Method and apparatus for electronic mail filtering

• US 9,473,439 B2
• Filed: 08/01/2014
• Issued: 10/18/2016
• Est. Priority Date: 05/18/2007
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint Uk Limited (Forcepoint LLC)
• Inventors: Kay, James
• Primary Examiner(s): BOUTAH, ALINA A
• Application Number:
  US14/450,155
• Publication Number:
  US 20140337452A1
• Time in Patent Office: 809 Days
• Field of Search: 709/224, 709206-207, 726/22, 707/999.009, 707/999.09
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 51/226 Delivery according to priorities
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes

Abstract

Messages having a reputation score higher than at least one message already on a queue are added to the queue when the queue has already reached the predetermined maximum permitted size. One or more messages having a low reputation score may be discarded from a bottom of the queue in favor of a new incoming message having a higher reputation score. This may be particularly useful in the context of Internet e-mail, wherein mail delivery protocols (i.e. SMTP) allow a connection for an incoming message to be held open for a limited time period and during this period the message processing apparatus does not assume responsibility for onward transmission of the message. Thus, the message processing apparatus is able to selectively accept only those messages having a highest reputation score for detailed analysis, without adversely affecting the operations performed by other parts of the electronic messaging system.

Claims

1. A message processing apparatus comprising:

an electronic hardware processor;

a memory storing instructions that configure the electronic hardware processor to perform a method of processing messages on communication paths between a plurality of client devices and a server device, the method comprising;

receiving, in a particular order, a corresponding plurality of incoming messages from the plurality of client devices over network connections between the apparatus and the plurality of client devices and determining a corresponding plurality of client identities associated with the plurality of client devices,

allocating a reputation score to each of the incoming messages according to the client identity associated with a client device from which the incoming message is received,

storing the plurality of incoming messages in a message queue ordered according to a reputation score allocated to each of the incoming messages,

extracting the plurality of messages from the message queue in an order according to their allocated reputation scores that is different than the particular order, and

transmitting the extracted messages to the server device in the order the messages are extracted from the message queue.

2. The message processing apparatus of claim 1, wherein the method further comprises:

storing a plurality of reputation scores, each associated with one of the plurality of client identities; and

allocating the reputation scores to the plurality of incoming messages according to the stored reputation scores and with respect to the determined client identities.

3. The message processing apparatus of claim 2, wherein the method further comprises updating one or more of the plurality of stored reputation scores.

4. The message processing apparatus of claim 1, wherein the method further comprises determining an updated reputation score associated with a particular client identity according to statistics derived from a history of previous messages from the particular client identity.

5. The message processing apparatus of claim 4, wherein the method further comprises determining the updated reputation score for a particular client identity according to a proportion of wanted messages as determined by one or more filtering functions with respect to a total number of messages from the particular client identity.

6. The message processing apparatus of claim 5, wherein the method further comprises determining the updated reputation score according to a volume of traffic received from a particular client identity, a rate at which the traffic is received, and a percentage of the traffic which is determined to be unwanted messages.

7. The message processing apparatus of claim 3, wherein the method further comprises updating the stored reputation scores with reference to an external source.

8. The message processing apparatus of claim 7, wherein the external source is another message processing apparatus.

9. The message processing apparatus of claim 1, wherein the method further comprises holding open the network connection to the client device while the message'"'"'s reputation score is allocated and the message is on the message queue;

and closing the network connection in response to the message being removed from the queue.

10. The message processing apparatus of claim 1, wherein an electronic processor is arranged to determine the client identities with respect to an IP address of the respective client device.

11. The message processing apparatus of claim 1, wherein the method further comprises monitoring a timing field associated with an incoming message with respect to a permitted total time to live so as to determine the incoming message as a timed-out message when the timing field indicates that the permitted total time to live has expired.

12. The message processing apparatus of claim 11, wherein the method further comprises removing the timed-out message from the message queue when the timing field indicates that the permitted total time to live has expired.

13. The message processing apparatus of claim 12, wherein the method further comprises terminating a connection to a particular client device for the respective incoming message so that a message transaction is not successfully completed in response to the determination that the incoming message is a timed-out message.

14. The message processing apparatus of claim 1, wherein the method further comprises selectively removing one or more incoming messages from the message queue having a low reputation score in favor of a new incoming message having a higher allocated reputation score, while maintaining a predetermined maximum size of the message queue.

15. The message processing apparatus of claim 1, wherein the method further comprises analyzing an extracted message with respect to one or more message filtering functions to determine whether the extracted message is either a wanted message or an unwanted message according to the one or more message filtering functions.

16. A method of processing messages processing messages, comprising:

receiving, via an electronic hardware processor and in a particular order, a plurality of incoming messages over network connections between a server device and a corresponding plurality of client devices;

determining a corresponding plurality of client identities with respect to the plurality of client devices,

allocating a reputation score to each of the incoming messages according to the client identity corresponding to the client device that transmitted the incoming message;

storing the plurality of incoming messages in a message queue ordered according to their allocated reputation score,

extracting, via the electronic hardware processor, the plurality of messages from the message queue in an order according to their allocated reputation scores that is different than the particular order, and

transmitting, via the electronic hardware processor, the extracted messages to the server device in the order the messages are extracted from the message queue.

17. The method of claim 16, further comprising determining an updated reputation score associated with a particular client identity according to statistics derived from a history of previous messages from the particular client identity.

18. The method of claim 17, the method further comprising determining the updated reputation score for a particular client identity according to a proportion of wanted messages as determined by one or more filtering functions with respect to a total number of messages from the particular client identity.

19. The method of claim 18, further comprising determining the updated reputation score according to a volume of traffic received from a particular client identity, a rate at which the traffic is received, and a percentage of the traffic which is determined to be unwanted messages.

20. The method of claim 16, further comprising:

holding open the respective network connection to a particular client device while the respective message'"'"'s reputation score is allocated and the message is on the message queue; and

closing the respective network connection in response to the respective message being removed from the queue.

21. An electronic messaging system, comprising:

a plurality of client devices arranged to send electronic messages wherein each of the client devices is associated with a predetermined client identity in the system;

a plurality of server devices arranged to receive the electronic messages sent by the plurality of client devices;

at least one message processing apparatus arranged to intercept the electronic messages with store-and-forward type interception between the plurality of client and at least one of the plurality of server devices, wherein the message processing apparatus comprises;

an electronic hardware processor, and

an electronic memory storing instructions that configure the processor to perform a method, the method comprising;

receiving one of the electronic messages from a particular client device amongst the plurality of client devices and to determine the client identity with respect to the particular client devices,

allocating a reputation score to the electronic message with respect to the client identity,

storing the electronic message in a message queue containing a plurality of the electronic messages and ordered according to the reputation score allocated to each of the electronic messages,

extracting an electronic message with the highest reputation score in the message queue from the message queue, and

forwarding the extracted electronic message to the at least one of the plurality of server.

22. The electronic messaging system of claim 21, wherein the plurality of client devices include a plurality of sending terminals arranged to originate the electronic messages and a plurality of outgoing message servers arranged to send the electronic messages originating from the plurality of client devices.

23. The electronic messaging system of claim 21, wherein the plurality of server devices include a plurality of receiving message servers arranged to receive one or more of the electronic messages according to a recipient identity provided for each electronic message, and a plurality of recipient terminals arranged to accept one or more of the electronic messages from one of the receiving message servers according to the recipient identity of each electronic message.