Apparatus and method for weighted and aging spam filtering rules

• US 7,882,193 B1
• Filed: 04/04/2002
• Issued: 02/01/2011
• Est. Priority Date: 12/31/1998
• Status: Expired due to Fees

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Khalsa, Kirpal Singh, Paul, Sunil, Medlar, Art, Pozar, Timothy Milan, Aronson, Daniel Alex
• Primary Examiner(s): Donaghue; Larry
• Assistant Examiner(s): Tang; Karen C
• Application Number:
  US10/117,065
• Time in Patent Office: 3,225 Days
• Field of Search: 709206-207, 709/217, 709/224, 709/202, 709/232, 709/238, 707/3, 707/10, 713/201
• US Class Current: 709/207
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching

Abstract

A server is disclosed for filtering e-mail messages. The server receives requests to retrieve e-mail messages on behalf of a client and then retrieves e-mail messages from a mail server on behalf of the client. The server then filters the e-mail messages based on one or more rules and transfers the filtered e-mail messages to the client. In addition, the server continues to filter the e-mail messages after the client has disconnected from the server. In one embodiment of the invention the e-mail message recipient is sent a notification by the server indicating that messages have been filtered. The recipient is then able to scan the filtered messages and insure that the messages have been filtered correctly. In another embodiment, a third party scans the e-mail messages on behalf of the e-mail user to make this determination. Also disclosed is an e-mail filter comprising an application programming interface and a plurality of dynamically loaded rule modules adapted to interface with the API. The rule modules are activated and deactivated based on usage. Specifically, rule modules which have not been used for a predetermined period of time are deactivated. In addition, different rule modules are assigned different weighted values based on the probability that the rule module will accurately filter e-mail messages and/or on the content of the e-mail messages.

Claims

1. A method for filtering e-mail messages comprising:

a computer system maintaining a set of filtering rules having one or more weight values associated therewith, wherein each of said filtering rules is configured to identify e-mail message characteristics indicative of spam; and

the computer system dynamically changing said set of filtering rules, including adding rules based upon spam e-mail messages addressed to one or more probe e-mail addresses, wherein the probe e-mail addresses are e-mail addresses created to receive spam e-mail messages, and further including aging a filtering rule from the set of filtering rules based on a weight value, the weight value reflecting a frequency of usage of the filtering rule within a designated time interval.

2. The method of claim 1 wherein aging the filtering rule comprises assigning an inactive status to the filtering rule.

3. The method of claim 1 wherein the weight value reflects the frequency of usage of the filtering rule across a network over which the e-mail messages are received.

4. The method of claim 1 wherein the weight value reflects the frequency of usage of the filtering rule at a specific network node of a network over which the e-mail messages are received.

5. An apparatus for filtering e-mail messages comprising:

a data storeconfigured to maintain a set of filtering rules having one or more weight values associated therewith, each of said filtering rules configured to identify e-mail message characteristics indicative of spam;

a processor; and

a memory storing program instructions executable by the processor to implement;

a filter module configured to dynamically change said set of filtering rules, including adding rules based upon spam e-mail messages addressed to one or more probe e-mail addresses, wherein the probe e-mail addresses are e-mail addresses created to receive spam e-mail messages, and further including aging a filtering rule from the set of filtering rules based on a weight value, the weight value reflecting a frequency of usage of the filtering rule within a designated time interval;

a filter module configured to age a filtering rule from the set of filtering rules based on a weight value, the weight value reflecting a frequency of usage of the filtering rule within a designated time interval;

6. The apparatus of claim 5 wherein aging the filtering rule comprises assigning an inactive status to the filtering rule.

7. The apparatus of claim 5 wherein the weight value reflects the frequency of usage of the filtering rule across a network over which the e-mail messages are received.

8. The apparatus of claim 5 wherein the weight value reflects the frequency of usage of the filtering rule at a specific network node of a network over which the e-mail messages are received.

