Blocking of spam e-mail at a firewall

• US 7,617,526 B2
• Filed: 10/06/2005
• Issued: 11/10/2009
• Est. Priority Date: 05/20/2003
• Status: Expired due to Fees

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Davis, John Fred, Jeremiah, Garreth Joseph, Jeffries, Clark Debs, Himberger, Kevin David
• Primary Examiner(s): Arani; Taghi T
• Assistant Examiner(s): LEE, JASON T
• Application Number:
  US11/244,993
• Publication Number:
  US 20060037070A1
• Time in Patent Office: 1,496 Days
• Field of Search: 726/2, 726/3, 726/4, 726/11, 726/21, 726 22- 25, 726/26, 709/206, 709/203, 707/500, 707/104.1, 713/201, 713/178, 715/752
• US Class Current: 726/11
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 69/28 Timers or timing mechanisms used in protocols

Abstract

A method of blocking spam at a firewall involves applying blocking measures for an adaptively determined duration. The blocking measure is then suspended while determining whether the spam has ended. If so, the method resets to an initial state. Otherwise, the blocking measure is re-applied for a second duration.

Claims

1. A method of blocking spam at a firewall, comprising the steps of:

receiving a spam e-mail message in a time interval during which no blocking measure is active;

applying a blocking measure for a duration that is determined adaptively; and

suspending the blocking measure in accordance with a state B(t) of the blocking measure at time t for discrete values of t which are integer multiples of a time interval Dt, said discrete values of t representing t=0, Dt, 2*Dt, . . . , J*Dt, wherein J is a positive integer equal to or greater than 2;

wherein if B(t)=I then the blocking measure is applied and if B(t)=0 then the blocking measure is suspended;

wherein A(t)=I if a spam e-mail message has arrived during a time interval Dt immediately preceding time t and A(t)=0 otherwise;

wherein N(t)=A(t)*(I−

B(t));

wherein S(t) is a time stamp indicating the absolute start time of a most recent sequence of time values with consecutive application of the blocking measure;

wherein K(t) is a count of the number of times, within a present epoch of consecutive detections of spam e-mail message, that the blocking measure has been suspended and then re-applied in response to detection of a spam e-mail message;

wherein P(t) is a duration of the blocking measure and is a non-decreasing function of K(t);

wherein a specified positive integer L is a maximum permitted value of K(t);

wherein t=0 is a time prior to execution of a loop of J iterations denoted as iterations 1, 2, . . . , J;

wherein at t=0, B(0)=I, A(0)=I, S(0)=0, K(0)=0, and P(0)=P.sub.0=I*Dt, wherein I is a positive integer;

wherein B(t), S(t), and K(t) are iteratively computed during execution of the loop such that in each iteration;

B(t+Dt)=N(t)*(I−

B(t))+(I−

N(t)*(I−

B(t))) *if (t+Dt−

S(t)i, else

     0),

S(t+Dt)=B(t+Dt)*(I−

B(t))*(t+Dt−

S(t)+S(t),

K(t+DT)=min{L,N(t)*(K(t)+I)+(I−

N(t))*B(t)*K(t)},

t=t+DT after B(t+Dt), S(t+Dt), and K(t+Dt) have been determined.

2. The method of claim 1, wherein said determining detects identical text bodies in said e-mail message with a plurality of other e-mail messages.

3. The method of claim 2, further comprising using a hash function to determine said identical text bodies.

4. The method of claim 1, further comprising the step of providing a database to integrate said identical bodies and declare filter rules for said determining.

5. The method of claim 4, further comprising the step of dynamically adding and deleting said filter rules to a database of filter rules to be enforced.

6. The method of claim 1, wherein said duration is determined adaptively in response to a count of a number of times that the blocking measure has been applied.

7. The method of claim 6, wherein said duration is adapted according to a monotone non-decreasing function of said count.

8. The method of claim 1, wherein said duration is a count of e-mail messages.

9. The method of claim 1, further comprising the step of selecting a level of certainty of said determining by selecting an appropriately corresponding length of an initial period of rules enforcement.