Method and apparatus for preventing outgoing spam e-mails by monitoring client interactions

• US 8,601,065 B2
• Filed: 05/31/2006
• Issued: 12/03/2013
• Est. Priority Date: 05/31/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Lin, Frank C., Wang, Xiangrong, Shi, Hang
• Primary Examiner(s): Moore, Ian N
• Assistant Examiner(s): Huynh, Dung B
• Application Number:
  US11/444,203
• Publication Number:
  US 20070282955A1
• Time in Patent Office: 2,743 Days
• Field of Search: None
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Methods and apparatus for preventing spam e-mail messages from being propagated or transmitted by monitoring user interaction events associated with the system are disclosed. According to one aspect of the present invention, a method for processing a first e-mail message on a system that transmits e-mail message and has an input device includes identifying an attempt to transmit the first e-mail message; and determining whether a user interaction event has occurred within a given time interval. If it is determined that a user interaction event has not occurred within the given time interval, the first e-mail message is prevented from being transmitted.

Claims

1. A method for processing a first e-mail message on a system, the system being arranged to transmit e-mail messages, the system including at least one input device, the method comprising:

identifying an attempt to transmit the first e-mail message;

determining whether an interaction event has occurred within a given time interval, the given time interval being measured beginning before the attempt to transmit the first e-mail message is identified;

performing a comparison utilizing content of the first e-mail message to determine whether the first e-mail message is likely legitimate;

preventing the first e-mail message from being transmitted if it is determined that the interaction event has not occurred within the given time interval and if the comparison indicates that the first e-mail message is likely not legitimate; and

allowing the first e-mail message to be transmitted if it is determined that the interaction event has not occurred within the given time interval and if the comparison indicates that the first e-mail message is likely legitimate,

wherein the interaction event is a user interaction event, and determining whether the user interaction event has occurred within the given time interval includes;

obtaining a timestamp associated with the user interaction event, the timestamp being arranged to indicate a time associated with an occurrence of the user interaction event;

determining a first time, the first time being a time associated with the attempt to transmit the first e-mail message; and

determining if the difference between the first time and the timestamp exceeds the given time interval, wherein if the difference between the first time and the timestamp exceeds the given time interval, it is determined that the user interaction event has not occurred within the given time interval.

2. The method of claim 1 wherein identifying the attempt to transmit the first e-mail message includes:

capturing at least one packet associated with the first e-mail message; and

identifying the at least one packet as having a protocol associated with the e-mail messages.

3. The method of claim 2 wherein the protocol is one selected from the group including a simple mail transfer protocol (SMTP), an internet message access protocol (IMAP), a post office protocol (POP), an HTTP protocol, and a protocol associated with a messaging application programming interface (MAPI).

4. The method of claim 1 wherein the user interaction event is a most recent user interaction event associated with the system.

5. The method of claim 1 wherein the timestamp associated with the user interaction event is obtained from a database.

6. The method of claim 1 wherein the at least one input device is a keyboard, and the interaction event is a keyboard activity.

7. The method of claim 1 wherein the at least one input device is a mouse, and the interaction event is a mouse click.

8. The method of claim 1 further including:

transmitting the first e-mail message if it is determined that the interaction event has occurred within the given time interval.

9. The method of claim 1 further including identifying the first e-mail message as being a spam e-mail message if it is determined that the interaction event has not occurred within the given time interval.

10. The method of claim 1 wherein the system is a first computing system arranged to transmit the e-mail messages to a second computing system, and where preventing the first e-mail message from being transmitted if it is determined that the interaction event has not occurred within the given time interval includes preventing the first e-mail message from being transmitted by the first computing system to the second computing system and received by the second computing system.

11. The method of claim 10 wherein the interaction event is performed by the first computing system.

12. The method of claim 1 wherein the system is a first computing system arranged to transmit the e-mail messages across a network to a second computing system, and wherein identifying an attempt to transmit the first e-mail message includes identifying an attempt to transmit the first-e-mail message from the first computing system across the network.

13. The method of claim 1 wherein the given time interval is a predetermined time interval that ends when the attempt to transmit the first e-mail message is identified.

