Real-time spam look-up system

• US 8,959,157 B2
• Filed: 06/26/2009
• Issued: 02/17/2015
• Est. Priority Date: 06/26/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Walter, Jason D., Gillum, Eliot C., Vitaldevara, Krishna C., Colvin, Ryan Charles, Bidgoli, Mehrdad, Mills, Chad W., Korb, Joshua David, McCann, Robert Lee, Hines, Douglas John, Davis, Malcolm Hollis, Drinic, Milenko
• Primary Examiner(s): Hussain, Tauqir
• Assistant Examiner(s): WIDHALM, ANGELA M
• Application Number:
  US12/493,046
• Publication Number:
  US 20100332601A1
• Time in Patent Office: 2,062 Days
• Field of Search: 709/206
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method of managing unsolicited email sent to an email system over a network. Email messages are received at an message at an inbound mail transfer agent. A determination is made as to whether the email message is suspected to be an unsolicited suspect message. One or more queries for additional information on one or more characteristics of the message is initiated. Determinations are made based on replies to the queries before issuing a message accepted for delivery indication to a sending server.

Claims

1. A method of managing unsolicited email sent to an email system over a public network, the system including a plurality of inbound mail servers, comprising:

(a) receiving an email message at an inbound mail transfer agent and before issuing a message accepted message to a sender of the email message,

initiating a plurality of concurrent queries to publicly accessible hosts on the public network for additional public information on a plurality of different characteristics of the message, each query returning public network infrastructure information on one or more of said plurality of characteristics based on public network infrastructure information available regarding the characteristics responsive to the queries; and

determining whether the message is unsolicited bulk email based on public network infrastructure information received in the response to said plurality of queries by determining, for each of the plurality of queries when a reply to said each of the plurality of queries is received, determining if another concurrent query has returned results prior to each said query and if so whether said returned results are dispositive of whether the message is unsolicited bulk email, and if not, waiting for results from said each of the plurality of queries;

(b) after said determining, if the message is not unsolicited bulk email, issuing the message accepted message to the sender and if not, withholding the message accepted message.

2. The method of claim 1 wherein the said determining includes determining whether the message is suspect based on the response of a previous query.

3. The method of claim 1 wherein the method further includes storing the response of each query for use in said determining.

4. The method of claim 1 wherein the determining includes updating search results from a plurality of concurrent searches to perform the determining step.

5. The method of claim 1 wherein said determining comprises at least one of:

determining a true source IP for a message and whether that IP is associated with known spam senders;

determining a source IP for a message and whether that IP is associated with a block of IPs associated with known spam senders;

determining a source IP and whether a registrant of a domain associated with the source IP is IPs associated with known spam senders;

determining for a domain name an authoritative name server for the domain and whether the ANS is associated with a known spammer;

determining an MX record associated with a sender and whether domains or IP addresses in the MX record are associated with known spam senders;

determining a host name associated with a known IP address of an email source and determining whether host name server IPs are associated with known spam senders;

determining a name server associated with a sending domain and determining whether the name server is associated with known spam senders.

6. The method of claim 1 wherein the step of initiating includes performing a plurality of queries on multiple characteristics of the message.

7. The method of claim 1 wherein the method includes performing a plurality of queries asynchronously.

8. The method of claim 1 further including receiving a reply to one of the plurality of queries and determining whether the reply is determinative of whether the message is spam before receiving replies to others of said queries.

9. The method of claim 1 wherein the method further includes one or more of:

determining to reject the message by issuing an SMTP level 500 error;

determining to accept the message and route the message to a junk folder,

determining to accept the message and automatically deleting the message;

determining to accept the message and rendering the message differently.

