Method and system for detecting abusive email based on number of hops

• US 7,689,659 B1
• Filed: 08/16/2004
• Issued: 03/30/2010
• Est. Priority Date: 04/12/2004
• Status: Expired due to Fees

• Current Assignee: Unwired Planet LLC (JP Morgan Chase & Co)
• Original Assignee: Openwave Systems Incorporated (JP Morgan Chase & Co)
• Inventors: Granoff, Mark H., Silberman, Samuel G., Brown, Jr., Bruce L.
• Primary Examiner(s): Walsh, John B.
• Application Number:
  US10/919,655
• Time in Patent Office: 2,052 Days
• Field of Search: None
• US Class Current: 709/207
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A classifier is implemented to determine the number of message transfer agents (MTAs) through which an email message has traveled. If the number of MTAs through which the email message has traveled is below a predetermined threshold and the email message is not otherwise authenticated, the classifier will designate the email message as abusive.

Claims

1. A system for detecting an abusive email message, the system comprising a processor and a memory, the memory storing instructions that, when executed by the processor, cause the system to perform a method, the method comprising:

determining the number of message transfer agents through which an email message has traveled; and

designating the email message as abusive if a predetermined set of conditions is satisfied, the predetermined set of conditions including that the number of message transfer agents through which the email message has traveled is less than a predetermined number of message transfer agents.

2. A system as recited in claim 1, wherein the set of conditions further includes that the email message has not otherwise been authenticated.

3. A system as recited in claim 2, wherein said otherwise authenticated comprises authenticated by having a previous message authentication.

4. A system as recited in claim 2, wherein said otherwise authenticated comprises authenticated by having a previous session authentication.

5. A system as recited in claim 1, wherein the method further comprises:

indicating in the email message the number of message transfer agents through which the email message has traveled.

6. A system as recited in claim 1, wherein said determining comprises obtaining the number of predefined headers that the email message has, each said predefined header having been inserted by a message transfer agent as a result of the email message traveling through the message transfer agent.

7. A system as recited in claim 6, wherein at least one of the predefined headers is inserted to record the event of the message transfer agent'"'"'s receiving of the email message.

8. A machine-readable program storage medium storing instructions which, when executed in a processing system, cause the processing system to perform a method, the method comprising:

determining the number of message transfer agents through which an email message has traveled; and

designating the email message as abusive if a predetermined set of conditions is satisfied, the predetermined set of conditions including that the number of message transfer agents through which the email message has traveled is less than a predetermined number of message transfer agents.

9. A machine-readable program storage medium as recited in claim 8, wherein the set of conditions further includes that the email message has not otherwise been authenticated.

10. A machine-readable program storage medium as recited in claim 9, wherein said otherwise authenticated comprises authenticated by having a previous message authentication.

11. A machine-readable program storage medium as recited in claim 9, wherein said otherwise authenticated comprises authenticated by having a previous session authentication.

12. A machine-readable program storage medium as recited in claim 8, wherein said method further comprises indicating in the email message the number of message transfer agents through which the email message has traveled.

13. A machine-readable program storage medium as recited in claim 8, wherein said determining comprises obtaining the number of predefined headers that the email message has, each said predefined header having been inserted by a message transfer agent as a result of the email message traveling through the message transfer agent.

14. A machine-readable program storage medium as recited in claim 13, wherein at least one of the predefined headers is inserted to record the event of the message transfer agent'"'"'s receiving of the email message.

15. A system for detecting an abusive email message, the system comprising a processor and a memory, the memory storing instructions that, when executed by the processor, cause the system to perform a method, the method comprising:

determining the number of message transfer agents through which an email message has traveled;

using the number of message transfer agents through which the email message has traveled and a plurality of other factors that each contribute a weighted score to calculate a final abuse score; and

comparing the final abuse score with a predetermined threshold and designating said email message as abusive if the final abuse score has a specified relationship to the predetermined threshold.

16. A system as recited in claim 15, wherein said determining comprises obtaining the number of predefined headers that the email message has, each said predefined header having been inserted by a message transfer agent as a result of the email message traveling through the message transfer agent.

17. A system as recited in claim 16, wherein at least one of the predefined headers is inserted to record the event of the message transfer agent'"'"'s receiving of the email message.

18. A machine-readable program storage medium storing instructions which, when executed in a processing system, cause the processing system to perform a method, the method comprising:

determining the number of message transfer agents through which an email message has traveled;

using the number of message transfer agents through which the email message has traveled and a plurality of other factors that each contribute a weighted score to calculate a final abuse score; and

comparing the final abuse score with a predetermined threshold and designating said email message as abusive if the final abuse score has a specified relationship to the predetermined threshold.

19. A machine-readable program storage medium as recited in claim 18, wherein said determining comprises obtaining the number of predefined headers that the email message has, each said predefined header having been inserted by a message transfer agent as a result of the email message traveling through the message transfer agent.

20. A machine-readable program storage medium as recited in claim 19, wherein at least one of the predefined headers is inserted to record the event of the message transfer agent'"'"'s receiving of the email message.

21. A system for detecting an abusive email message, the system comprising a processor and a memory, the memory storing instructions that, when executed by the processor, cause the system to perform a method, the method comprising:

determining the number of message transfer agents through which an email message has traveled; and

marking the email message as possibly abusive for further consideration if the number of message transfer agents through which the email message has traveled is less than a predetermined number of message transfer agents.

22. A system as recited in claim 21, wherein said determining comprises obtaining the number of predefined headers that the email message has, each said predefined header having been inserted by a message transfer agent as a result of the email message traveling through the message transfer agent.

23. A system as recited in claim 22, wherein at least one of the predefined headers is inserted to record the event of the message transfer agent'"'"'s receiving of the email message.

24. A system as recited in claim 21, wherein marking comprises adding a header to said email message indicating the number of message transfer agents through which the email message has traveled.

25. A machine-readable program storage medium storing instructions which, when executed in a processing system, cause the processing system to perform a method, the method comprising:

determining the number of message transfer agents through which an email message has traveled; and

marking the email message as possibly abusive for further consideration if the number of message transfer agents through which the email message has traveled is less than a predetermined number of message transfer agents.

26. A machine-readable program storage medium as recited in claim 25, wherein said determining comprises obtaining the number of predefined headers that the email message has, each said predefined header having been inserted by a message transfer agent as a result of the email message traveling through the message transfer agent.

27. A machine-readable program storage medium as recited in claim 26, wherein at least one of the predefined headers is inserted to record the event of the message transfer agent'"'"'s receiving of the email message.

28. A machine-readable program storage medium as recited in claim 25, wherein marking comprises adding a header to said email message indicating the number of message transfer agents through which the email message has traveled.