Method and apparatus to block spam based on spam reports from a community of users

• US 7,373,385 B2
• Filed: 11/03/2003
• Issued: 05/13/2008
• Est. Priority Date: 11/03/2003
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Cloudmark Incorporated (Proofpoint Incorporated)
• Inventors: Prakash, Vipul Ved
• Primary Examiner(s): Jacobs; LaShonda T
• Application Number:
  US10/700,911
• Publication Number:
  US 20050114452A1
• Time in Patent Office: 1,653 Days
• Field of Search: 709/206, 709/207, 709/203, 709/217, 709/223, 709/224
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

In one embodiment, a method for operating a server is provided. The method comprises receiving a plurality of reports from a community of users, each report identifying an email message as spam or not spam; and determining if the email message is spam based on a number of the reports received from the community of users, and a trust factor associated with each user.

Claims

1. A method, comprising:

a community of users generating a plurality of reports, said generating comprising, for each of the plurality of reports,

generating at least one signature based on a content of an email message,

adding the at least one signature to a respective report; and

identifying the email message as spam or not spam in the respective report;

receiving the plurality of reports from the community of users; and

determining if the email message is spam based on a number of the reports received from the community of users, and a trust factor associated with each user.

2. The method of claim 1, further comprising maintaining a database of email messages determined as being spam.

3. The method of claim 2, further comprising providing notifications to the community of users of email messages stored in the database and determined as being spam.

4. The method of claim 2, further comprising:

using the at least one signature as a key to store the email message in the database if the email message is determined to be spam.

5. The server of claim 2, wherein the method further comprises:

using the at least one signature as a key to store the email message in the database if the email message is determined to be spam.

6. The method of claim 3, wherein each notification is in response to a request received from a user in the community for an indication on whether an identified message is spam.

7. The method of claim 1, wherein the trust factor is based on an indication of how accurately previous reports sent by the user identified email messages as spam.

8. The method of claim 1, wherein the at least one signature comprises a hash calculated based on the content of the email message.

9. A server, comprising:

a processor; and

a memory coupled to the processor, the memory storing instructions which when executed by the processor cause the processor to perform a method, comprising;

generating a plurality of reports in response to requests from a community of users, said generating comprising, for each of the plurality of reports,

generating at least one signature based on a content of an email message,

adding the at least one signature to a respective report; and

identifying the email message as spam or not spam in the respective report;

receiving the plurality of reports from the community of users; and

determining if the email message is spam based on a number of the reports received from the community of users, and a trust factor associated with each user.

10. The server of claim 9, wherein the method further comprises maintaining a database of email messages determined as being spam.

11. The server of claim 10, wherein the method further comprises providing notifications to the community of users of email messages stored in the database and determined as being spam.

12. The server of claim 11, wherein each notification is in response to a request received from a user in the community for an indication on whether an identified message is spam.

13. The server of claim 9, wherein the trust factor is based on an indication of how accurately previous reports sent by the sender identified email messages as spam.

14. The server of claim 9, wherein the at least one signature comprises a hash calculated based on the content of the email message.

15. A recordable-type medium having stored thereon a sequence of instructions which when executed by a computer, cause the computer to perform a method comprising:

generating a plurality of reports in response to requests from a community of users, said generating comprising, for each of the plurality of reports,

generating at least one signature based on a content of an email message,

adding the at least one signature to a respective report; and

identifying the email message as spam or not spam in the respective report;

receiving the plurality of reports from the community of users; and

determining if the email message is spam based on a number of the reports received from the community of users, and a trust factor associated with each user.

16. The recordable-type medium of claim 15, wherein the method further comprises maintaining a database of email messages determined as being spam.

17. The recordable-type medium of claim 16, wherein the method further comprises providing notifications to the community of users of email messages stored in the database and determined as being spam.

18. The recordable-type medium of claim 16, wherein the method further comprises:

using the at least one signature as a key to store the email message in the database if the email message is determined to be spam.

19. The recordable-type medium of claim 17, wherein each notification is in response to a request received from a user in the community for an indication on whether an identified message is spam.

20. The recordable-type medium of claim 16, wherein the trust factor is based on an indication of how accurately previous reports sent by the sender identified email messages as spam.

21. The recordable-type medium of claim 15, wherein the at least one signature comprises a hash calculated based on the content of the email message.