Countering spam through address comparison

• US 7,975,010 B1
• Filed: 03/23/2005
• Issued: 07/05/2011
• Est. Priority Date: 03/23/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Satish, Sourabh
• Primary Examiner(s): Divecha; Kamal B
• Assistant Examiner(s): Daftuar; Saket K
• Application Number:
  US11/088,348
• Time in Patent Office: 2,295 Days
• Field of Search: 709205-207, 726/11, 726/13, 726/22, 726/26, 707/10, 707/104.1, 707/999.01, 707/999.107
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

Computer implemented methods, apparati, and computer readable media for determining whether an electronic message (30) is likely to contain spam. A method embodiment of the present invention comprises the steps of comparing (11) addresses associated with the electronic message (30) with addresses in an address book (21) of a recipient (20) of the electronic message (30); counting (12) instances for which an address associated with the electronic message (30) matches an address in the address book (21); and determining (13) whether spam is likely present in the electronic message (30) by calculating whether a pre-selected condition (70) is satisfied, said pre-selected condition (70) being based upon a count of said matches and at least one predetermined threshold (80).

Claims

1. A computer-implemented method for determining whether an electronic message sent by a sender to a message recipient and to other recipients contains spam, the electronic message received on a recipient computer, said method comprising the steps of:

comparing electronic message addresses of the other recipients listed in a TO field and a CC field of the electronic message with electronic message addresses stored in an address book of the message recipient, wherein the recipient computer consists of a client computer or a server computer coupled to a plurality of client computers, and wherein the recipient computer has access to the address book;

counting instances for which each of the electronic message addresses of the other recipients listed in the TO field and the CC field of the electronic message matches an electronic message address stored in the address book;

calculating whether at least three of the following conditions are satisfied;

     1) xTO/nADR>

A,

     2) xCC/nADR>

B,

     3) xTO/nTO>

C, and

     4) xCC/nCC>

D, where A, B, C, and D are thresholds that are pre-selected numbers, wherein each of the pre-selected numbers is a percentage, and where nADR is a total number of addresses in the address book, where xTO is a number of addresses in the address book that are also contained in the TO field of the electronic message, where xCC is a number of addresses in the address book that are also contained in the CC field of the electronic message, where nTO is a total number of addresses in the TO field, and where nCC is a total number of addresses in the CC field, wherein the xTO and xCC are obtained or calculated based on said counting;

responsive to at least three of the conditions

     1),

     2),

     3), and

     4) being satisfied, determining that the electronic message is non-spam, wherein, prior to the comparing step, a spam filter determined that the electronic message is spam, and wherein the comparing, counting, calculating, and determining steps are a check on whether the spam filter made a false positive identification of spam and wherein the comparing, the counting, the calculating and the determining are performed by the client computer or the server computer coupled to a plurality of client computers.

2. The method of claim 1 wherein attributes from the electronic message are fed back to the spam filter to train the spam filter regarding attributes of non-spam electronic messages for future use in spam detection.

3. The method of claim 2 wherein the attributes comprise at least one of:

contents of the electronic message;

at least one address from the TO field associated with the electronic message; and

at least one address from the CC field associated with the electronic message.

4. The method of claim 1 wherein the determination is verified by the message recipient opening the electronic message and determining whether or not the message contains spam.

5. The method of claim 4 wherein, when the conclusion of the message recipient opening the message is that spam is contained within the electronic message, at least one of the thresholds of the conditions is adjusted based on this false negative for tightening criteria associated with a determination that no spam is present.

6. The method of claim 1, wherein the electronic message is determined to be non-spam only in response to all of the conditions 1), 2), 3), and 4) being satisfied.

