Filtering electronic messages based on domain attributes without reputation

• US 9,258,260 B2
• Filed: 08/19/2013
• Issued: 02/09/2016
• Est. Priority Date: 08/19/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Nikolayev, Alexander, Li, Weisheng, Gandhi, Mauktik
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): BUKHARI, SIBTE H
• Application Number:
  US13/970,484
• Publication Number:
  US 20150052207A1
• Time in Patent Office: 904 Days
• Field of Search: 709/206
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A messaging application filters electronic messages based on domain attributes without a reputation. A message with a uniform resource identifier (URI) is received and determined to not be included within a trusted or a block list. A total score is computed from weighted scores assigned to factors associated with the message. The message is evaluated for an unsolicited message determination by comparing the total score against a predetermined threshold.

Claims

1. A method executed on a computing device for filtering an electronic message based on domain attributes, the method comprising:

receiving the electronic message with a uniform resource identifier (URI);

determining that the URI is not included within at least one of;

a trusted list and a block list, wherein the trusted list provides a list of trusted domains and the block list provides a list of untrusted domains;

indicating a failure to locate a reputation of the URI in one or more of the trusted domains and the untrusted domains;

assigning weighted scores to one or more factors associated with the electronic message;

computing a total score from the weighted scores; and

evaluating the electronic message to determine an unsolicited electronic message by comparing the total score against a predetermined threshold.

2. The method of claim 1, further comprising:

retrieving the trusted list and the block list from one of;

a local resource and a trusted external resource.

3. The method of claim 1, further comprising:

determining a size of the electronic message; and

assigning a first weighted score to the size.

4. The method of claim 3, further comprising:

incrementing a URI count; and

assigning a second weighted score to the URI count.

5. The method of claim 4, further comprising:

determining a set of electronic messages sent to other recipients within a predefined group having the URI.

6. The method of claim 5, further comprising:

computing a number of recipients of the set of electronic messages; and

assigning a third weighted score to the number of recipients.

7. The method of claim 6, further comprising:

computing a number of recipient domains for the set of electronic messages; and

assigning a fourth weighted score to the number of recipient domains.

8. The method of claim 7, further comprising:

computing at least one of;

a time of arrival and a rate of arrival of the set of electronic messages; and

assigning a fifth weighted score to the at least one of;

the time of arrival and the rate of arrival of the set of electronic messages.

9. The method of claim 8, further comprising:

determining a geo-location of a sender of the electronic message; and

assigning a sixth weighted score to the geo-location.

10. The method of claim 9, further comprising:

adding two or more of the first weighted score, the second weighted score, the third weighted score, the fourth weighted score, the fifth weighted score, and the sixth weighted score to determine a total score.

11. A computing device for filtering an electronic message based on domain attributes, the computing device comprising:

a memory configured to store instructions; and

a processor coupled to the memory, the processor executing a messaging application in conjunction with the instructions stored in the memory, wherein the messaging application is configured to;

receive the electronic message with a uniform resource identifier (URI);

retrieve a trusted list and a block list from one of;

a local resource and a trusted external resource;

determine that the URI is not included within at least one of;

the trusted list and the block list, wherein the trusted list provides a list of trusted domains and the block list provides a list of untrusted domains;

indicate a failure to locate a reputation of the URI in one or more of the trusted domains and the untrusted domains;

assign weighted scores to one or more factors associated with the electronic message;

compute a total score from the weighted scores; and

evaluate the electronic message to determine an unsolicited electronic message by comparing the total score against a predetermined threshold.

12. The computing device of claim 11, wherein the messaging application is further configured to:

confirm a determination of the unsolicited electronic message in response to the total score exceeding the predetermined threshold.

13. The computing device of claim 11, wherein the messaging application is further configured to:

reject a determination of the unsolicited electronic message in response to the total score remaining within the predetermined threshold.

14. The computing device of claim 11, wherein the messaging application is further configured to:

adjust the predetermined threshold and the weighted scores based on at least one of;

a current unsolicited message activity and a recipient of the electronic message.

15. The computing device of claim 11, wherein the messaging application is further configured to:

adjust the weighted scores over time based on at least one of;

accumulated data and statistics associated with the one or more factors.

16. The computing device of claim 15, wherein the messaging application is further configured to:

employ a machine-learning algorithm to adjust the weighted scores.

17. A method executed on a computing device for filtering an electronic message based on domain attributes, the method comprising:

receiving the electronic message with a uniform resource identifier (URI);

retrieving a trusted list and a block list from one of;

a local resource and a trusted external resource;

determining that the URI is not included within at least one of;

the trusted list and the block list, wherein the trusted list provides a list of trusted domains and the block list provides a list of untrusted domains;

indicating a failure to locate a reputation of the URI in one or more of the trusted domains and the untrusted domains;

assigning weighted scores to one or more factors associated with the electronic message;

computing a total score from the weighted scores;

evaluating the electronic message to determine an unsolicited electronic message by comparing the total score against a predetermined threshold; and

adjusting the predetermined threshold and the weighted scores based on at least one of;

a current unsolicited message activity and a recipient of the electronic message.

18. The method of claim 17, further comprising:

confirming a determination of the unsolicited electronic message in response to the total score exceeding the predetermined threshold; and

rejecting the determination of the unsolicited electronic message in response to the total score remaining within the predetermined threshold.

19. The method of claim 18, further comprising:

adjusting the weighted scores over time based on at least one of;

accumulated data and statistics associated with the factors; and

using a machine-learning algorithm to adjust the weighted scores.