronic messages;

supplementing the source and destination data with metadata provided by the computer process and based on the plurality of electronic messages; and

managing the transmission of the plurality of electronic messages in the computer process based on the source and destination data and the metadata.

9. The method as recited in claim 8, wherein the managing of the transmission includes generating processing instructions based on the source and destination data and the metadata for use in the managing of the transmission of the plurality of electronic messages.

10. The method as recited in claim 9, wherein generating processing instructions includes generating disposition instructions for the plurality of electronic messages.

11. The method as recited in claim 10, wherein generating disposition instructions includes generating disposition instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

12. The method as recited in claim 8, wherein supplementing includes supplementing the source and destination data with metadata derived from the plurality of electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

13. The method as recited in claim 8, wherein supplementing further includes supplementing the source and destination data with metadata derived from the plurality of electronic messages selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

14. The method as recited in claim 8, wherein storing the source and destination data comprises mapping source data for the plurality of electronic messages against destination data for the plurality of electronic messages in a data table.

15. An electronic message management system for use in managing the transmission of electronic messages from sending mail servers to receiving mail servers, wherein messages sent from the sending mail servers comprise source data associated with the sending mail servers and destination data associated with the receiving mail servers, comprising:

a traffic monitor having a data matrix for storing the source and destination data for a plurality of incoming electronic messages, and an interface for facilitating access to the data matrix;

a message handling process coupled to the interface and configured to supplement the source and destination data with metadata derived from the plurality of electronic messages; and

an interpreter process coupled to the interface and configured to access the source and destination data and the metadata to generate processing instructions based thereon, the message handling process further configured to manage the transmission of the plurality of electronic messages based on the processing instructions.

16. The electronic message management system as recited in claim 15, wherein the processing instructions are disposition instructions for the plurality of electronic messages.

17. The electronic message management system as recited in claim 16, wherein the interpreter process is configured to generate disposition instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

18. The electronic message management system as recited in claim 15, wherein the message handling process includes a connection management module configured to extract the source and destination data, and to accept the plurality of electronic messages from the sending mail servers based on the processing instructions.

19. The electronic message management system as recited in claim 18, further including a connection management table coupled between the interpreter process and the connection management module, and configured to hold the processing instructions.

20. The electronic message management system as recited in claim 15, wherein the message handling process includes a delivery module configured to deliver the plurality of electronic messages to the receiving mail servers based on the processing instructions.

21. The electronic message management system as recited in claim 20, wherein the interpreter process is configured to generate processing instructions based on the source and destination data and the metadata in accordance with rules stored in a database.

22. The electronic message management system as recited in claim 21, further including an administrative access console coupled to the database and configured to establish the rules.

23. The electronic message management system as recited in claim 15, wherein the message handling process is configured to supplement the source and destination data with metadata derived using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

24. The electronic message management system as recited in claim 15, wherein the metadata derived from the plurality of electronic messages is selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

25. The electronic message management system as recited in claim 15, wherein the destination data includes original delivery addresses of the receiving mail servers, the message handling process further configured to intercept the plurality of electronic messages by associating a delivery address of the electronic message management system with the original delivery addresses.

26. The electronic message management system as recited in claim 15, wherein the data matrix comprises a data table mapping source data for the plurality of electronic messages against destination data for the plurality of electronic messages.

27. A method for managing the transmission of electronic messages from sending mail servers to receiving mail servers, wherein messages sent from the sending mail servers comprise source data associated with the sending mail servers and destination data associated with the receiving mail servers, comprising:

storing the source and destination data for a plurality of incoming electronic messages in a data matrix;

deriving metadata from the plurality of electronic messages;

supplementing the source and destination data with the metadata;

accessing the source and destination data and the metadata via an interface;

generating processing instructions based on the source and destination data and the metadata; and

managing the transmission of the plurality of electronic messages based on the processing instructions.

28. The method as recited in claim 27, wherein generating processing instructions includes generating disposition instructions for the plurality of electronic messages.

29. The method as recited in claim 28, wherein generating includes generating disposition instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

30. The method as recited in claim 27, wherein the managing of the transmission includes accepting the plurality of incoming electronic messages from the sending mail servers based on the source and destination data and the metadata.

