System, method and program to limit rate of transferring messages from suspected spammers

• US 8,176,126 B2
• Filed: 08/26/2004
• Issued: 05/08/2012
• Est. Priority Date: 08/26/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Davis, John Fred, Himberger, Kevin David, Jeffries, Clark Debs, Jeremiah, Garreth Joseph
• Primary Examiner(s): ENGLAND, DAVID E
• Application Number:
  US10/926,641
• Publication Number:
  US 20060047769A1
• Time in Patent Office: 2,812 Days
• Field of Search: None
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system, method and program product for managing e-mails from a source suspected of sending spam. The e-mails are received at a firewall or router en route to a mail server. A determination is made whether a source has sent an e-mail which exhibits characteristics of spam. In response, subsequent e-mails from the source destined for the mail server are rate-limiting at the firewall or router such that the firewall or router limits a rate at which the subsequent e-mails are forwarded from the firewall or router to the mail server. The rate is predetermined and less than a maximum rate at which the firewall or router can physically forward e-mails to the mail server absent the rate limit. A determination is made whether another source has sent another e-mail which exhibits more characteristics of spam than the first said e-mail. In response, subsequent e-mails from this other source are blocked at the firewall or router. The rate limit can be a limit on a number of e-mails per unit of time from the source that will be forwarded from the firewall or router to the mail server.

Claims

1. A method for managing e-mails, said e-mails being received at a firewall or router en route to a mail server, said method comprising the computer implemented steps of:

determining a first score indicating an extent to which contents of a first e-mail sent by a first source exhibit characteristics of spam, and in response to said first score exceeding a lower threshold but not exceeding an upper threshold, said firewall or router limiting a rate at which said firewall or router forwards subsequent e-mails from said first source to said mail server, the rate limit being predetermined, greater than zero and less than a maximum rate at which said firewall or router is able to forward said subsequent e-mails from said first source to said mail server absent said rate limit;

determining a second score indicating an extent to which contents of a second email sent by a second source exhibit characteristics of spam, and in response to said second score exceeding said upper threshold, said firewall or router not forwarding to said mail server subsequent e-mails from said second source destined for said mail server; and

determining a third score indicating an extent to which contents of a third e-mail sent by a third source exhibit characteristics of spam, and in response to said third score being less than said lower threshold, said firewall or router forwarding subsequent e-mails from said third source to said mail server without blocking or rate-limiting said subsequent e-mails from said third source based on said contents of said third e-mail.

2. A method as set forth in claim 1 wherein scores below said lower threshold indicate that corresponding e-mails are probably not spam, scores above said upper threshold indicate that corresponding e-mails are probably spam, and scores between said lower and upper thresholds indicate that corresponding e-mails have an intermediate likelihood of being spam.

3. A method as set forth in claim 1 wherein said rate limit is a limit on a number of e-mails per unit of time from said first source that will be forwarded from said firewall or router to said mail server.

4. A method as set forth in claim 1 wherein said rate limit is in effect for a predetermined period, and then discontinued such that subsequent e-mails from said first source are not rate-limited based on said contents of said first e-mail.

5. A method as set forth in claim 1 wherein said characteristics of spam include three or more of the following characteristics:

key words characteristic of spam, whether the e-mail is HTML type, whether text in the e-mail omits a first or last name of an intended recipient, whether a subject line of the e-mail is blank or includes words characteristic of marketing, whether an identity listed in a “

from”

field matches a location of a source IP address, whether the e-mail includes colors, whether the e-mail has some text in larger fonts than ordinarily used for noncommercial e-mail, whether multiple e-mails with similar content are addressed to multiple different recipients and originate from a same source IP address, and whether the text is similar or identical to other e-mails from a same source.

8. A system as set forth in claim 5 wherein said rate limit is a limit on a number of e-mails per unit of time from said first source that will be forwarded from said firewall or router to said mail server.

