Method and apparatus for certifying mass emailings

• US 8,135,778 B1
• Filed: 04/27/2005
• Issued: 03/13/2012
• Est. Priority Date: 04/27/2005
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Cowings, David, Jensen, Sanford, Chin, Ren
• Primary Examiner(s): Biagini, Christopher
• Application Number:
  US11/116,572
• Time in Patent Office: 2,512 Days
• Field of Search: 709/206
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A method and system for creating bulk filters are described. In one embodiment, the method includes receiving probe email messages indicative of spam, grouping similar probe email messages, and creating a bulk filter for each group having at least a predefined number of probe email messages without human interaction. The method further includes distributing the resulting bulk filters to clients for detection of bulk email messages at the clients.

Claims

1. A method comprising:

a control center creating, without human interaction, bulk filters for groups of a plurality of received email messages, the control center comprising a computer system;

the control center receiving a request from a mass mailer to perform a certified mass mailing, wherein the request includes a sample email message of the mass mailer, the mass mailer comprising a computer system;

in response to receiving the request, the control center generating a key to be associated with the certified mass mailing and sending the key to the mass mailer;

the control center distributing the created bulk filters, the sample email message, and the key to a plurality of mail servers;

wherein the bulk filters are usable by a given one of the plurality of mail servers to determine whether messages received at the given mail server are bulk email messages; and

wherein the given mail server is configured to identify a bulk email message as being part of the certified mass mailing by;

comparing the bulk email message with one or more samples of certified mass mailings to determine whether a match is found between the bulk email message and the sample email message, wherein the one or more samples include the sample email message;

in response to finding the match, determining whether the bulk email message includes the key associated with the certified mass mailing; and

identifying the bulk email message as being part of the certified mass mailing in response to the bulk email message including the key associated with the certified mass mailing.

2. The method of claim 1, wherein the plurality of received email messages are collected using a plurality of fictitious probe email addresses selected to appear on spam email mailing lists, wherein one of the fictitious probe email addresses includes an expired domain name.

3. The method of claim 1, further comprising:

the control center creating spam filters for groups of received probe email messages;

the control center distributing the created spam filters to a plurality of mail servers for detection of spam email messages at the plurality of mail servers; and

the control center maintaining separate statistics that indicate reliability of the created bulk and spam filters.

4. The method of claim 3, wherein the maintained statistics are received from the plurality of mail servers, and wherein the method further comprises:

limiting a number of false positive submissions of a mail server over a predetermined time period.

5. The method of claim 1, further comprising:

aging a bulk filter that identifies legitimate email messages as bulk.

6. The method of claim 1, wherein the plurality of email messages are collected using a plurality of fictitious probe email addresses, and wherein the method further comprises:

removing, from a list of the plurality of fictitious probe email addresses, email addresses providing legitimate data.

7. The method of claim 1, wherein the plurality of email messages are collected using a plurality of fictitious probe email addresses, and wherein the method further comprises:

assigning scores to the plurality of fictitious probe email addresses based on an amount of received spam or an amount of received legitimate mail.

8. The method of claim 1, further comprising:

encoding the bulk filters to prevent the bulk filters from being intercepted during transmission to a mail server.

9. The method of claim 1, wherein the given mail server is configured to:

deliver to a recipient at least a subset of the bulk email messages.

10. The method of claim 1, wherein the certified mass mailing is a news digest.

11. A method comprising:

a computer system receiving a request from a mass mailer to perform a certified mass mailing, wherein the request includes a sample email message of the mass mailer, the mass mailer comprising a second computer system;

in response to receiving the request, the computer system distributing the sample email message and a key to be associated with the certified mass mailing to a plurality of other computer systems; and

wherein each of the plurality of other computer systems is configured to identify a bulk email message as being part of the certified mass mailing by;

comparing the bulk email message and the sample email message to determine whether a match is found;

in response to finding the match, determining whether the bulk email message includes the key associated with the certified mass mailing; and

identifying the bulk email message as being part of the certified mass mailing in response to the bulk email message including the key associated with the certified mass mailing.

12. The method of claim 11, further comprising:

after receiving the request, the computer system generating the key to be associated with the certified mass mailing.

13. A computer mail system comprising:

a processor; and

a memory storing program instructions executable to;

receive a request from a mass mailer to perform a certified mass mailing, wherein the request includes a sample email message of the mass mailer, the mass mailer comprising a computer system;

in response to receiving the request, generate a key to be associated with the certified mass mailing and send the key to the mass mailer; and

distribute the sample email message and the key to a plurality of mail servers, wherein each mail server is configured to;

compare a bulk email message with the sample email message;

in response to finding that the bulk email message and the sample email message match, determine whether the bulk email message includes the key associated with the certified mass mailing; and

identify the bulk email message as being part of the certified mass mailing in response to the bulk email message including the key associated with the certified mass mailing.

14. A computer readable memory medium storing program instructions executable on a mail processing computer system to:

create bulk filters for groups of a plurality of received email messages without human interaction;

receive a request from a mass mailer to perform a certified mass mailing, wherein the request includes a sample email message of the mass mailer, the mass mailer comprising a computer system;

in response to receiving the request, generate a key to be associated with the certified mass mailing and send the key to the mass mailer;

distribute the created bulk filters, the sample email message, and the generated key to a plurality of mail servers;

wherein the bulk filters are usable by a given one of the plurality of mail servers to determine whether messages received at the given mail server are bulk email messages; and

wherein the given mail server is configured to identify a bulk email message as being part of the certified mass mailing by;

comparing the bulk email message with one or more samples of certified mass mailings to determine whether a match is found between the bulk email message and the sample email message, wherein the one or more samples include the sample email message;

in response to finding the match, determining whether the bulk email message includes the key associated with the certified mass mailing; and

identifying the bulk email message as being part of the certified mass mailing in response to the bulk email message including the key associated with the certified mass mailing.

15. The medium of claim 14, wherein the plurality of received email messages are collected using a plurality of fictitious probe email addresses selected to appear on spam email mailing lists, and wherein one of the fictitious probe email addresses includes an expired domain name.

16. The medium of claim 15, wherein the program instructions are further executable to:

assign scores to the plurality of fictitious probe email addresses based on an amount of received spare or an amount of received legitimate mail.

17. A computer readable memory medium storing program instructions executable on a mail processing computer system to:

receive a request from a mass mailer to perform a certified mass mailing, wherein the request includes a sample email message of the mass mailer, the mass mailer comprising a computer system;

in response to receiving the request, generate a key to be associated with the certified mass mailing and send the key to the mass mailer; and

distribute the sample email message and the key to a plurality of mail servers, wherein each mail server is configured to;

compare a bulk email message with the sample email message;

in response to finding that the bulk email message and the sample email message match, determine whether the bulk email message includes the key associated with the certified mass mailing; and

identify the bulk email message as being part of the certified mass mailing in response to the bulk email message including the key associated with the certified mass mailing.