31. The method as recited in claim 30, wherein generating processing instructions includes generating processing instructions in a connection management table, and the managing of the transmission includes managing of the transmission of the plurality of electronic messages based on the message processing instruction in the connection management table.

32. The method as recited in claim 27, wherein the managing of the transmission includes delivering the plurality of incoming electronic messages to the receiving mail servers based on the source and destination data and the metadata.

33. The method as recited in claim 27, wherein generating includes generating processing instructions based on the source and destination data and the metadata in accordance with rules stored in a database.

34. The method as recited in claim 33, wherein generating further includes generating processing instructions in accordance with rules established using an administrative access console coupled to the database.

35. The method as recited in claim 27, wherein deriving includes deriving the metadata from the plurality of electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

36. The method as recited in claim 27, wherein deriving includes deriving metadata selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

37. The method as recited in claim 27, wherein the destination data includes original delivery addresses of the receiving mail servers, the method further including intercepting the plurality of incoming electronic messages by associating a new delivery address with the original delivery addresses.

38. The method as recited in claim 27, wherein storing the source and destination data in a data matrix further comprises mapping source data for the plurality of electronic messages against destination data for the plurality of electronic messages in a data table.

39. An electronic message management system for use in managing the transmission of electronic messages from sending mail servers to receiving mail servers, comprising:

a connection management module configured to extract source data associated with the sending mail servers and destination data associated with the receiving mail servers from a plurality of incoming electronic messages;

a data matrix for storing the source and destination data; and

an interface coupled between the data matrix and the connection management module and configured to facilitate supplementing of the source and destination data with metadata derived from the plurality of incoming electronic messages, and to facilitate access to the source and destination data and the metadata, the connection management module further configured to manage the transmission of electronic messages by accepting any of the plurality of incoming electronic messages from the sending mail servers based on the source and destination data and the metadata.

40. The electronic message management system as recited in claim 39, further including a connection management table having processing instructions based on the source and destination data and the metadata, the connection management module configured to accept any of the plurality of incoming electronic messages based on the processing instructions.

41. The electronic message management system as recited in claim 40, wherein the processing instructions are disposition instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

42. The electronic message management system as recited in claim 40, wherein the processing instructions are generated in accordance with rules stored in a database.

43. The electronic message management system as recited in claim 42, further including an administrative access console coupled to the database and configured to establish the rules.

44. The electronic message management system as recited in claim 39, wherein the metadata is derived from the plurality of incoming messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

45. The electronic message management system as recited in claim 39, wherein the metadata derived from the plurality of incoming electronic messages is selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

46. The electronic message management system as recited in claim 39, wherein the destination data includes original delivery addresses of the receiving mail servers, the connection management module further configured to intercept the plurality of incoming electronic messages by associating a delivery address of the electronic message management system with the original delivery addresses.

47. The electronic message management system as recited in claim 39, wherein the data matrix comprises a data table mapping source data for the plurality of electronic messages against destination data for the plurality of electronic messages.

48. A method for managing the transmission of electronic messages from sending mail servers to receiving mail servers, comprising:

extracting source data associated with the sending mail servers and destination data associated with the receiving mail servers from a plurality of incoming electronic messages;

supplementing the source and destination data with metadata derived from the plurality of electronic messages; and

accepting any of the plurality of electronic messages from the sending mail servers based on the source and destination data and the metadata to manage the transmission of the electronic messages.

49. The method as recited in claim 48, wherein accepting includes accepting any of the plurality of incoming electronic messages based on processing instructions based on the source and destination data and the metadata.

50. The method as recited in claim 49, wherein the processing instructions are disposition instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

51. The method as recited in claim 49, wherein accepting further includes accepting any of the plurality of incoming electronic messages based on processing instructions generated in accordance with rules stored in a database.

52. The method as recited in claim 51, wherein accepting further includes accepting any of the plurality of incoming electronic messages based on processing instructions generated in accordance with rules stored in a database established using an administrative access console coupled to the database.

53. The method as recited in claim 48, wherein the supplementing includes supplementing the source and destination data with metadata derived from the plurality of electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

54. The method as recited in claim 48, wherein the supplementing includes supplementing the source and destination data with metadata derived from the plurality of electronic messages selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

55. The method as recited in claim 48, wherein the destination data includes original delivery addresses of the receiving mail servers, the method further including intercepting the plurality of incoming electronic messages by associating a new delivery address with the original delivery addresses.