10. A method for determining whether to issue a mail accepted for delivery message for an email message received over a public network, comprising:

accepting the email message for delivery and prior to issuing a message accepted for delivery message to a sender,

determining whether the email message has spam characteristic;

for each message having a spam characteristic, issuing a plurality of parallel queries on one or more different characteristics of the message to public hosts on the public network to determine public network infrastructure information regarding the characteristic, and determining whether the message shares network infrastructure characteristics with messages previously determined to be spam using public infrastructure information returned in response to at least one of the plurality of parallel queries;

receiving a reply including public infrastructure information to a subset of less than all of the plurality of parallel queries;

determining if the reply received is sufficient to determine whether the message is or is not spam;

determining whether the email message is or is not spam by evaluating the reply such that if the reply received is sufficient to determine whether the message is or is not spam, determining, based on said reply, whether the message is or is not spam, and ignoring other replies and if not waiting for one or more additional replies and determining whether or not the message is or is not spam based on the additional replies

subsequent to said determining issuing a message accepted for delivery message to the sender if the message is not spam and disposing of the message without issuing a message accepted for delivery message if the message is spam.

11. The method of claim 10 wherein the method further includes storing reply queries for use in each determining step, issuing includes determining whether the message is suspect based on results of a previous query.

12. The method of claim 11 wherein said determining includes using updated search results from a plurality of concurrent queries to perform the determining step.

13. The method of claim 12 wherein determining whether a message has a spam characteristic includes determining one or a sender classification, whether the message is authenticated or determining a spam probability based on assigning a spam score.

14. The method of claim 13 wherein the step of determining whether the message is or is not spam includes at least one of:

determining a true source IP for a message and whether that IP is associated with known spam senders;

determining a source IP for a message and whether that IP is associated with a block of IPs associated with known spam senders;

determining a source IP and whether a registrant of a domain associated with the source IP is IPs associated with known spam senders;

determining for a domain name an authoritative name server for the domain and whether the ANS is associated with a known spammer;

determining an MX record associated with a sender and whether domains or IP addresses in the MX record are associated with known spam senders;

determining a host name associated with a known IP address of an email source and determining whether host name server IPs are associated with known spam senders;

determining a name server associated with a sending domain and determining whether the name server is associated with known spam senders.

15. The method of claim 14 wherein the step of initiating includes performing a plurality of queries on an multiple characteristics of the message.

16. The method of claim 15 wherein the method includes performing the plurality of queries asynchronously.

17. The method of claim 10 further including receiving a reply to one of the plurality of queries and determining whether the reply is determinative of whether the message is spam before receiving replies to others of said queries.

18. A messaging system comprising a processing device coupled to a public network and receiving messages from the public network, the processing device including code providing instructions to the processing device to implement the steps of;

providing a message transfer agent managing connections to the messaging system, the message transfer agent receiving an email message;

providing an inbound email parsing agent including a mail component extraction module;

providing a suspect email determination module including which includes code performing the steps of;

accepting the email message and prior to issuing a mail accepted message to a sender of the email message, determining whether an email message has spam characteristic, and

for each email message having a spam characteristic, issuing a plurality of parallel queries on the email message to public hosts having public infrastructure information, each query seeking public infrastructure information on a different characteristic of the message to determine public network infrastructure information regarding each queried characteristic;

receiving a reply to one or more of the plurality of queries, the reply including public infrastructure information;

determining from the public infrastructure information received in reply to one or more queries whether the message shares characteristics with messages previously determined to be spam or not spam based on network infrastructure information shared by spam messages;

determining if the reply received is sufficient to determine whether the message is or is not spam, and if the reply received is sufficient to determine whether the message is or is not spam, ignoring other replies and determining, based on said reply, whether the message is or is not spam, and if not waiting for one or more additional replies and determining whether or not the message is or is not spam based on the additional replies; and

subsequent to said determining whether or not the message is or is not spam, issuing a message accepted for delivery message to the sender if the message is not spam and disposing of the message without issuing a message accepted for delivery message to said sender.

19. The system of claim 18 wherein the code issuing a plurality of queries includes issuing a query for a plurality of:

determining a true source IP for a message and whether that IP is associated with known spam senders;

determining a source IP for a message and whether that Ip is associated with a block of IPs associated with known spam senders;

determining a source IP and whether a registrant of a domain associated with the source IP is IPs associated with known spam senders;

determining for a domain name an authoritative name server for the domain and whether the ANS is associated with a known spammer;

determining an MX record associated with a sender and whether domains or IP addresses in the MX record are associated with known spam senders;

determining a host name associated with a known IP address of an email source and determining whether host name server IPs are associated with known spam senders;

determining a name server associated with a sending domain and determining whether the name server is associated with known spam senders.