14. The method of claim 1 wherein determining whether the interaction event has occurred within the given time interval includes determining whether the interaction event has occurred before the attempt to transmit the first e-mail is identified.

15. The method of claim 1 wherein the given time interval being measured beginning before the attempt to transmit the first email is identified is such that the given time interval is measured beginning when the first e-mail is composed.

16. The method of claim 15 wherein the given time interval ends when the attempt to transmit the first e-mail message is identified.

17. A non-transitory computer-readable medium for storing computer codes for processing a first e-mail message, the computer codes being executable by a processor, the computer codes comprising:

computer code that causes an attempt to transmit the first e-mail message to be identified;

computer code that causes a determination of whether an interaction event has occurred within a given time interval, the given time interval being measured beginning before the attempt to transmit the first e-mail message is identified;

computer code that performs a comparison utilizing content of the first e-mail message to determine whether the first e-mail message is likely legitimate;

computer code that prevents the first e-mail message from being transmitted if it is determined that the interaction event has not occurred within the given time interval and if the comparison indicates that the first e-mail message is likely not legitimate; and

computer code that allows the first e-mail message to be transmitted if it is determined that the interaction event has not occurred within the given time interval and if the comparison indicates that the first e-mail message is likely legitimate,

wherein the interaction event is a user interaction event, and computer code that cause the determination of whether the user interaction event has occurred within the given time interval includes;

computer code that obtains a timestamp associated with the user interaction event, the timestamp being arranged to indicate a time associated with an occurrence of the user interaction event;

computer code that determines a first time, the first time being a time associated with the attempt to transmit the first e-mail message; and

computer code that determines if the difference between the first time and the timestamp exceeds the given time interval, wherein if the difference between the first time and the timestamp exceeds the given time interval, it is determined that the user interaction event has not occurred within the given time interval.

18. The computer-readable medium for storing computer codes of claim 17 wherein the computer codes further include:

computer code that causes a time associated with an occurrence of the interaction even to be recorded, wherein the time is recorded as a timestamp; and

computer code that causes the timestamp to be stored.

19. The computer-readable medium for storing computer codes of claim 17 wherein the computer codes further include:

computer code that causes at least one packet associated with the first e-mail message to be intercepted.

20. The computer-readable medium for storing computer codes of claim 19 wherein the computer codes further include:

computer code that causes wherein a protocol associated with the at least one packet to be identified, wherein if the protocol is identified as an e-mail protocol, the attempt to transmit the first e-mail message is detected.

21. The computer-readable medium for storing computer codes of claim 17 wherein the computer codes further include:

computer code that causes the user interaction event to be captured.

22. The computer-readable medium for storing computer codes of claim 18 wherein the computer codes further include:

computer code that causes a packet associated with the first e-mail message to be captured.

23. An apparatus for processing a first e-mail message generated by an application, the apparatus being arranged on a computing system, the computing system being a part of a network, the apparatus comprising:

a first activity detector, the first activity detector being arranged to detect an attempt to transmit the first e-mail message from the computing system over the network; and

a second activity detector, the second activity detector being arranged to determine if an interaction event has occurred within a given time interval, the second activity detector further being arranged to perform a comparison utilizing content of the first e-mail message to determine whether the first e-mail is likely legitimate, the given time interval occurring before the attempt to transmit the first e-mail message is detected, wherein if it is determined that the interaction event has not occurred within the given time interval and if it is determined that the first e-mail is likely not legitimate, the first e-mail message is identified as being a spam e-mail message,

wherein the interaction event is a user interaction event, and the second activity detector being arranged to determine if the user interaction event has occurred within the given time interval includes;

obtain a timestamp associated with the user interaction event, the timestamp being arranged to indicate a time associated with an occurrence of the user interaction event;

determine a first time, the first time being a time associated with the attempt to transmit the first e-mail message; and

determine if the difference between the first time and the timestamp exceeds the given time interval, wherein if the difference between the first time and the timestamp exceeds the given time interval, it is determined that the user interaction event has not occurred within the given time interval.