7. At least one non-transitory computer-readable storage medium encoding computer program instructions executable on a processor for determining whether an electronic message sent by a sender to a message recipient and to other recipients contains spam, the electronic message received on a recipient computer, said computer program instructions performing the steps of:

comparing electronic message addresses of the other recipients listed in a TO field and a CC field of the electronic message with electronic message addresses stored in an address book of the message recipient, wherein the recipient computer consists of a client computer or a server computer coupled to a plurality of client computers, and wherein the recipient computer has access to the address book;

counting instances for which each of the electronic message addresses of the other recipients listed in the TO field and the CC field of the electronic message matches an electronic message address stored in the address book;

calculating whether at least three of the following conditions are satisfied;

     1) xTO/nADR>

A,

     2) xCC/nADR>

B,

     3) xTO/nTO>

C, and

     4) xCC/nCC>

D, where A, B, C, and D are thresholds that are pre-selected numbers, wherein each of the pre-selected numbers is a percentage, and where nADR is a total number of addresses in the address book, where xTO is a number of addresses in the address book that are also contained in the TO field of the electronic message, where xCC is a number of addresses in the address book that are also contained in the CC field of the electronic message, where nTO is a total number of addresses in the TO field, and where nCC is a total number of addresses in the CC field, wherein the xTO and xCC are obtained or calculated based on said counting;

responsive to at least three of the conditions

     1),

     2),

     3), and

     4) being satisfied, determining that the electronic message is non-spam, wherein, prior to the comparing step, a spam filter determined that the electronic message is spam, and wherein the comparing, counting, calculating, and determining steps are a check on whether the spam filter made a false positive identification of spam.

8. The at least one non-transitory computer-readable storage medium of claim 7 wherein attributes from the electronic message are fed back to the spam filter to train the spam filter regarding attributes of non-spam electronic messages for future use in spam detection.

9. The at least one non-transitory computer-readable storage medium of claim 8 wherein the attributes comprise at least one of:

contents of the electronic message;

at least one address from the TO field associated with the electronic message; and

at least one address from the CC field associated with the electronic message.

10. The at least one non-transitory computer-readable storage medium of claim 7 wherein the determination is verified by the message recipient opening the electronic message and determining whether or not the message contains spam.

11. The at least one non-transitory computer-readable storage medium of claim 10 wherein, when the conclusion of the message recipient opening the message is that spam is contained within the electronic message, at least one of the thresholds of the conditions is adjusted based on this false negative for tightening criteria associated with a determination that no spam is present.

12. The at least one computer-readable storage medium of claim 7, wherein the electronic message is determined to be non-spam only in response to all of the conditions 1), 2), 3), and 4) being satisfied.

13. A computer system for determining whether an electronic message that has been sent by a sender to a message recipient and to other recipients contains spam, the electronic message received on a recipient computer, said computer system comprising:

a non-transitory computer-readable storage medium storing executable software modules, comprising;

a comparison module associated with the recipient computer adapted to compare electronic message addresses of the other recipients listed in a TO field and a CC field of the electronic message with electronic message addresses stored in an address book of the message recipient, wherein the recipient computer consists of a client computer or a server computer coupled to a plurality of client computers, and wherein the recipient computer has access to the address book;

coupled to the comparison module, a counting module adapted to count instances for which each of the electronic message addresses of the other recipients listed in the TO field and the CC field of the electronic message matches an electronic message address stored in the address book;

coupled to the counting module, a determining module adapted to;

calculate whether at least three of the following conditions are satisfied;

     1) xTO/nADR>

A,

     2) xCC/nADR>

B,

     3) xTO/nTO>

C, and

     4) xCC/nCC>

D, where A, B, C, and D are thresholds that are pre-selected numbers, wherein each of the pre-selected numbers is a percentage, and where nADR is a total number of addresses in the address book, where xTO is a number of addresses in the address book that are also contained in the TO field of the electronic message, where xCC is a number of addresses in the address book that are also contained in the CC field of the electronic message, where nTO is a total number of addresses in the TO field, and where nCC is a total number of addresses in the CC field, wherein the xTO and xCC are obtained or calculated based on said counting; and

responsive to at least three of the conditions

     1),

     2),

     3), and

     4) being satisfied, determining that the electronic message is non-spam, wherein, prior to the comparing step, a spam filter determined that the electronic message is spam, and wherein the comparing, counting, calculating, and determining steps are a check on whether the spam filter made a false positive identification of spam; and

a processor configured to execute the software modules stored by the non-transitory computer-readable storage medium.

14. The system of claim 13, wherein the electronic message is determined to be non-spam only in response to all of the conditions 1), 2), 3), and 4) being satisfied.

15. The system of claim 13, further comprising a post-determination module, coupled to the determining module, the post-determination module adapted to feed attributes of the electronic message back to the spam filter to train the spam filter for future use.