Framework to enable integration of anti-spam technologies
First Claim
1. A method of determining if a message is spam in a system having a plurality of anti-spam modules comprising the steps of:
- a) invoking one of the plurality of anti-spam modules;
b) receiving a spam confidence level from the one of the plurality of anti-spam modules;
c) applying a tuning factor to the spam confidence level to create a tuned spam confidence level;
d) adding the tuned spam confidence level to a summed spam confidence level;
e) comparing the summed spam confidence level to at least one threshold;
f) if the summed spam confidence level is greater than the at least one threshold, invoking an action associated with the at least one threshold; and
g) repeating steps a–
f if the summed spam confidence level is less than the at least one threshold,wherein the action includes one of the following;
dropping a connection if the summed spam confidence level exceeds a first threshold level of the at least one threshold, returning a non-delivery message to a sender if the summed spam confidence level exceeds a second threshold level of the at least one threshold and is below the first threshold level, and delivering the message to a junk mail folder if the message exceeds a third threshold level of the at least one threshold and is below the second threshold level.
2 Assignments
0 Petitions
Accused Products
Abstract
A method that enables multiple spam detection solutions to be deployed in a manageable and rational manner to determine if a message is spam is presented. A framework invokes one or more anti-spam filters to analyze the message and return a confidence level of whether a message is spam and that confidence level is added to a summary of confidence levels. The framework evaluates a summary of confidence levels against a set of defined thresholds. If the summary of confidence levels is greater than the highest threshold set by the administrator, the action specified for the highest threshold is taken. Otherwise, subsequent filters are used to evaluate the message until either the maximum threshold is exceeded or all filters have evaluated the message. After all filters have evaluated the message, the summary of confidence levels is compared against all thresholds and the action associated with that matching threshold is taken.
88 Citations
28 Claims
-
1. A method of determining if a message is spam in a system having a plurality of anti-spam modules comprising the steps of:
-
a) invoking one of the plurality of anti-spam modules; b) receiving a spam confidence level from the one of the plurality of anti-spam modules; c) applying a tuning factor to the spam confidence level to create a tuned spam confidence level; d) adding the tuned spam confidence level to a summed spam confidence level; e) comparing the summed spam confidence level to at least one threshold; f) if the summed spam confidence level is greater than the at least one threshold, invoking an action associated with the at least one threshold; and g) repeating steps a–
f if the summed spam confidence level is less than the at least one threshold,wherein the action includes one of the following;
dropping a connection if the summed spam confidence level exceeds a first threshold level of the at least one threshold, returning a non-delivery message to a sender if the summed spam confidence level exceeds a second threshold level of the at least one threshold and is below the first threshold level, and delivering the message to a junk mail folder if the message exceeds a third threshold level of the at least one threshold and is below the second threshold level. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A method of integrating spam confidence levels of a plurality of anti-spam modules comprising the steps of:
-
invoking at least one of the plurality of anti-spam modules to process a message; receiving a spam confidence level of the message from the at least one of the plurality of anti-spam modules; applying a tuning factor to the spam confidence level to create a tuned spam confidence level; adding the tuned spam confidence level to a summed spam confidence level; comparing the summed spam confidence level to at least one threshold; and if the summed spam confidence level is greater than the at least one threshold, invoking an action associated with the at least one threshold, wherein the action includes one of the following;
dropping a connection if the summed spam confidence level exceeds a first threshold level of the at least one threshold, returning a non-delivery message to a sender if the summed spam confidence level exceeds a second threshold level of the at least one threshold and is below the first threshold level, and delivering the message to a junk mail folder if the message exceeds a third threshold level of the at least one threshold and is below the second threshold level, and wherein steps described above are repeated until either the summed spam confidence level is greater than the threshold or all of the anti-spam modules have been invoked. - View Dependent Claims (12, 13, 14, 15, 16, 17)
-
-
18. A tangible computer-readable medium having computer executable instructions for determining if a message is spam in a system having a plurality of anti-spam modules, the instructions comprising the steps of:
-
a) invoking at least one of the plurality of anti-spam modules; b) receiving a spam confidence level of the message from the at least one of the plurality of anti-spam modules; c) applying a scaling factor to the spam confidence level to create a normalized spam confidence level; d) adding the normalized spam confidence level to a summed spam confidence level; e) comparing the summed spam confidence level to at least one threshold; f) if the summed spam confidence level is greater than the at least one threshold, invoking an action associated with the at least one threshold, wherein the action includes one of the following;
dropping a connection if the summed spam confidence level exceeds a first threshold level, returning a non-delivery message to a sender if the summed spam confidence level exceeds a second threshold level and is below the first threshold level, and delivering the message to a junk mail folder if the message exceeds a third threshold level and is below the second threshold level; andg) repeating steps a–
f if the summed spam confidence level is less than the at least one threshold until one of the summed spam confidence level is greater than the at least one threshold and the plurality of anti-spam modules have been invoked. - View Dependent Claims (19, 20, 21, 22, 23, 24, 25, 26, 27, 28)
-
Specification