9. An apparatus for filtering e-mail messages comprising:

first hardware means for maintaining a set of filtering rules having one or more weight values associated therewith, wherein each of said filtering rules is configured to identify e-mail message characteristics indicative of spam; and

second hardware means for dynamically changing said set of filtering rules, including adding rules based upon spam e-mail messages addressed to one or more probe e-mail addresses, wherein the probe e-mail addresses are e-mail addresses created to receive spam e-mail messages, and further including aging a filtering rule from the set of filtering rules based on a weight value, the weight value reflecting a frequency of usage of the filtering rule within a designated time interval.

10. The apparatus of claim 9 wherein the second hardware means for aging comprise means for assigning an inactive status to the filtering rule.

11. The apparatus of claim 9 wherein the weight value reflects the frequency of usage of the filtering rule across a network over which the e-mail messages are received.

12. The apparatus of claim 9 wherein the weight value reflects the frequency of usage of the filtering rule at a specific network node of a network over which the e-mail messages are received.

13. A method comprising:

a computer system receiving e-mail messages addressed to a client;

the computer system filtering the e-mail messages based on one or more rules to produce one or more filtered e-mail messages, the rules being dynamically established utilizing sample e-mail messages retrieved from one or more probes and aged based on frequency of use, the one or more probes representing fictitious e-mail addresses created to appear on spam e-mail mailing lists and to receive sample spam e-mail messages; and

the computer system providing the client with the filtered e-mail messages.

14. The method of claim 13 wherein the e-mail messages are filtered based on information in the e-mail message header.

15. The method of claim 13 wherein the e-mail messages are filtered based on the address from which the e-mail messages originate.

16. The method of claim 13 wherein the e-mail messages are filtered based on keywords within the e-mail messages.

17. The method of claim 13 wherein the e-mail messages are filtered based on a mathematical signature of the e-mail messages.

18. The method of claim 13 wherein the e-mail messages are filtered based on whether the e-mail messages contains computer viruses.

19. The method of claim 13 wherein the e-mail messages are filtered based on an inclusion list.

20. The method of claim 13 wherein filtering is performed by a filter module comprised of an application programming interface (“

API”

) and one or more dynamically linked rule modules.

21. A method comprising:

a proxy server receiving, from a mail server, e-mail messages addressed to a client;

the proxy server filtering spam e-mail messages from received the e-mail messages based on one or more rules to produce one or more filtered e-mail messages, the rules being dynamically established utilizing sample spam e-mail messages and aged based on frequency of use of the rules; and

the proxy server providing the filtered e-mail messages to the client.

22. The method of claim 21 wherein the e-mail messages are filtered based on information in e-mail message headers.

23. The method of claim 21 wherein the e-mail messages are filtered based on the address from which the e-mail messages originate.

24. The method of claim 21 wherein the e-mail messages are filtered based on keywords within the e-mail messages.

25. The method of claim 21 wherein the e-mail messages are filtered based on a mathematical signature of the e-mail messages.

26. The method of claim 21 wherein the e-mail messages are filtered based on whether the e-mail messages contains computer viruses.

27. The method of claim 21 wherein the e-mail messages are filtered based on an inclusion list.

28. The method of claim 21 wherein said filtering is performed by a filter module comprised of an application programming interface (“

API”

) and one or more dynamically linked rule modules.

29. The method of claim 21 wherein the sample spam e-mail messages are received by at least one fictitious probe e-mail address selected to appear on spam e-mailing lists.

30. A machine-readable memory medium containing instructions which, when executed by a processing system, cause the processing system to perform a method, the method comprising:

receiving e-mail messages addressed to a client;

filtering the e-mail messages based on one or more rules to produce one or more filtered e-mail messages, the rules being dynamically established utilizing sample e-mail messages retrieved from one or more probes and aged based on frequency of use, the one or more probes representing fictitious e-mail addresses designed to appear on spam e-mail mailing lists and to receive sample spam e-mail messages; and

providing the client with the filtered e-mail messages.

31. The machine-readable memory medium of claim 30, wherein the e-mail messages are filtered based on keywords within the e-mail messages.

32. The machine-readable memory medium of claim 30, wherein filtering is performed using an application programming interface (“

API”

) and one or more dynamically linked rule modules.

