Automatic spim detection

• US 7,856,090 B1
• Filed: 08/08/2005
• Issued: 12/21/2010
• Est. Priority Date: 08/08/2005
• Status: Expired due to Fees

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Satish, Sourabh
• Primary Examiner(s): Phan; Joseph T
• Application Number:
  US11/200,326
• Time in Patent Office: 1,961 Days
• Field of Search: 379/93.01, 709/206, 709/225
• US Class Current: 379/93.01
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A spim detection manager automatically detects and blocks spim. The spim detection manager detects a first incoming instant message from an unrecognized source, and sends a response to that source. The spim detection manager receives a second incoming instant message from the unrecognized source in reply to the sent response. The spim detection manager examines the second incoming instant message, and determines whether the incoming instant messages comprise spim based on its content. In some embodiments, the spim detection manager concludes that at least one of the incoming instant messages was generated by an automated process, and that therefore the incoming messages comprise spim. Where the spim detection manager determines that an incoming instant message comprises spim, it blocks that incoming message. Where the spim detection manager determines that an incoming instant message is legitimate, it forwards that message to the target user.

Claims

1. A computer implemented method for automatically detecting spim, the method comprising:

detecting an incoming instant message directed to a user from an unrecognized source;

logging the user out of a chat session to send a message to a sender of the incoming instant message indicating that the user is logged out;

logging the user into the chat session after the message indicating that the user is logged out is sent;

responsive to logging the user into the chat session, attempting to initiate an electronic conversation with the sender of the incoming instant message by sending a question to the sender; and

responsive to not receiving an appropriate reply to the attempt to initiate the electronic conversation concluding that the incoming instant message comprises spim.

2. The method of claim 1 further comprising:

determining that the incoming instant message comprises spim based on not receiving a reply to the attempt to initiate the electronic conversation.

3. The method of claim 1 further comprising:

receiving a second incoming instant message from the unrecognized source, the second incoming message being received as a reply to the attempt to initiate the electronic conversation;

examining the second incoming instant message; and

determining whether the incoming instant message comprises spim based on at least results of examining the second incoming instant message.

4. The method of claim 3 further comprising:

concluding that the second incoming instant message was generated by an automated process; and

responsive to concluding that the second incoming instant message was generated by an automated process, determining that the incoming instant message comprises spim.

5. The method of claim 1 further comprising:

receiving a reply to the attempt to initiate the electronic conversation;

concluding that the incoming instant message and the reply comprise spim;

storing the incoming instant message and reply as identified spim;

sending a response to the reply, and sending responses to additional received replies; and

storing the additional received replies as identified spim.

6. The method of claim 5 further comprising:

receiving an incoming message suspected to comprise spim;

determining that the incoming message suspected to comprise spim is sufficiently similar to stored identified spim; and

determining that the incoming message suspected to comprise spim comprises spim responsive to the determination of sufficient similarity.

7. The method of claim 1 further comprising:

determining whether the incoming instant message comprises spim based at least in part on whether a reply to the sent question comprises an appropriate answer to the question.

8. The method of claim 7 further comprising:

concluding that the incoming instant message comprises spim responsive to the reply to the sent question not comprising an appropriate answer to the question.

9. The method of claim 7 wherein determining whether the reply to the sent question comprises an appropriate answer to the question further comprises:

comparing the reply to the sent question to at least one appropriate answer to the question.

10. The method of claim 9 wherein comparing the reply to the sent question to at least one appropriate answer to the question further comprises:

taking into account common spelling and/or typographical errors.

11. The method of claim 7 further comprising:

periodically updating the question to be sent to incoming instant messages from unrecognized sources.

12. The method of claim 1 further comprising:

blocking the incoming instant message responsive to a conclusion that the incoming instant message comprises spim.

13. The method of claim 1 further comprising:

forwarding the incoming instant message to the user responsive to a conclusion that the incoming instant message does not comprise spim.

14. A computer readable storage medium containing executable computer program code for automatically detecting spim, the computer program code comprising:

program code for detecting an incoming instant message directed to a user from an unrecognized source;

program code for logging the user out of a chat session to send a message to the sender of the incoming instant message indicating that the user is logged out;

program code for logging the user into the chat session after the message indicating that the user is logged out is sent;

program code for attempting to initiate an electronic conversation with the sender of the incoming instant message by sending a question to the sender responsive to logging the user into the chat session; and

program code for determining whether the incoming instant message comprises spim based on whether an appropriate reply to the attempt to initiate the electronic conversation is received.

15. The computer readable medium of claim 14 further comprising:

program code for receiving a second incoming instant message from the unrecognized source, the second incoming instant message being received as a reply to the attempt to initiate the electronic conversation;

program code for examining the second incoming instant message; and

program code for determining whether the incoming instant message comprises spim based on at least results of examining the second incoming instant message.

16. The computer readable medium of claim 15 further comprising:

program code for concluding that the second incoming instant message was generated by an automated process; and

program code for, responsive to concluding that the second incoming instant message was generated by an automated process, determining that the incoming instant message comprises spim.

17. A computer system for automatically detecting spim, the computer system comprising:

a computer-readable storage medium comprising;

a software portion configured to detect an incoming instant message directed to a user from an unrecognized source;

a software portion configured to log the user out of a chat session to send a message to the sender of the incoming instant message indicating that the user is logged out;

a software portion configured to log the user into the chat session after the message indicating that the user is logged out is sent;

a software portion configured to attempt to initiate an electronic conversation with the sender of the incoming instant message by sending a question to the sender responsive to logging the user into the chat session; and

a software portion configured to, responsive to not receiving an appropriate reply to the attempt to initiate the electronic conversation, conclude that the incoming instant message comprises spim.

18. The computer system of claim 17 further comprising:

a software portion configured to receive a second incoming instant message from the unrecognized source, the second incoming instant message being received as a reply to the sent question;

a software portion configured to examine the second incoming instant message; and

a software portion configured to determine whether the incoming instant message comprises spim based on at least results of examining the second incoming instant message.