56. The method as recited in claim 48, further comprising storing the extracted source and destination data in a data matrix, and supplementing the source and destination data in the data matrix with the metadata.

57. The method as recited in claim 56, wherein the data matrix comprises a data table mapping the source data against the destination data.

58. An electronic message management system for use in managing the transmission of electronic messages from sending mail servers to receiving mail servers, comprising:

a data matrix for storing source data associated with the sending mail servers and destination data associated with the receiving mail servers for a plurality of incoming electronic messages;

an interface coupled to the data matrix and configured to facilitate supplementing of the source and destination data with metadata derived from the plurality of electronic messages, and to facilitate access to the source and destination data and the metadata; and

a delivery management module coupled to the interface and configured to manage the transmission of electronic messages by delivering any of the plurality of incoming electronic messages to the receiving mail servers based on the source and destination data and the metadata.

59. The electronic message management system as recited in claim 58, wherein the delivery management module is configured to deliver any of the plurality of incoming electronic messages to the receiving mail servers based on processing instruction based on the source and destination data and the metadata.

60. The electronic message management system as recited in claim 59, wherein the delivery management module is configured to deliver any of the plurality of incoming electronic messages to a plurality of receiving mail servers based on loading capabilities of the plurality of receiving mail servers.

61. The electronic message management system as recited in claim 59, wherein the processing instructions are disposition instructions for the plurality of electronic messages.

62. The electronic message management system as recited in claim 61, wherein the disposition instructions are selected from the group consisting of:

message deliver;

message defer;

message reject; and

message redirect.

63. The electronic message management system as recited in claim 62, further including an administrative access console coupled to the database and configured to establish the rules.

64. The electronic message management system as recited in claim 58, wherein the processing instructions based on the source and destination data and the metadata are generated in accordance with rules stored in a database.

65. The electronic message management system as recited in claim 58, wherein the metadata is derived from the plurality of incoming electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

66. The electronic message management system as recited in claim 58, wherein the metadata derived is selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

67. The electronic message management system as recited in claim 58, wherein the data matrix comprises a data table mapping source data for the plurality of electronic messages against destination data for the plurality of electronic messages.

68. A method for managing the transmission of electronic messages from sending mail servers to receiving mail servers, comprising:

storing source data associated with the sending mail servers and destination data associated with the receiving mail servers from a plurality of incoming electronic messages;

supplementing the source and destination data with metadata derived from the plurality of electronic messages; and

delivering any of the plurality of electronic messages to the receiving mail servers based on the source and destination data and the metadata to manage the transmission of the electronic messages.

69. The method as recited in claim 68, wherein delivering includes delivering any of the plurality of incoming electronic messages to the receiving mail servers based on processing instructions based on the source and destination data and the metadata.

70. The method as recited in claim 69, wherein delivering includes delivering any of the plurality of incoming electronic messages to a plurality of receiving mail servers based on loading capabilities of the plurality of receiving mail servers.

71. The method as recited in claim 69, wherein the processing instructions are disposition instructions selected from the group consisting of:

message deliver;

message defer;

message reject; and

message redirect.

72. The method as recited in claim 69, wherein delivering further includes delivering any of the plurality of incoming electronic messages based on processing instructions generated in accordance with rules stored in a database.

73. The method as recited in claim 68, wherein delivering further includes delivering any of the plurality of incoming electronic messages based on processing instructions generated in accordance with rules stored in a database established using an administrative access console coupled to the database.

74. The method as recited in claim 68, wherein the supplementing includes supplementing the source and destination data with metadata derived from the plurality of electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

75. The method as recited in claim 68, wherein the supplementing includes supplementing the source and destination data with metadata derived from the plurality of electronic messages selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, black-holed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

76. The method as recited in claim 68, wherein the storing further comprises storing the source and destination data in a data matrix, and supplementing the source and destination data in the data matrix with the metadata.

77. The method as recited in claim 76, wherein the data matrix comprises a data table mapping the source data against the destination data.

