Systems and methods for associating website browsing behavior with a spam mailing list

• US 8,935,284 B1
• Filed: 07/15/2010
• Issued: 01/13/2015
• Est. Priority Date: 07/15/2010
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Cooley, Shaun
• Primary Examiner(s): Beausoliel, Jr., Robert
• Assistant Examiner(s): BROMELL, ALEXANDRIA Y
• Application Number:
  US12/836,703
• Time in Patent Office: 1,643 Days
• Field of Search: 707/802, 707/776, 709/206, 706/45
• US Class Current: 707/776
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation

Abstract

A computer-implemented method for associating website browsing behavior with a spam mailing list is described. A history of website browsing behavior is collected for a plurality of users. At least one spam mailing list is identified that includes an e-mail address for at least two users of the plurality of users. A determination is made as to whether a common website exists between the histories of website browsing behavior for the at least two users. Reputation information for the common website is updated.

Claims

1. A computer-implemented method for associating website browsing behavior with a spam mailing list, comprising:

collecting a history of website browsing behavior for each of a plurality of users;

identifying at least one spam mailing list that includes an e-mail address for a first user and an email address for a second user of the plurality of users;

determining if a level of similarity between a first email message received at the e-mail address for the first user and a second email message received at the e-mail address for the second user exceeds a threshold;

upon determining that the level of similarity exceeds the threshold;

determining if a common website exists between the history of website browsing behavior for the first user and the history of website browsing behavior for the second user; and

upon determining that a common website exists, updating reputation information for the common website, wherein the reputation information indicates a likelihood that e-mail messages sent to e-mail addresses on the at least one spam mailing list originate from the common website.

2. The method of claim 1, further comprising monitoring a website browsing application for each of the plurality of users.

3. The method of claim 2, further comprising collecting information relating to websites accessed by the website browsing application.

4. The method of claim 3, further comprising identifying accessed websites that include a data form.

5. The method of claim 1, further comprising identifying at least one client computing device that receives e-mail messages.

6. The method of claim 5, further comprising receiving information identifying at least one e-mail message received by the at least one client.

7. The method of claim 6, further comprising recording the identifying information in a database.

8. The method of claim 7, further comprising identifying the at least one spam mailing list by identifying at least one group of client computing device with similar patterns of identifying information.

9. The method of claim 1, further comprising transmitting the history of website browsing behavior to a back end computing device for processing in real time.

10. The method of claim 1, further comprising copying a browser history for a user and transmitting the copy of the browser history to a back end computing device for processing.

11. A computing device configured to associate website browsing behavior with a spam mailing list, comprising:

a processor;

memory in electronic communication with the processor, the memory storing computer executable instructions that when executed by the processor cause the processor to;

collect a history of website browsing behavior for each of a plurality of users;

identify at least one spam mailing list that includes an e-mail address for a first user and an email address for a second user of the plurality of users;

determine if a level of similarity between a first email message received at the e-mail address for the first user and a second email message received at the e-mail address for the second user exceeds a threshold;

upon determining that the level of similarity exceeds the threshold;

determine if a common website exists between the history of website browsing behavior for the first user and the history of website browsing behavior for the second user; and

upon determining that a common website exists, update reputation information for the common website, wherein the reputation information indicates a likelihood that e-mail messages sent to e-mail addresses on the at least one spam mailing list originate from the common website.

12. The computing device of claim 11, wherein the processor is further configured to monitor a website browsing application for each of the plurality of users.

13. The computing device of claim 12, wherein the processor is further configured to collect information relating to websites accessed by the website browsing application.

14. The computing device of claim 13, wherein the processor is further configured to identify accessed websites that include a data form.

15. The computing device of claim 11, wherein the processor is further configured to identify at least one client computing device that receives e-mail messages.

16. The computing device of claim 15, wherein the processor is further configured to receive information identifying at least one e-mail message received by the at least one client.

17. The computing device of claim 16, wherein the processor is further configured to record the identifying information in a database.

18. The computing device of claim 17, wherein the processor is further configured to identify the at least one spam mailing list by identifying at least one group of client computing device with similar patterns of identifying information.

19. The computing device of claim 11, wherein the processor is further configured to transmit the history of website browsing behavior to a back end computing device for processing in real time.

20. A computer-readable storage device storing instructions that when executed cause a processor to:

collect a history of website browsing behavior for each of a plurality of users;

identify at least one spam mailing list that includes an e-mail address for a first user and an email address for a second user of the plurality of users;

determine if a level of similarity between a first email message received at the e-mail address for the first user and a second email message received at the e-mail address for the second user exceeds a threshold;

upon determining that the level of similarity exceeds the threshold;

determine if a common website exists between the history of website browsing behavior for the first user and the history of website browsing behavior for the second user; and

upon determining that a common website exists, update reputation information for the common website, wherein the reputation information indicates a likelihood that e-mail messages sent to e-mail addresses on the at least one spam mailing list originate from the common website.