Method and system for handling unwanted email messages

• US 9,419,927 B2
• Filed: 08/27/2013
• Issued: 08/16/2016
• Est. Priority Date: 11/14/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Shinde, Rajesh, Awasthi, Harish Mohan
• Primary Examiner(s): Miah, Razu A
• Application Number:
  US14/010,527
• Publication Number:
  US 20130346528A1
• Time in Patent Office: 1,085 Days
• Field of Search: 709204-207
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method, system, and computer program product for scanning incoming emails reduces the server resources needed, which improves server throughput and reduces costs. A method for processing incoming email messages comprised the steps of scanning incoming email messages to obtain an address of a sender of each incoming email message and to determine whether the email message is spam, for each email message that is determined to be spam, incrementing a count of email messages that are spam for a sender of the email message, determining that a count of email messages that are spam for a sender of an email message has exceeded a threshold, and thereafter, discarding all incoming email messages from the sender for which the count of email messages that are spam for a sender of an email message has exceeded a threshold without scanning the email messages to determine whether they are spam.

Claims

1. A method, comprising:

scanning, in response to a determination that a first time period has ended, email messages from an email address of a sender previously identified as a source of spam;

placing the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender, the placing performed in response to a determination that a count of the email messages that are clean has exceeded a threshold over a second time period, the second time period similar or less than the first time period; and

placing the email address of the sender in a spammers list in response to a determination that a count of the email messages that are spam has exceeded a threshold over a third time period greater than the second time period, wherein the spammers list is replicated to another server.

2. The method of claim 1, further comprising:

scanning the email messages to identify patterns in headers of the email messages.

3. The method of claim 1, wherein the scanning further comprises:

scanning a first name and a last name of the sender.

4. The method of claim 1, further comprising:

counting spam and clean characteristics of the email messages; and

storing results of the counting in a security database.

5. The method of claim 4, wherein the security database includes a selected one or more of a group of columns, the group consisting of:

a) an email address column;

b) a count of email messages marked spam column;

c) a count of email messages quarantined column; and

d) a count of clean email messages column.

6. The method of claim 4, wherein the security database is accessed by an email server using the email address of the sender.

7. The method of claim 5, wherein the columns in the database are incremented based on results associated with scanning the email messages.

8. A method, comprising:

scanning email messages from an email address of a sender previously identified as a source of spam;

determining that a count of the email messages that are clean has exceeded a threshold over a predefined time period;

placing the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender;

obtaining respective email addresses for each of a plurality of email messages;

evaluating a spam list and the clean list of a database to determine whether the respective email addresses are present in either of the lists;

discarding a first group of the plurality of email messages based on the first group having corresponding email addresses that are present on the spam list; and

delivering a second group of the plurality of email messages based on the second group having corresponding email addresses that are present on the clean list.

9. One or more non-transitory, computer-readable storage media storing instructions that, when executed, cause a computing device to perform a method, the method comprising:

scanning, in response to a determination that a first time period has ended, email messages from an email address of a sender previously identified as a source of spam;

placing the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender, the placing performed in response to a determination that a count of the email messages that are clean has exceeded a threshold over a second time period, the second time period similar or less than the first time period; and

placing the email address of the sender in a spammers list in response to a determination that a count of the email messages that are spam has exceeded a threshold over a third time period greater than the second time period, wherein the spammers list is replicated to another server.

10. The one or more computer-readable storage media of claim 9, the method further comprising:

scanning the email messages to identify patterns in headers of the email messages.

11. The one or more computer-readable storage media of claim 9, the method further comprising:

scanning a first name and a last name of the sender.

12. The one or more computer-readable storage media of claim 9, the method further comprising:

counting spam and clean characteristics of the email messages; and

storing results of the counting in a security database.

13. The one or more computer-readable storage media of claim 12, wherein the security database includes a selected one or more of a group of columns, the group consisting of:

a) an email address column;

b) a count of email messages marked spam column;

c) a count of email messages quarantined column; and

d) a count of clean email messages column.

14. The one or more computer-readable storage media of claim 12, wherein the security database is accessed by an email server using the email address of the sender.

15. The one or more computer-readable storage media of claim 13, wherein the columns in the security database are incremented based on results associated with scanning the email messages.

16. One or more non-transitory, computer-readable storage media storing instructions that, when executed, cause a computing device to perform a method, the method comprising:

scanning email messages from an email address of a sender previously identified as a source of spam;

determining that a count of the email messages that are clean has exceeded a threshold over a predefined time period;

placing the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender;

obtaining respective email addresses for each of a plurality of email messages;

evaluating a spam list and the clean list of a database to determine whether the respective email addresses are present in either of the lists;

discarding a first group of the plurality of email messages based on the first group having corresponding email addresses that are present on the spam list; and

delivering a second group of the plurality of email messages based on the second group having corresponding email addresses that are present on the clean list.

17. A server, comprising:

a processor; and

a memory coupled to the processor, wherein the server is configured to

perform a scanning, in response to a determination that a first time period has ended, email messages from an email address of a sender previously identified as a source of spam;

place the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender, the email address placed in the clean list in response to a determination that a count of the email messages that are clean has exceeded a threshold over a second time period, the second time period similar or less than the first time period; and

place the email address of the sender in a spammers list in response to a determination that a count of the email messages that are spam has exceeded a threshold over a third time period greater than the second time period, wherein the spammers list is replicated to another server.

18. The server of claim 17, wherein the server is further configured to scan the email messages to identify patterns in headers of the email messages.

19. The server of claim 17, wherein the scanning further comprises:

scanning a first name and a last name of the sender.

20. The server of claim 17, wherein the server is further configured to perform a counting of spam and clean characteristics of the email messages and to store results of the counting in a security database.

21. The server of claim 20, wherein the security database includes a selected one or more of a group of columns, the group consisting of:

a) an email address column;

b) a count of email messages marked spam column;

c) a count of email messages quarantined column; and

d) a count of clean email messages column.

22. The server of claim 20, wherein the security database is accessed by the server using the email address of the sender.

23. The server of claim 21, wherein the columns in the security database are incremented based on results associated with scanning the email messages.

24. A server, comprising:

a processor; and

a memory coupled to the processor, wherein the server is configured to

scan email messages from an email address of a sender previously identified as a source of spam;

determine that a count of the email messages that are clean has exceeded a threshold over a predefined time period;

place the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender;

obtain respective email addresses for each of a plurality of email messages;

evaluate a spam list and the clean list of a database to determine whether the respective email addresses are present in either of the lists;

discard a first group of the plurality of email messages based on the first group having corresponding email addresses that are present on the spam list; and

deliver a second group of the plurality of email messages based on the second group having corresponding email addresses that are present on the clean list.