6. A system for managing e-mails, said e-mails being received at a firewall or router en route to a mail server, said system comprising:

means for determining a first score indicating an extent to which contents of a first e-mail sent by a first source exhibit characteristics of spam, and in response to said first score exceeding a lower threshold but not exceeding an upper threshold,

limiting a rate at which said firewall or router forwards said subsequent e-mails from said first source to said mail server, the rate limit being predetermined, greater than zero and less than a maximum rate at which said firewall or router is able to forward e-mails from said first source to said mail server absent said rate limit;

means for determining a second score indicating an extent to which contents of a second e-mail sent by a second source exhibit characteristics of spam, and in response to said second score exceeding said upper threshold, causing said firewall or router to block from said mail server subsequent e-mails from said second source destined for said mail server; and

means for determining a third score indicating an extent to which contents of a third e-mail sent by a third source exhibit characteristics of spam, and in response to said third score being less than said lower threshold, allowing said firewall or router to forward subsequent e-mails from said third source to said mail server without blocking or rate-limiting said subsequent e-mails from said third source based on said contents of said third e-mail.

7. A system as set forth in claim 6 wherein scores below said lower threshold indicate that corresponding e-mails are probably not spam, scores above said upper threshold indicate that corresponding e-mails are probably spam, and scores between said lower and upper thresholds indicate that corresponding e-mails have an intermediate likelihood of being spam.

9. A system as set forth in claim 6 wherein said rate limit is in effect for a predetermined period, and then discontinued such that subsequent e-mails from said first source are not rate-limited based on said contents of said first e-mail.

10. A system as set forth in claim 6 wherein said characteristics of spam include three or more of the following characteristics:

key words characteristic of spam, whether the e-mail is HTML type, whether text in the e-mail omits a first or last name of an intended recipient, whether a subject line of the e-mail is blank or includes words characteristic of marketing, whether an identity listed in a “

from”

field matches a location of a source IP address, whether the e-mail includes colors, whether the e-mail has some text in larger fonts than ordinarily used for noncommercial e-mail, whether multiple e-mails with similar content are addressed to multiple different recipients and originate from a same source IP address, and whether the text is similar to or identical with other e-mails from a same source.

11. A computer program product for managing e-mails, said e-mails being received at a firewall or router en route to a mail server, said computer program product comprising:

one or more computer readable storage media;

first program instructions to determine a first score indicating an extent to which contents of a first e-mail sent by a first source exhibit characteristics of spam, and in response to said first score exceeding a lower threshold but not exceeding an upper threshold, limit a rate at which said firewall or router forwards subsequent e-mails from said first source to said mail server, the rate limit being predetermined, greater than zero and less than a maximum rate at which said firewall or router is able to forward e-mails from said first source to said mail server absent said rate limit;

second program instructions to determine a second score indicating an extent to which contents of a second e-mail sent by a second source exhibit characteristics of spam, and in response to said second score exceeding said upper threshold, cause said firewall or router to block from said mail server subsequent e-mails from said second source destined for said mail server; and

third program instructions to determine a third score indicating an extent to which contents of a third e-mail sent by a third source exhibit characteristics of spam, and in response to said third score being less than said lower threshold, allow said firewall or router to forward subsequent e-mails from said third source to said mail server without blocking or rate-limiting said subsequent e-mails from said third source based on said contents of said third e-mail, and wherein

said first, second and third program instructions are recorded on said one or more computer readable storage media.

12. A computer program product as set forth in claim 11 wherein scores below said lower threshold indicate that corresponding e-mails are probably not spam, scores above said upper threshold indicate that corresponding e-mails are probably spam, and scores between said lower and upper thresholds indicate that corresponding e-mails have an intermediate likelihood of being spam.

13. A computer program product as set forth in claim 11 wherein said rate limit is a limit on a number of e-mails per unit of time from said first source that will be forwarded from said firewall or router to said mail server.

14. A computer program product as set forth in claim 11 wherein said rate limit is in effect for a predetermined period, and then discontinued such that subsequent e-mails from said first source are not rate-limited based on said contents of said first e-mail.

15. A computer program product as set forth in claim 11 wherein said characteristics of spam include three or more of the following characteristics:

key words characteristic of spam, whether the e-mail is HTML type, whether text in the e-mail omits a first or last name of an intended recipient, whether a subject line of the e-mail is blank or includes words characteristic of marketing, whether an identity listed in a “

from”

field matches a location of a source IP address, whether the e-mail includes colors, whether the e-mail has some text in larger fonts than ordinarily used for noncommercial e-mail, whether multiple e-mails with similar content are addressed to multiple different recipients and originate from a same source IP address, and whether the text is similar to or identical with other e-mails from a same source.