Automatic isolation and detection of outbound spam

• US 9,455,989 B2
• Filed: 07/10/2013
• Issued: 09/27/2016
• Est. Priority Date: 07/10/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Yost, David Nicholas, Nikolayev, Alexander
• Primary Examiner(s): Edwards, Linglan
• Assistant Examiner(s): GRACIA, GARY S
• Application Number:
  US13/938,916
• Publication Number:
  US 20150020193A1
• Time in Patent Office: 1,175 Days
• Field of Search: 726/22
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5084 Providing for device mobility network addressing or numbering for mobility support in wireless networks H04W8/26; mobile IP H04W80/04
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Embodiments provide IP address partitioning features that can be used to source outbound email communications, but the embodiments are not so limited. In an embodiment, a computer-based method operates to identify and/or isolate one or more customers that may be misusing one or more IP addresses of a partition. A system of an embodiment is configured in part to divide a partition that includes one or more potentially misused IP addresses into one or more levels of sub-partitions as part of identifying offending or potentially offending customers. Other embodiments are included.

Claims

1. A server computer system having at least one processing unit and at least one memory storing computer-executable instructions that when executed by the at least one processing unit cause the server computer system to:

configure, over a communications network, a partition associated with a plurality of Internet Protocol (IP) addresses;

host outbound email communications for a plurality of customers using the partition, wherein each customer is associated with at least one of the plurality of IP addresses;

determine that the partition is blocked from hosting outbound email communications when at least one of the plurality of IP addresses is blocked, wherein the at least one IP address is blocked when a customer associated with the at least one IP address has engaged in an abusive outbound email practice;

in response to determining that the partition is blocked from hosting outbound email communications, generate rules to;

divide the partition into a plurality of sub-partitions;

assign one or more of the plurality of IP addresses to each of the plurality of sub-partitions;

host outbound email communications using each of the plurality of sub-partitions;

monitor the plurality of sub-partitions to detect when a sub-partition is blocked from hosting outbound email communications;

continue to divide any blocked sub-partition at least a single customer exists in a blocked sub-partition; and

recombine any unblocked sub-partitions into a new partition and reputable IP addresses from other unblocked partitions for hosting outbound email communications.

2. The server computer system of claim 1, wherein the server computer system is further configured to assign new IP addresses for the new partition.

3. The server computer system of claim 1, wherein the server computer system is further configured to receive IP address reputation information from a reputation component as part of determining a blocked status of a partition or a sub-partition.

4. The server computer system of claim 1, wherein the server computer system is further configured to monitor reputations of blocked sub-partitions for a designated amount of time before allowing outbound email communications from the blocked sub-partitions.

5. The server computer system of claim 1, wherein the server computer system is further configured to automatically mitigate outbound customer email from being blocked.

6. The server computer system of claim 1, wherein the server computer system is further configured to generate rules that assign known reputable IP addresses from one or more different partitions for each of the plurality of sub-partitions.

7. The server computer system of claim 1, wherein the server computer system is further configured to generate rules that randomly assign one or more customers associated with the partition to each of the plurality of sub-partitions as part of isolating spamming customers.

8. The server computer system of claim 1, wherein the server computer system is further configured to monitor the new partition to determine whether the new partition is blocked.

9. The server computer system of claim 1, wherein the server computer system is further configured to receive reputation information associated with each IP address as part of identifying spamming customers.

10. The server computer system of claim 1, wherein the server computer system is further configured to isolate spamming customers to prevent hosting of outbound email from the spamming customers.

11. A method implemented over a communications network by a computer system having a processing unit and a memory, the method comprising:

configuring, over the communications network, a partition that includes a plurality of IP addresses;

hosting outbound email communications for a group of customers using the partition, wherein each customer is associated with at least one of the plurality of IP addresses;

determining, by the processing unit, whether the partition is blocked from hosting outbound email communications, wherein the partition is blocked when a customer associated with the partition has engaged in an abusive outbound email practice;

in response to determining that the partition is blocked from hosting outbound email communications;

dividing the blocked partition into a plurality of sub-partitions;

randomly assigning one or more customers of the group of customers to each sub-partition;

sourcing reputable IP addresses to each of the plurality of sub-partitions;

hosting outbound email communications using each of the plurality of sub-partitions;

detecting when a sub-partition is blocked from hosting outbound email communications;

continue dividing any blocked sub-partition at least a single customer exists in a blocked sub-partition; and

recombining any unblocked sub-partitions.

12. The method of claim 11, further comprising recombining unblocked sub-partitions into a new partition and sourcing reputable IP addresses from other unblocked partitions.

13. The method of claim 11, further comprising monitoring the plurality of sub-partitions for a designated amount of time to identify customer spamming.

14. The method of claim 11, further comprising:

in response to determining that one or more first sub-partitions are blocked from hosting outbound email communications for more than one customer of the group of customers;

dividing each of the first sub-partitions that are blocked into a plurality of second sub-partitions;

assigning one or more customers of the group of customers in each of the second sub-partitions;

assigning an unblocked IP address to each of the plurality of second sub-partitions;

hosting outbound email communications using each of the plurality of second sub-partitions;

monitoring the plurality of second sub-partitions to identify whether one or more of the second sub-partitions are blocked from hosting outbound email communications; and

identifying at least one customer assigned to at least one of the second sub-partitions that is being blocked from hosting outbound email communications.

15. The method of claim 11, further comprising contacting a spamming customer to inform of a blocked status.

16. The method of claim 11, further comprising allowing one or more customers not identified as spammers to send outbound email communications.

17. A non-transitory computer storage device which stores executable instructions that, when executed by a processing unit, operate to:

configure, over a communications network, a partition associated with a plurality of Internet Protocol (IP) addresses;

host outbound email communications for a plurality of customers using the partition, wherein each customer is associated with at least one of the plurality of IP addresses;

determine that the partition is blocked from hosting outbound email communications, wherein the partition is blocked when a customer associated with the partition has engaged in an abusive outbound email practice;

divide the blocked partition into a plurality of first sub-partitions;

assign at least one reputable IP address to each of the plurality of first sub-partitions;

host outbound email communications using each of the plurality of first sub-partitions;

monitor a status of each of the plurality of first sub-partitions to identify whether a first sub-partition is blocked from hosting outbound email communications;

in response to identifying a first sub-partition that is blocked and includes more than one customer, then;

divide the first sub-partition that is blocked into a plurality of second sub-partitions;

assign new IP addresses for each of the plurality of second sub-partitions;

host outbound email communications using each of the plurality of second sub-partitions;

monitor a status of each of the plurality of second sub-partitions to identify whether a second sub-partition is blocked from hosting outbound email communications;

in response to identifying a blocked second sub-partition that includes one customer, identify the one customer as a spamming source; and

resolve the blocked partition by recombining unblocked ones of the first and second sub-partitions into a new partition.

18. The non-transitory computer storage device of claim 17, wherein the instructions operate further to contact a customer of a blocked sub-partition to inform of a spamming issue.

19. The non-transitory computer storage device of claim 17, wherein the instructions operate further to automatically mitigate outbound customer email from being blocked.

20. The non-transitory computer storage device of claim 17, wherein the instructions operate further to randomly assign one or more customers associated with the partition to each of the plurality of sub-partitions as part of isolating spamming customers while reducing disruption of other customer email.