Email safety determination

• US 8,135,780 B2
• Filed: 12/01/2006
• Issued: 03/13/2012
• Est. Priority Date: 12/01/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gillum, Eliot C.
• Primary Examiner(s): Avellino, Joseph
• Assistant Examiner(s): KHAN, AFTAB N
• Application Number:
  US11/566,071
• Publication Number:
  US 20080133672A1
• Time in Patent Office: 1,929 Days
• Field of Search: 709/206, 709/207, 709/204, 709/205, 715/821, 715/752, 715/744
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting

Abstract

A computer implemented method for assisting email users recognizes deviations in characteristics of emails sent from a particular source identifier or “source ID” to a user. After one or more emails having a pattern of characteristics are received, an action on subsequent emails is performed, such as warning users when the subsequent emails received from the source ID match or don'"'"'t match the pattern. Characteristics from a particular source ID are determined based on whether the addressee reads the email from the source ID. Various levels of warning based on the characteristics identified and the deviation of any email from the characteristics of previous emails.

Claims

1. A computer implemented method for assisting email users, comprising:

receiving a plurality of email messages, each message addressed to at least one email user and identifying a sender identity;

recording a plurality of characteristics associated with each email sent from a sender identity;

determining whether characteristics of new emails purported to be received from the sender identity match characteristics of a plurality of previously received emails from the sender identity, the determining performed after a user views an email in the interface, and a known good pattern is established when at least a plurality emails from the sender identity share the same plurality of characteristics when the user reads the email;

presenting at least a portion of a received new email message to the user in a user interface, the user interface including a set of user actions which may be performed by the user via the user interface; and

if the characteristics in the received new email message do not match the characteristics recorded for the plurality of previously received emails from the sender identity, transforming the user interface to include an indication along with at least a portion of the message field of the email, associated with the received new email message, to the at least one email user, that the received new email message purported to be from the sender identity is not likely to be from the sender identity and enabling further actions on the received new email message in the user interface, the indication comprising a warning which includes a first greater severity when a pattern of matching a stronger characteristic is not matched and a lesser severity when a pattern of matching a weaker characteristic is not matched, and if the characteristics in the received new email message match the characteristics recorded, not transforming the user interface.

2. The computer implemented method of claim 1 wherein the characteristics comprise one or more of:

whether or not an email passes a Sender ID authentication or whether or not an email passes DomainKeys Identified Mail authentication;

whether or not an email is received from one or more Internet Protocol addresses;

one or more elements in an email header; and

/or a text characteristic in emails from the sender identity.

3. The method of claim 1 wherein a first characteristic is an email from a source identifier regularly passing Sender ID or DomainKeys Identified Mail authentication and a second characteristic is an email regularly coming from an Internet Protocol address.

4. The method of claim 1 wherein the sender identity comprises one or:

an email address or a group of email addresses.

5. The method of claim 1 wherein the sender identity comprises one of:

an Internet Protocol address or a group of Internet Protocol addresses.

6. The method of claim 5 wherein a group of Internet Protocol addresses results from one or more of:

a WHOIS query based on at least two known good IP addresses;

a BGP query based on at least two known good IP addresses;

a common domain part from a reverse DNS query resulting from at least two IP addresses.

7. A computer implemented method for classifying emails according to source, comprising;

receiving a plurality of email messages, each message addressed to at least one email user and identifying a sender identity;

presenting newly received emails addressed to the at least one email user in an user interface for the user, the user interface including a set of available actions;

monitoring whether a user selects to view a received email message from the sender identity in the user interface;

extracting one or more characteristics from each received email message associated with the sender identity after the user selects to view a first email message from the sender identity in the user interface;

determining whether the one or more characteristics associated with the received email selected matches one or more known good characteristics of a plurality of other messages received for the sender identity to establish a pattern of characteristics for messages a user views from the sender identity, the determining performed after a user views an email in the interface, and a known good pattern is established when at least a plurality emails from the sender identity share the same plurality of characteristics when the user reads the email; and

receiving a new email for the user from the sender identity and if the one or more characteristics of the new email do not match the pattern, transforming the user interface to include an at least a portion of the message field of the message along with an indication, associated with the new email, to the at least one email user, of whether the received email is likely to be from the sender identity and enabling an action on the email, the indication comprising a warning which includes a first greater severity when a pattern of matching a stronger characteristic is not matched and a lesser severity when a pattern of matching a weaker characteristic is not matched, and if the characteristics in the received new email message match the characteristics recorded, not transforming the user interface.

8. The computer implemented method of claim 7 wherein the action comprises displaying a visual indicator in the interface to indicate potential email problems to the user.

9. The computer implemented method of claim 7 wherein the characteristics comprise one or more of:

whether or not an email passes a Sender ID authentication;

whether or not an email passes DomainKeys Identified Mail authentication; and

/or whether or not an email is received from one or more Internet Protocol addresses.

10. The method of claim 7 wherein the source comprises at least one of an email address or a group of email addresses.

11. The method of claim 7 wherein the source comprises one of:

an Internet Protocol address or a group of Internet Protocol addresses.

12. The method of claim 7 wherein the characteristics comprise a text characteristic in emails from the source.

13. The computer implemented method of claim 7 further including the step of automatically white-listing the email address.

14. A computer implemented method for assisting email users of an enterprise service provider email system, comprising:

receiving a plurality of email messages in the enterprise service provider email system, each message addressed to at least one email user and identifying at least one sender identity having an email address;

presenting emails addressed to the at least one email user in a user interface for the user;

gathering a plurality of identifying characteristics for the plurality of emails received at the enterprise service provider email system from an email address directed to a plurality of users in a group of users after one user in the group selects to view a first email from the email address;

establishing a pattern of identifying characteristics for emails from the at least one sender identity based on group actions;

determining whether a new received email purported to be from the sender identity and directed to the at least one email user matches the pattern of identifying characteristics associated with the at least one sender identity, the determining performed after a user views an email in the interface, and a known good pattern is established when at least three emails from the sender identity share the same plurality of characteristics when the user reads the email; and

upon the user viewing the new email, transforming the user interface to provide a portion of the message field and to visually indicate to the user that the new received email is not likely from the sender identity when identifying characteristics of the new email do not match the pattern of identifying characteristics by providing a warning which includes a first greater severity when a pattern of matching a stronger characteristic is not matched and a lesser severity when a pattern of matching a weaker characteristic is not matched, and enabling an action on the email in the user interface.

15. The computer implemented method of claim 14 wherein the step of indicating includes indicating one of a match with previous characteristics and a non-match with previously gathered characteristics.

16. The computer implemented method of claim 14 wherein the characteristics comprise one or more of:

whether or not an email passes a Sender ID authentication;

whether or not an email passes DomainKeys Identified Mail authentication;

whether or not an email is received from one or more Internet Protocol addresses; and

/or a recurring text pattern in emails from the sender identity.