Use of geo-location data for spam detection

• US 7,366,919 B1
• Filed: 04/25/2003
• Issued: 04/29/2008
• Est. Priority Date: 04/25/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: McCorkendale, Bruce, Sobel, William E
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Okoronkwo; Chinwendu C
• Application Number:
  US10/424,532
• Time in Patent Office: 1,831 Days
• Field of Search: 726/22, 726/24, 726/25, 713/150
• US Class Current: 726/23
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/222 using geographical location information, e.g. messages transmitted or received in proximity of a certain spot or area
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Computer implemented methods, apparati, and computer-readable media for detecting suspected spam in e-mail (24) originating from a sending computer (21). A method embodiment comprises the steps of determining (11) the actual IP address (23) of the sending computer (21); converting (12) the actual IP address (23) into geo-location data; and, using the geo-location data, ascertaining (13) whether the e-mail (24) contains suspected spam.

Claims

1. A computer implemented method for detecting suspected spam in e-mail originating from a sending computer, said method comprising the steps of:

determining an actual IP address of the sending computer;

converting the actual IP address into actual geo-location data; and

using the actual geo-location data, ascertaining whether the e-mail contains suspected spam.

2. The method of claim 1 further comprising, when the ascertaining step finds that the e-mail contains suspected spam, at least one of the following steps:

refusing the e-mail;

deleting the suspected spam from the e-mail;

processing the e-mail by a spam filter;

tagging the e-mail as containing suspected spam;

moving the e-mail to a special folder;

augmenting a composite spam score;

modifying the e-mail.

3. The method of claim 1 wherein the actual IP address is determined when the sending computer connects to a mail transfer agent.

4. The method of claim 3 wherein the actual IP address is gleaned from a transport layer using TCP.

5. The method of claim 1 wherein the actual IP address is determined from a return path header associated with the e-mail.

6. The method of claim 5 wherein:

the e-mail is received by a recipient computer;

there are a plurality of mail transfer agents situated between the sending computer and the recipient computer; and

the determining step comprises deriving the IP address from the return path header associated with the mail transfer agent that is closest to the sending computer, as long as said closest mail transfer agent, and each mail transfer agent situated between said closest mail transfer agent and said recipient computer, is trusted by the recipient computer.

7. The method of claim 6 wherein a mail transfer agent is trusted by the recipient computer when one of the following conditions is satisfied:

the mail transfer agent is co-located with the recipient computer in a common enterprise;

the mail transfer agent appears on a list of trusted computers that is kept by the recipient computer;

the recipient computer has never been spoofed by the mail transfer agent.

8. The method of claim 1 wherein:

the converting step is not able to provide geo-location data;

the sending computer'"'"'s claimed domain is not common; and

the ascertaining step does not deem that suspected spam is present in the e-mail.

9. The method of claim 1 wherein:

the converting step is not able to provide actual geo-location data;

the sending computer'"'"'s claimed domain is common; and

the ascertaining step deems that suspected spam is present in the e-mail.

10. The method of claim 1 wherein the actual geo-location data has a confidence number associated therewith;

and

the ascertaining step is performed only when the confidence number exceeds a pre-selected threshold.

11. The method of claim 1 wherein the ascertaining step comprises comparing the actual geo-location data with an access control list.

12. The method of claim 11 wherein the access control list is a whitelist.

13. The method of claim 11 wherein the access control list is a blacklist.

14. The method of claim 11 wherein the actual geo-location data is data pertaining to an entity from the group of entities comprising city, county, state, country, and presence within a preselected radius of a geographical point.

15. The method of claim 1 wherein the ascertaining step comprises comparing the actual geo-location data with a claimed geo-location claimed by the sending computer.

16. The method of claim 15 wherein the claimed geo-location is derived from domain information inserted by the sending computer as part of a HELO or EHLO command pursuant to a SMTP protocol.

17. The method of claim 15 wherein:

the e-mail is received by a recipient computer; and

the claimed geo-location is derived from a DNS address appearing in e-mail client software associated with the recipient computer.

18. The method of claim 15 wherein the claimed geo-location:

is derived from a DNS address claimed by the sending computer; and

is a location where a domain within the DNS address has a mail transfer agent.

19. The method of claim 18 wherein locations where the domain has a mail transfer agent are listed in a database from the group of databases comprising:

a database listing locations disclosed by an owner of the domain;

a database compiled by machine learning techniques;

a database compiled by noticing locations from which a large amount of e-mail has emanated.

20. The method of claim 19 wherein the database is compiled only with respect to e-mail allegedly emanating from common domains.

21. The method of claim 20 wherein a domain is deemed to be common during a training phase by virtue of being responsible for at least a certain preselected threshold percentage worth of total e-mail traffic observed during the training phase.

22. The method of claim 1 wherein at least one of the determining, converting, and ascertaining steps is performed by a client computer receiving the e-mail.

23. The method of claim 1 wherein at least one of the determining, converting, and ascertaining steps is performed by a mail transfer agent computer that processes the e-mail.

28. The method of claim 1 wherein the geo-location data comprises data identifying an actual geographical location of the sending computer.

24. A computer program product for detecting suspected spam in e-mail originating from a sending computer, comprising:

a computer-readable medium; and

computer program code, encoded on the computer-readable medium, for;

determining an actual IP address of the sending computer;

converting the actual IP address into actual geo-location data; and

using the actual geo-location data, ascertaining whether the e-mail contains suspected spam.

25. The computer program product of claim 24 wherein the ascertaining step comprises comparing the actual geo-location data with an access control list.

26. The computer program product of claim 24 wherein the ascertaining step comprises comparing the actual geo-location data with a claimed geo-location claimed by the sending computer.

27. An apparatus for detecting suspected spam in e-mail originating from a sending computer, said apparatus comprising:

means for determining an actual IP address of the sending computer;

coupled to the determining means, means for converting the actual IP address into actual geo-location data; and

coupled to the converting means, means for ascertaining, using the actual geo-location data, whether the e-mail contains suspected spam.