78. A data structure associated with an electronic messaging network for transmitting a plurality of electronic messages comprising at least a sending mail server and a receiving mail server, the data structure comprising:

source data fields configured to contain source data extracted from the plurality of electronic messages, the source data containing at least data associated with the sending mail server;

destination data fields configured to contain destination data extracted from the plurality of electronic messages, the destination data containing at least data associated with the receiving mail server; and

processing fields configured to contain message-processing data for managing the transmission of the plurality of electronic messages, the message processing data based on the source and destination data and on metadata derived from the plurality of electronic messages.

79. The data structure as recited in claim 78, wherein the message processing data includes message disposition instructions for processing the plurality of electronic messages.

80. The data structure as recited in claim 79, wherein the disposition instructions are selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black bole.

81. The data structure as recited in claim 78, wherein the metadata is derived from the plurality of electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

82. The data structure as recited in claim 78, wherein the metadata derived from the plurality of electronic messages is select from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

count of messages from a domain;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, black-holed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

83. The data structure as recited in claim 78, wherein the message processing data based on the source and destination data and metadata is generated in accordance with rules stored in a database.

84. The data structure as recited in claim 83, wherein the rules are established using an administrative access console coupled to the database.

85. The data structure according to claim 78, wherein the source data fields and destination data fields comprise a data matrix.

86. A system for managing the transmission of incoming electronic messages from sending mail servers, wherein the electronic messages sent from the sending mail servers comprise source data associated with them, the system comprising:

a data structure for storing the source data for at least some of the electronic messages and metadata derived from the at least some of the electronic messages; and

a computer process coupled to the data structure and operable to manage the transmission of the electronic messages according to the information in the data structure.

87. A system according to claim 86, wherein the computer process is further operable to generate processing instructions for managing the transmission of the electronic messages.

88. A system according to claim 87, wherein the processing instructions are disposition instructions.

89. A system according to claim 88, wherein the disposition instructions are selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message redirect;

connection rejection; and

black hole.

90. A system according to claim 86, wherein the computer process is further operable to manage the transmission of the electronic messages by throttling at least one of the SMTP connections upon which the electronic messages arrive from the sending mail servers.

91. A system according to claim 86, wherein the computer process is further operable to manage the transmission of the electronic messages by deferring delivery of the at least one electronic message.

92. A system according to claim 86, wherein the data structure comprises a data table mapping source data for the electronic messages against destination data for the electronic messages.

93. A system according to claim 86, wherein the source data comprises source IP address data based on the sending mail servers.

94. A system according to claim 86, wherein the source data comprises domain data based on the sending mail servers.

95. A system according to claim 86, wherein the metadata derived is selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

count of messages from a domain;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content; and

count of messages from source IP address against which the disposition option was blocked, black-holed, spooled, or quarantined.

96. A method for managing the transmission of incoming electronic messages from sending mail servers, wherein electronic messages sent from the sending mail servers comprise source data associated with them, the method comprising:

storing the source data for at least some of the incoming electronic messages;

supplementing the source data with metadata derived from the at least some of the electronic messages; and

managing the transmission of the electronic messages based on the source data and the metadata.

97. A method according to claim 96, wherein managing the transmission comprises generating processing instructions for managing the transmission of the electronic messages.

98. A method according to claim 96, wherein the processing instructions are disposition instructions.

99. A method according to claim 98, wherein the disposition instructions are selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message redirect;

connection ejection; and

black hole.

100. A method according to claim 96, wherein managing the transmission of the electronic messages further comprises throttling at least one of the SMTP connections upon which the electronic messages arrive from the sending mail servers.

101. A method according to claim 96, wherein managing the transmission of the electronic messages further comprises deferring delivery of at least one electronic message.

102. A method according to claim 96, wherein storing the source data further comprises storing the source data in a data table mapped against destination data for the electronic messages.

103. A method according to claim 96, wherein the source data comprises source IP address data based on the sending mail servers.

104. A method according to claim 96, wherein the source data comprises domain data based on the sending mail servers.

105. A method according to claim 96, wherein the metadata derived is selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

count of messages from a domain;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address;

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content; and

count of messages from source IP address against which the disposition option was blocked, black-holed, spooled, or quarantined.