Message filtering method

• US 8,194,564 B2
• Filed: 11/15/2010
• Issued: 06/05/2012
• Est. Priority Date: 09/03/2003
• Status: Active Grant

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Hoshiko LLC (Raoul Management LLC)
• Inventors: Shuster, Gary Stephen
• Primary Examiner(s): Kizou, Hassan
• Assistant Examiner(s): MAGLO, EMMANUEL K
• Application Number:
  US12/946,517
• Publication Number:
  US 20110119342A1
• Time in Patent Office: 568 Days
• Field of Search: 370/252, 709/224, 709/227, 709/229, 709/226
• US Class Current: 370/252
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL

Abstract

A message filtering method makes use of a database in which domain names of a network, such as the Internet, are associated with IP addresses, or with geographic locations. Electronic messages are tested for authenticity by comparing domain names and IP addresses for a message being tested with information in the database. If the sender information in the message does not have the same associations as information in the database, the message may be blocked, flagged as spam, or subjected to further filtering.

Claims

1. A method comprising:

determining, by a computing device, sender information for an electronic mail message, wherein the sender information comprises a domain name within an email address of a sender of the electronic mail message and an originating IP address for at least one of one or more servers transmitting the electronic mail message;

determining one or more owners of the originating IP address;

determining, by the computing device, whether the domain name matches the one or more owners of the originating IP address; and

providing an indication of likelihood that the electronic mail message constitutes spam based on at least said determining whether the domain name matches the one or more owners of the originating IP address, wherein the indication indicates a higher likelihood that the electronic mail message constitutes spam if the domain name does not match the one or more owners of the originating IP address.

2. The method of claim 1, wherein the one or more owners of the originating IP address include an entity associated with a range of IP addresses that includes the originating IP address.

3. The method of claim 1, further comprising:

determining a first geographic location associated with the domain name;

determining a second geographic location associated with the originating IP address; and

comparing the first geographic location and the second geographic location, wherein the indication of likelihood that the electronic mail message constitutes spam is further based on said comparing the first geographic location and the second geographic location.

4. A non-transitory computer-readable medium storing instructions thereon, wherein the instructions are readable by a computing device in order to cause the computing device to perform operations comprising:

determining a domain name associated with a sender'"'"'s address of an electronic message;

determining an originating IP address for at least one server associated with transmission of the electronic message;

determining an owner of a range of IP addresses including the originating IP address;

comparing the domain name to the owner in order to generate a likelihood that the domain name is associated with the owner; and

based on said comparing, providing an indication of a likelihood that the electronic message includes spam.

5. The non-transitory computer-readable medium of claim 4, wherein the indication indicates a higher likelihood that the electronic message includes spam if the domain name and the owner do not substantially match.

6. The non-transitory computer-readable medium of claim 4, wherein said determining the owner of the range of IP addresses comprises accessing a data structure storing IP ranges and associated respective owners of the IP ranges.

7. The non-transitory computer-readable medium of claim 4, wherein the operations further comprise:

determining a first geographic location associated with the domain name;

determining a second geographic location associated with the originating IP address; and

comparing the first geographic location and the second geographic location, wherein the likelihood that the electronic message includes spam is further based on said comparing the first geographic location and the second geographic location.

8. A computing system comprising:

a processing unit configured to execute software instructions;

a computer readable medium storing software instructions for execution by the processing unit in order to cause the computing system to perform operations comprising;

determining sender information for an electronic message, wherein the sender information comprises a domain name associated with a sender of the electronic message and an originating IP address associated with at least one server involved in transmission of the electronic message;

determining one or more owners of the originating IP address;

determining whether the domain name matches the one or more owners of the originating IP address; and

providing an indication of likelihood that the electronic message constitutes spam based on at least said determining whether the domain name matches the one or more owners of the originating IP address, wherein the indication indicates a higher likelihood that the electronic message constitutes spam if the domain name does not match the one or more owners of the originating IP address.

9. The computing system of claim 8, wherein said determining one or more owners of the originating IP address comprises accessing a data structure storing IP ranges and associated respective owners of the IP ranges.

10. The computing system of claim 8, wherein the operations further comprise:

determining a first geographic location associated with the domain name;

determining a second geographic location associated with the originating IP address; and

comparing the first geographic location and the second geographic location, wherein the indication of likelihood that the electronic message constitutes spam is further based on said comparing the first geographic location and the second geographic location.