System for reclassification of electronic messages in a spam filtering system

• US 7,693,945 B1
• Filed: 06/30/2004
• Issued: 04/06/2010
• Est. Priority Date: 06/30/2004
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Golub, Seth, Dulitz, Daniel Wesley
• Primary Examiner(s): Thomas; Joseph
• Assistant Examiner(s): FABBRI, ANTHONY E
• Application Number:
  US10/882,714
• Time in Patent Office: 2,106 Days
• Field of Search: 709/206, 709/207, 709/104.1, 709/224
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method for indicating probability of spam for email comprises tracking network traffic characteristics for the email, and comparing the tracked characteristics for the email to characteristics for email from trusted or known spam sources.

Claims

1. A computer implemented method for filtering emails on a server system having one or more processors and memory storing one or more programs for execution by the one or more processors, comprising:

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical communication activity data between the recipient and the sender, wherein the historical communication activity data includes information from an email application and one or more non-email applications, the one or more non-email applications including at least one of;

an instant messaging application, a file-sharing application, and a collaboration application;

wherein identifying the spam probability further comprises;

tracking network characteristics for the email, the tracked network characteristics including one or more of;

network traffic volume per unit of time and network traffic burstiness, and comparing tracked values of the tracked network characteristics for the email to known values for email from trusted or untrusted sources; and

classifying the email according the identified spam probability.

2. The computer implemented method of claim 1, wherein the identifying the spam probability comprises:

identifying the spam probability of the email based on historical communications activity data between a user recipient and the sender.

3. A computer implemented method for filtering emails on a server system having one or more processors and memory storing one or more programs for execution by the one or more processors, comprising:

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical communication activity data between the recipient and the sender, wherein the historical communication activity data includes information from an email application and one or more non-email applications, the one or more non-email applications including at least one of;

an instant messaging application, a file-sharing application, and a collaboration application;

wherein the identifying the spam probability further comprises;

identifying a spam probability of the email based at least in part on statistical information relating to previous interactions between a respective recipient and the sender, and where the information relating to previous interactions includes two or more of the following;

types of interaction, media of interaction, and frequency of interaction; and

classifying the email according the identified spam probability.

4. The computer implemented method of claim 3, wherein the historical communication activity data includes a plurality of conditions derived from data logged in an account history of the user, and

wherein the identifying the spam probability further comprises:

combining two or more conditions to provide a combined condition; and

identifying the spam probability of the email based at least in part on the combined condition.

5. The computer implemented method of claim 3, wherein the identifying the spam probability comprises:

identifying the spam probability of the email based on historical communication activity data between one or more non-user recipients and the sender.

6. A computer implemented method for filtering emails on a server system having one or more processors and memory storing one or more programs for execution by the one or more processors, comprising:

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical communication activity data between the recipient and the sender, wherein the historical communication activity data includes information from an email application and one or more non-email applications, the one or more non-email applications including at least one of;

an instant messaging application, a file-sharing application, and a collaboration application;

wherein the identifying the spam probability further comprises;

tracking network characteristics for the email, the tracked network characteristics including one or more of;

network traffic burstiness, network traffic volume per unit of time, number of recipients, number of purported senders, and mail recipient connection type; and

combining tracked values associated with more than one tracked network characteristic to provide a single combined tracked rating value; and

comparing the tracked values for the email to known values for email from trusted or untrusted sources; and

classifying the email according the identified spam probability.

7. A system for filtering emails, comprising:

at least one processor; and

memory storing at least one program for execution by the at least one processor;

the at least one program including instructions for;

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical communication activity data between the recipient and the sender, wherein the historical communication activity data includes information from an email application and one or more non-email applications, the one or more non-email applications including at least one of;

an instant messaging application, a file-sharing application, and a collaboration application;

wherein identifying the spam probability further comprises;

tracking network characteristics for the email, the tracked network characteristics include one or more of;

network traffic volume per unit of time and network traffic burstiness, and comparing tracked values of the tracked network characteristics for the email to known values for email from trusted or untrusted sources; and

classifying the email according the identified spam probability.

8. The system of claim 7, wherein the identifying the spam probability comprises:

identifying the spam probability of the email based on historical communications activity data between a user recipient and the sender.

9. A system for filtering emails, comprising:

at least one processor; and

memory storing at least one program for execution by the at least one processor;

the at least one program including instructions for;

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical communication activity data between the recipient and the sender, wherein the historical communication activity data includes information from an email application and one or more non-email applications, the one or more non-email applications including at least one of;

an instant messaging application, a file-sharing application, and a collaboration application;

wherein identifying the spam probability further comprises;

tracking network characteristics for the email, the tracked network characteristics include one or more of;

network traffic volume per unit of time and network traffic burstiness, and comparing tracked values of the tracked network characteristics for the email to known values for email from trusted or untrusted sources;

wherein the identifying the spam probability further comprises;

identifying a spam probability of the email based at least in part on statistical information relating to previous interactions between a respective recipient and the sender, and where the information relating to previous interactions includes two or more of the following;

types of interaction, media of interaction, and frequency of interaction; and

classifying the email according the identified spam probability.

