System for determining email spam by delivery path

• US 9,281,962 B2
• Filed: 11/10/2011
• Issued: 03/08/2016
• Est. Priority Date: 06/30/2004
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Golub, Seth
• Primary Examiner(s): Nguyen, Quang N
• Application Number:
  US13/294,165
• Publication Number:
  US 20120059893A1
• Time in Patent Office: 1,580 Days
• Field of Search: 709/206, 709/207, 709/229, 709/203, 709/204, 709/224, 709/225, 709/232, 709/239
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages

Abstract

A spam detector for determining likelihood of forgery of a source in an email addressed to a destination is provided, comprising extraction means for extracting delivery path information from one or more packets in the packet flow of the email, and comparison means for comparing the extracted delivery path information with trusted delivery path information from the source to the destination.

Claims

1. A method for determining email spam, comprising:

determining that an email addressed to a user is from a sender on a whitelist of senders associated with the user;

upon determining that the email is from a sender on the whitelist of senders, obtaining a delivery path of the email including a plurality of delivery path nodes;

matching the plurality of delivery path nodes of the email with a plurality of delivery path nodes of a trusted delivery path for the sender; and

upon determining that the plurality of delivery path nodes of the email match the plurality of delivery path nodes of the trusted delivery path for the sender, marking the email as a trusted message.

2. The method of claim 1, wherein the email is marked as a trusted message only when all of the delivery path nodes of the email match delivery path nodes of the trusted delivery path for the sender.

3. The method of claim 1, including performing further spam checks on the email when less than all of the delivery path nodes of the email match delivery path nodes of the trusted delivery path for the sender.

4. The method of claim 3, wherein performing further spam checks includes, upon determining that some of the delivery path nodes of the email do not match delivery path nodes of the trusted delivery path for the sender, marking the email as potential spam.

5. The method of claim 1, further comprising marking the trusted message as a message to be opened.

6. The method of claim 1, further comprising sending the trusted message to the user.

7. The method of claim 1, wherein the method is performed at a server.

8. The method of claim 1, wherein the method is performed at a workstation associated with the user.

9. A non-transitory computer readable storage medium storing one or more programs configured for execution by a computer, the one or more programs comprising instructions for:

determining that an email addressed to a user is from a sender on a whitelist of senders associated with the user;

upon determining that the email is from a sender on the whitelist of senders, obtaining a delivery path of the email including a plurality of delivery path nodes;

matching the plurality of delivery path nodes of the email with a plurality of delivery path nodes of a trusted delivery path for the sender; and

upon determining that the plurality of delivery path nodes of the email match the plurality of delivery path nodes of the trusted delivery path for the sender, marking the email as a trusted message.

10. The non-transitory computer readable storage medium of claim 9, wherein the email is marked as a trusted message only when all of the delivery path nodes of the email match delivery path nodes of the trusted delivery path for the sender.

11. The non-transitory computer readable storage medium of claim 9, further comprising instructions for:

performing further spam checks on the email when less than all of the delivery path nodes of the email match delivery path nodes of the trusted delivery path for the sender.

12. The non-transitory computer readable storage medium of claim 11, wherein instructions for performing further spam checks include, upon determining that some of the delivery path nodes of the email do not match delivery path nodes of the trusted delivery path for the sender, instructions for marking the email as spam.

13. The non-transitory computer readable storage medium of claim 9, further comprising instructions for:

marking the trusted message as a message to be opened.

14. The non-transitory computer readable storage medium of claim 9, further comprising instructions for:

sending the trusted message to the user.

15. A system, for determining email spam, comprising:

one or more central processing units for executing programs;

memory storing one or more programs be executed by the one or more central processing units;

the one or more programs comprising instructions for;

determining that an email addressed to a user is from a sender on a whitelist of senders associated with the user;

upon determining that the email is from a sender on the whitelist of senders, obtaining a delivery path of the email including a plurality of delivery path nodes;

matching the plurality of delivery path nodes of the email with a plurality of delivery path nodes of a trusted delivery path for the sender; and

upon determining that the plurality of delivery path nodes of the email match the plurality of delivery path nodes of the trusted delivery path for the sender, marking the email as a trusted message.

16. The system of claim 15, wherein the email is marked as a trusted message only when all of the delivery path nodes of the email match delivery path nodes of the trusted delivery path for the sender.

17. The system of claim 15, further comprising instructions for:

performing further spam checks on the email when less than all of the delivery path nodes of the email match delivery path nodes of the trusted delivery path for the sender.

18. The system of claim 17, wherein instructions for performing further spam checks include, upon determining that some of the delivery path nodes of the email do not match delivery path nodes of the trusted delivery path for the sender, instructions for marking the email as spam.

19. The system of claim 15, further comprising instructions for:

marking the trusted message as a message to be opened.

20. The system of claim 15, further comprising instructions for:

sending the trusted message to the user.

21. The system of claim 15, wherein the system is a server system.

22. The system of claim 15, wherein the system includes a workstation associated with the user.