33. A first computer system, comprising:

a processor;

a memory storing program instructions executable by the processor to;

maintain a set of filtering rules for e-mail messages, each of the set of filtering rules having one or more weight values associated therewith, and wherein each of the set of filtering rules is configured to identify e-mail message characteristics indicative of spam; and

dynamically change the set of filtering rules, including adding rules based upon spam e-mail messages addressed to one or more probe e-mail addresses, the probe e-mail addresses comprising e-mail addresses designed to receive the spam e-mail messages, and further including aging a filtering rule from the set of filtering rules based on a corresponding weight value, the weight value reflecting a frequency of usage of the filtering rule within a designated time interval.

34. The first computer system of claim 33, wherein the program instructions are executable by the processor to age a first filtering rule by assigning it an inactive status.

35. The first computer system of claim 33, wherein the corresponding weight value for a first filtering rule reflects the frequency of usage of the first filtering rule across a network over which the e-mail messages are received.

36. The first computer system of claim 33, wherein the corresponding weight value for a first filtering rule reflects the frequency of usage of the first filtering rule at a specific network node of a network over which the e-mail messages are received.

37. The first computer system of claim 33, wherein the program instructions are further executable by the processor to apply the maintained set of filtering rules to a received set of e-mail messages, and to provide the unfiltered e-mail messages to a second computer system.

38. The first computer system of claim 37, wherein the first computer system is a proxy server.

39. A first computer system, comprising:

a processor;

a memory storing program instructions executable by the processor to;

receive e-mail messages addressed to a client, wherein the e-mail messages are received from a mail server;

filter spam e-mail messages from the received e-mail messages based on one or more rules to produce one or more filtered e-mail messages, the rules being dynamically established utilizing sample spam e-mail messages and aged based on frequency of use of the rules; and

provide the filtered e-mail messages to the client;

wherein the first computer system is a proxy server.

40. The first computer system of claim 39, wherein the e-mail messages are filtered based on information in e-mail message headers.

41. The first computer system of claim 39, wherein the e-mail messages are filtered based on addresses from which the e-mail messages originate.

42. The first computer system of claim 39, wherein the e-mail messages are filtered based on keywords within the e-mail messages.

43. The first computer system of claim 39, wherein the e-mail messages are filtered based on mathematical signatures of the e-mail messages.

44. The first computer system of claim 39, wherein the e-mail messages are filtered based on whether the e-mail messages contain computer viruses.

45. The first computer system of claim 39, wherein the e-mail messages are filtered based on an inclusion list.

46. The first computer system of claim 39, wherein the e-mail messages are filtered using an application programming interface (“

API”

) and one or more dynamically linked rule modules.

47. The first computer system of claim 39, wherein the sample spam e-mail messages are received by at least one fictitious probe e-mail address created to appear on spam e-mailing lists, and wherein the one or more rules are applied to a given received e-mail message based on an order determined by weights associated with the rules.

48. The first computer system of claim 47, wherein the e-mail messages are filtered using an application programming interface (“

API”

) and one or more dynamically linked rule modules.

49. One or more computer-readable memory media storing program instructions executable by a first computer system to:

maintain a set of filtering rules for e-mail messages, each of the set of filtering rules having one or more weight values associated therewith, and wherein each of the set of filtering rules is configured to identify e-mail message characteristics indicative of spam; and

dynamically change the set of filtering rules, including adding rules based upon spam e-mail messages addressed to one or more probe e-mail addresses, wherein the probe e-mail addresses are e-mail addresses created to receive the spam e-mail messages, and further including aging a filtering rule from the set of filtering rules based on a corresponding weight value, the weight value reflecting a frequency of usage of the filtering rule within a designated time interval.

50. The computer-readable memory media of claim 49, wherein the program instructions are executable to age a first filtering rule by assigning it an inactive status.

51. The computer-readable memory media of claim 49, wherein the corresponding weight value for a first filtering rule reflects the frequency of usage of the first filtering rule across a network over which the e-mail messages are received.

52. The computer-readable memory media of claim 49, wherein the corresponding weight value for a first filtering rule reflects the frequency of usage of the first filtering rule at a specific network node of a network over which the e-mail messages are received.

53. The computer-readable memory media of claim 49, wherein the program instructions are executable to apply the maintained set of filtering rules to a received set of e-mail messages, and to provide the unfiltered e-mail messages to a second computer system.