10. The system of claim 9, wherein the historical communication activity data includes a plurality of conditions derived from data logged in an account history of the user, and

wherein the identifying the spam probability further comprises:

combining two or more conditions to provide a combined condition; and

identifying the spam probability of the email based at least in part on the combined condition.

11. The system of claim 9, wherein the identifying the spam probability comprises:

identifying the spam probability of the email based on historical communication activity data between one or more non-user recipients and the sender.

12. A system for filtering emails, comprising:

at least one processor; and

memory storing at least one program for execution by the at least one processor;

the at least one program including instructions for;

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical communication activity data between the recipient and the sender, wherein the historical communication activity data includes information from an email application and one or more non-email applications, the one or more non-email applications including at least one of;

an instant messaging application, a file-sharing application, and a collaboration application;

wherein identifying the spam probability further comprises;

tracking network characteristics for the email, the tracked network characteristics include one or more of;

network traffic volume per unit of time and network traffic burstiness, and comparing tracked values of the tracked network characteristics for the email to known values for email from trusted or untrusted sources;

wherein the identifying the spam probability further comprises;

tracking network characteristics for the email, the tracked network characteristics including one or more of;

network traffic burstiness, network traffic volume per unit of time, number of recipients, number of purported senders, and mail recipient connection type; and

combining tracked values associated with more than one tracked network characteristic to provide a single combined tracked rating value; and

comparing the tracked values for the email to known values for email from trusted or untrusted sources; and

classifying the email according the identified spam probability.

13. A computer readable storage medium storing one or more programs for execution by a computer, the one or more programs including instructions for:

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical communication activity data between the recipient and the sender, wherein the historical communication activity data includes information from an email application and one or more non-email applications, the one or more non-email applications including at least one of;

an instant messaging application, a file-sharing application, and a collaboration application;

wherein identifying the spam probability further comprises;

tracking network characteristics for the email, the tracked network characteristics including one or more of;

network traffic volume per unit of time and network traffic burstiness, and comparing tracked values of the tracked network characteristics for the email to known values for email from trusted or untrusted sources;

wherein the identifying the spam probability further comprises;

tracking network characteristics for the email, the tracked network characteristics including one or more of;

network traffic burstiness, network traffic volume per unit of time, number of recipients, number of purported senders, and mail recipient connection type; and

combining tracked values associated with more than one tracked network characteristic to provide a single combined tracked rating value; and

comparing the tracked values for the email to known values for email from trusted or untrusted sources; and

classifying the email according the identified spam probability.

14. A computer readable storage medium storing one or more programs for execution by a computer, the one or more programs including instructions for:

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical communication activity data between the recipient and the sender, wherein the historical communication activity data includes information from an email application and one or more non-email applications, the one or more non-email applications including at least one of;

an instant messaging application, a file-sharing application, and a collaboration application;

wherein identifying the spam probability further comprises;

tracking network characteristics for the email, the tracked network characteristics including one or more of;

network traffic volume per unit of time and network traffic burstiness, and comparing tracked values of the tracked network characteristics for the email to known values for email from trusted or untrusted sources; and

classifying the email according the identified spam probability.

15. The computer readable storage medium of claim 14, wherein the identifying the spam probability comprises:

identifying the spam probability of the email based on historical communications activity data between a user recipient and the sender.

16. A computer readable storage medium storing one or more programs for execution by a computer, the one or more programs including instructions for:

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical communication activity data between the recipient and the sender, wherein the historical communication activity data includes information from an email application and one or more non-email applications, the one or more non-email applications including at least one of;

an instant messaging application, a file-sharing application, and a collaboration application;

wherein identifying the spam probability further comprises;

tracking network characteristics for the email, the tracked network characteristics including one or more of;

network traffic volume per unit of time and network traffic burstiness, and comparing tracked values of the tracked network characteristics for the email to known values for email from trusted or untrusted sources;

wherein the identifying the spam probability further comprises;

identifying a spam probability of the email based at least in part on statistical information relating to previous interactions between a respective recipient and the sender, and where the information relating to previous interactions includes two or more of the following;

types of interaction, media of interaction, and frequency of interaction; and

classifying the email according the identified spam probability.

17. The computer readable storage medium of claim 16, wherein the historical communication activity data includes a plurality of conditions derived from data logged in an account history of the user, and

wherein the identifying the spam probability further comprises:

combining two or more conditions to provide a combined condition; and

identifying the spam probability of the email based at least in part on the combined condition.

18. The computer readable storage medium of claim 16, wherein the identifying the spam probability comprises:

identifying the spam probability of the email based on historical communication activity data between one or more non-user recipients and the sender.