24. A method for processing a first e-mail message on a system that is included in a network, the system being arranged to transmit e-mail messages over the network, the method comprising:

identifying an attempt to transmit the first e-mail message from the system over the network, wherein identifying the attempt to transmit the first e-mail message includes monitoring traffic on the network;

determining whether an event has occurred within a given time interval, the time interval being measured beginning before the attempt to transmit the first e-mail message is identified and ending when the attempt to transmit the first e-mail message is identified by the system;

performing a heuristic comparison using contents of the first email to determine a likelihood that the first e-mail message is spam;

identifying the first e-mail message as being spam if it is determined that the event has not occurred within the given time interval and if the heuristic comparison using the contents of the first e-mail message indicates the likelihood that the first email is spam; and

identifying the first e-mail message as being legitimate if it is determined that the event has not occurred within the given time interval and if the heuristic comparison does not indicate the likelihood that the first e-mail message is spam,

wherein the event is a user interaction event, and determining whether the user interaction event has occurred within the given time interval includes;

obtaining a timestamp associated with the user interaction event, the timestamp being arranged to indicate a time associated with an occurrence of the user interaction event;

determining a first time, the first time being a time associated with the attempt to transmit the first e-mail message; and

determining if the difference between the first time and the timestamp exceeds the given time interval, wherein if the difference between the first time and the timestamp exceeds the given time interval, it is determined that the user interaction event has not occurred within the given time interval.

25. The method of claim 24 wherein the e-mail messages include prescheduled e-mail messages, and determining whether the event has occurred within the given time interval includes determining whether a prescheduled event has occurred within the given time interval.

26. The method of claim 25 wherein identifying the first e-mail message as being spam if it is determined that the event has not occurred within the given time interval includes identifying the first e-mail message as being spam if it is determined that the prescheduled event has not occurred within the given time interval.

27. The method of claim 24 wherein monitoring the traffic on the network includes the system intercepting the first e-mail message from an outgoing network traffic path.

28. A non-transitory computer-readable medium for storing computer codes for processing a first e-mail message, the computer codes being executable by a processor, the computer codes comprising:

computer code that causes an attempt to transmit the first e-mail message from a system over a network to be identified wherein the computer code that causes the attempt to transmit the first e-mail message to be identified includes computer code that causes traffic on the network to be monitored;

computer code that causes a determination of whether an event has occurred within a given time interval, the time interval being measured beginning before the attempt to transmit the first e-mail message is identified and ending when the attempt to transmit the first e-mail message is identified by the system;

computer code that causes a heuristic comparison using contents of the first email to be performed to determine a likelihood that the first e-mail message is spam;

computer code that causes the first e-mail message to be identified as being spam if it is determined that the event has not occurred within the given time interval and if the heuristic comparison using the contents of the first e-mail message indicates the likelihood that the first email is spam; and

computer code that causes the first e-mail message to be identified as being legitimate if it is determined that the event has not occurred within the given time interval and if the heuristic comparison does not indicate the likelihood that the first e-mail message is spam,

wherein the event is a user interaction event, and computer code that cause the determination of whether the user interaction event has occurred within the given time interval includes;

computer code that obtains a timestamp associated with the user interaction event, the timestamp being arranged to indicate a time associated with an occurrence of the user interaction event;

computer code that determines a first time, the first time being a time associated with the attempt to transmit the first e-mail message; and

computer code that determines if the difference between the first time and the timestamp exceeds the given time interval, wherein if the difference between the first time and the timestamp exceeds the given time interval, it is determined that the user interaction event has not occurred within the given time interval.

29. The computer-readable medium for storing computer codes of claim 28 wherein the e-mail messages include prescheduled e-mail messages, and the computer code that causes the determination of whether the event has occurred within the given time interval includes computer code that causes a determination of whether a prescheduled event has occurred within the given time interval.

30. The computer-readable medium for storing computer codes of claim 29 wherein the computer code that causes the first e-mail message to be identified as being spam if it is determined that the event has not occurred within the given time interval includes computer code that causes the first e-mail message to be identified as being spam if it is determined that the prescheduled event has not occurred within the given time interval.