System, method and computer program to block spam

• US 8,468,208 B2
• Filed: 06/25/2012
• Issued: 06/18/2013
• Est. Priority Date: 03/09/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Davis, John Fred, Himberger, Kevin David, Jeffries, Clark Debs, Jeremiah, Garreth Joseph
• Primary Examiner(s): JAKOVAC, RYAN J
• Application Number:
  US13/532,061
• Publication Number:
  US 20120265834A1
• Time in Patent Office: 358 Days
• Field of Search: 709/206
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A system, method and program product for blocking unwanted e-mails. An e-mail is identified as unwanted. A source IP address of the unwanted e-mail is determined. Other source IP addresses owned or registered by an owner or registrant of the source IP address of the unwanted e-mail are determined. Subsequent e-mails from the source IP address and the other IP addresses are blocked. This will thwart a spammer who shifts to a new source IP address when its spam is blocked from one source IP address.

Claims

1. A method of blocking e-mails, the method comprising the steps of:

generating a filter rule to block a first e-mail from a source of the first e-mail for a first predetermined period, and setting a second predetermined period that extends beyond the first predetermined period, and

if a second e-mail is received from the source during the first predetermined period, blocking the second e-mail based on the filter rule,

if a third e-mail is received from the source after an end of the first predetermined period but before an end of the second predetermined period, a computer (a) setting a third predetermined period to block subsequent e-mails from the source, the third predetermined period extending approximately from a time that the third e-mail is received for a duration longer than a duration of the first predetermined period, and (b) setting a fourth predetermined period to extend beyond an end of the third predetermined period such that if a fourth e-mail is received from the source after an end of the third predetermined period but before an end of the fourth predetermined period, the computer setting a fifth predetermined period to block subsequent e-mails from the source, the fifth predetermined period extending approximately from a time that the fourth e-mail is received for a duration longer than the duration of the third predetermined period; and

if no e-mail is received from the source during the first and second predetermined periods, the computer disabling the filter rule such that if a subsequent e-mail is received from the source, the e-mail is forwarded to its intended destination.

2. The method of claim 1 wherein a duration of the fourth predetermined period equal to a duration of the second predetermined period and begins at an end of the third predetermined period.

3. The method of claim 1 wherein, responsive to the third e-mail being received from the source after an end of the first predetermined period but before an end of the second predetermined period, blocking the third e-mail based on the filter rule.

4. The method of claim 1 wherein the first, second, third and fourth e-mails are received at a firewall.

5. The method of claim 1 wherein the first, second, third and fourth e-mails are received at a router.

6. A computer program product for blocking e-mails, the computer program product comprising:

one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more storage devices, the program instructions comprising;

program instructions to generate a filter rule to block a first e-mail from a source of the first e-mail for a first predetermined period, and set a second predetermined period that extends beyond the first predetermined period, and

responsive to a second e-mail being received from the source during the first predetermined period, to block the second e-mail based on the filter rule,

responsive to a third e-mail being received from the source after an end of the first predetermined period but before an end of the second predetermined period, (a) to set a third predetermined period to block subsequent e-mails from the source, the third predetermined period extending approximately from a time that the third e-mail is received for a duration longer than a duration of the first predetermined period, and (b) to set a fourth predetermined period to extend beyond an end of the third predetermined period such that if a fourth e-mail is received from the source after an end of the third predetermined period but before an end of the fourth predetermined period, to set a fifth predetermined period to block subsequent e-mails from the source, the fifth predetermined period extending approximately from a time that the fourth e-mail is received for a duration longer than the duration of the third predetermined period; and

responsive to no e-mail being received from the source during the first and second predetermined periods, to disable the filter rule such that if a subsequent e-mail is received from the source, the e-mail is forwarded to its intended destination.

7. The computer program product of claim 6 wherein a duration of the fourth predetermined period is equal to a duration of the second predetermined period and begins at an end of the third predetermined period.

8. The computer program product of claim 6 further comprising program instructions, stored on at least one of the one or more storage devices, responsive to the third e-mail being received from the source after an end of the first predetermined period but before an end of the second predetermined period, to block the third e-mail based on the filter rule.

9. The computer program product of claim 6 wherein the first, second, third and fourth e-mails are received at a firewall.

10. The computer program product of claim 6 wherein the first, second, third and fourth e-mails are received at a router.

11. A computer system for blocking e-mails, the computer system comprising:

one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the program instructions comprising;

program instructions to generate a filter rule to block a first e-mail from a source of the first e-mail for a first predetermined period, and set a second predetermined period that extends beyond the first predetermined period, and

responsive to a second e-mail being received from the source during the first predetermined period, to block the second e-mail based on the filter rule,

responsive to a third e-mail being received from the source after an end of the first predetermined period but before an end of the second predetermined period, (a) to set a third predetermined period to block subsequent e-mails from the source, the third predetermined period extending approximately from a time that the third e-mail is received for a duration longer than a duration of the first predetermined period, and (b) to set a fourth predetermined period to extend beyond an end of the third predetermined period such that if a fourth e-mail is received from the source after an end of the third predetermined period but before an end of the fourth predetermined period, to set a fifth predetermined period to block subsequent e-mails from the source, the fifth predetermined period extending approximately from a time that the fourth e-mail is received for a duration longer than the duration of the third predetermined period; and

responsive to no e-mail being received from the source during the first and second predetermined periods, to disable the filter rule such that if a subsequent e-mail is received from the source, the e-mail is forwarded to its intended destination.

12. The computer system of claim 11 wherein a duration of the fourth predetermined period is equal to a duration of the second predetermined period and begins at an end of the third predetermined period.

13. The computer system of claim 11 further comprising program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, responsive to the third e-mail being received from the source after an end of the first predetermined period but before an end of the second predetermined period, to block the third e-mail based on the filter rule.

14. The computer system product of claim 13 wherein the first, second, third and fourth e-mails are received at a firewall.

15. The computer system of claim 13 wherein the first, second, third and fourth e-mails are received at a router.