Increasing spam scanning accuracy by rescanning with updated detection rules

• US 7,865,561 B2
• Filed: 04/01/2008
• Issued: 01/04/2011
• Est. Priority Date: 04/01/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Roberts, Guy, Kelly, Nick
• Primary Examiner(s): Walsh; John B.
• Application Number:
  US12/078,515
• Publication Number:
  US 20090248814A1
• Time in Patent Office: 1,008 Days
• Field of Search: None
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method, system, and computer program product for processing email messages rescans emails messages that have already been scanned for spam and delivered to user inboxes with updated spam detection rules. This increases the accuracy of spam scanning and reduces the need for users to submit missed spam in emails that was not detected at the time the emails were received, but would subsequently be detected with newer anti-spam rules. A method of processing email messages comprises receiving email messages in a local inbox or in an inbox on an email server, or both, the received email messages having been scanned using spam detection rules to determine whether or not they include spam, obtaining updated spam detection rules, and rescanning at least some of the received email messages using the updated spam detection rules to determine whether or not they include spam.

Claims

1. A method of processing email messages, comprising:

receiving email messages in a local inbox or in an inbox on an email server, or both, the received email messages having been scanned using spam detection rules to determine whether or not they include spam;

obtaining updated spam detection rules, utilizing a processor; and

rescanning at least some of the received email messages using the updated spam detection rules to determine whether or not they include spam;

wherein each email message includes information indicating a version of spam detection rules that were used by the email server to scan the email and the rescanning is performed by rescanning only email messages that were scanned using a version of spam detection rules that is older than the updated spam detection rules, based on the information.

2. The method of claim 1, wherein the received email messages were scanned by the email server.

3. The method of claim 2, wherein the rescanning is performed by a user computer system.

4. The method of claim 3, wherein the messages that are rescanned are in a local inbox on the user computer system.

5. The method of claim 3, wherein the messages that are rescanned are in an inbox on the email server.

6. The method of claim 1, wherein the updated spam detection rules are obtained from the email server, from an update server, or via a peer-to-peer connection.

7. The method of claim 1, wherein the updated spam detection rules are obtained from the email server after spam detection rules used by the email server are updated.

8. The method of claim 7, wherein the updated spam detection rules are the updated spam detection rules of the email server.

9. The method of claim 6, wherein a plug-in downloads the updated spam detection rules.

10. The method of claim 3, wherein unread messages in a local inbox on the user computer system are rescanned.

11. A system for processing email messages comprising:

a processor operable to execute computer program instructions;

a memory operable to store computer program instructions executable by the processor; and

computer program instructions stored in the memory and executable to perform the steps of;

receiving email messages in a local inbox or in an inbox on an email server, or both, the received email messages having been scanned using spam detection rules to determine whether or not they include spam;

obtaining updated spam detection rules; and

rescanning at least some of the received email messages using the updated spam detection rules to determine whether or not they include spam;

wherein each email message includes information indicating a version of spam detection rules that were used by the email server to scan the email and the rescanning is performed by rescanning only email messages that were scanned using a version of spam detection rules that is older than the updated spam detection rules, based on the information.

12. The system of claim 11, wherein the received email messages were scanned by the email server.

13. The system of claim 12, wherein the rescanning is performed by a user computer system.

14. The system of claim 13, wherein the messages that are rescanned are in a local inbox on the user computer system.

15. The system of claim 13, wherein the messages that are rescanned are in an inbox on the email server.

16. The system of claim 11, wherein the updated spam detection rules are obtained from the email server after spam detection rules used by the email server are updated.

17. The system of claim 16, wherein the updated spam detection rules are the updated spam detection rules of the email server.

18. The system of claim 11, wherein the updated spam detection rules are obtained from the email server, from an update server, or via a peer-to-peer connection.

19. A computer program product for processing incoming email messages comprising:

a computer readable storage medium;

computer program instructions, recorded on the computer readable storage medium, executable by a processor, for performing the steps of;

receiving email messages in a local inbox or in an inbox on an email server, or both, the received email messages having been scanned using spam detection rules to determine whether or not they include spam;

obtaining updated spam detection rules; and

rescanning at least some of the received email messages using the updated spam detection rules to determine whether or not they include spam;

wherein each email message includes information indicating a version of spam detection rules that were used by the email server to scan the email and the rescanning is performed by rescanning only email messages that were scanned using a version of spam detection rules that is older than the updated spam detection rules, based on the information.

20. The computer program product of claim 19, wherein the received email messages were scanned by the email server.

21. The computer program product of claim 20, wherein the rescanning is performed by a user computer system.

22. The computer program product of claim 21, wherein the messages that are rescanned are in a local inbox on the user computer system.

23. The computer program product of claim 21, wherein the messages that are rescanned are in an inbox on the email server.

24. The computer program product of claim 19, wherein the updated spam detection rules are obtained from the email server, from an update server, or via a peer-to-peer connection.

25. The computer program product of claim 19, wherein the updated spam detection rules are obtained from the email server after spam detection rules used by the email server are updated.

26. The computer program product of claim 25, wherein the updated spam detection rules are the updated spam detection rules of the email server.