Automatic isolation and detection of outbound spam

• US 9,749,271 B2
• Filed: 08/26/2016
• Issued: 08/29/2017
• Est. Priority Date: 07/10/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Yost, David Nicholas, Nikolayev, Alexander
• Primary Examiner(s): GRACIA, GARY S
• Application Number:
  US15/248,037
• Publication Number:
  US 20160366081A1
• Time in Patent Office: 368 Days
• Field of Search: 726 22, 726 23, 726 24, 709206, 709220, 709224, 709225
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5084 Providing for device mobility network addressing or numbering for mobility support in wireless networks H04W8/26; mobile IP H04W80/04
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Embodiments provide IP address partitioning features that can be used to source outbound email communications, but the embodiments are not so limited. In an embodiment, a computer-based method operates to identify and/or isolate one or more customers that may be misusing one or more IP addresses of a partition. A system of an embodiment is configured in part to divide a partition that includes one or more potentially misused IP addresses into one or more levels of sub-partitions as part of identifying offending or potentially offending customers. Other embodiments are included.

Claims

1. A server computer system for configuring datacenter partitions, the server computer system having at least one processing unit and at least one memory storing computer-executable instructions that when executed by the at least one processing unit cause the server computer system to:

configure a partition with a plurality of Internet Protocol (IP) addresses;

host outbound email communications using the partition;

determine that the partition is blocked from hosting outbound email communications when at least one of the plurality of IP addresses is blocked, wherein the at least one IP address is blocked when used to engage in an abusive outbound email practice;

identify the at least one IP address from among the plurality of IP addresses by causing the server computer system to;

divide the partition into a plurality of sub-partitions;

assign one or more of the plurality of IP addresses to each of the plurality of sub-partitions;

monitor the plurality of sub-partitions to detect when a sub-partition is blocked from hosting outbound email communications;

divide each blocked sub-partition until a single IP address is associated with the blocked sub-partition;

identify the single IP address as the at least one IP address used to engage in an abusive outbound email practice;

and remove the single IP address from use in hosting outbound email communications.

2. The server computer system of claim 1, the computer-executable instructions further causing the server computer system to:

recombine any unblocked sub-partitions into a new partition for hosting outbound email communications, the new partition configured with IP addresses from the unblocked sub-partitions.

3. The server computer system of claim 2, the computer-executable instructions further causing the server computer system to assign new IP addresses to the new partition.

4. The server computer system of claim 1, the computer-executable instructions further causing the server computer system to receive IP address reputation information from a reputation component as part of determining a blocked status of a partition or a sub-partition.

5. The server computer system of claim 1, the computer-executable instructions further causing the server computer system to automatically identify the at least one IP address in response to determining that the partition is blocked.

6. The server computer system of claim 1, the computer-executable instructions further causing the server computer system to identify at least one customer associated with the at least one IP address.

7. The server computer system of claim 1, the computer-executable instructions further causing the server computer system to generate rules that randomly assign one or more customers associated with one or more of the plurality of IP addresses to each of the plurality of sub-partitions to identify spamming customers.

8. The server computer system of claim 2, the computer-executable instructions further causing the server computer system to monitor the new partition to determine whether the new partition is blocked.

9. The server computer system of claim 1, the computer-executable instructions further causing the server computer system to receive reputation information associated with each IP address to identify spamming customers.

10. A method implemented over a communications network by a computer system having a processing unit and a memory, the method comprising:

configuring a partition with a plurality of Internet Protocol (IP) addresses;

hosting outbound email communications using the partition;

determining that the partition is blocked from hosting outbound email communications when at least one of the plurality of IP addresses is blocked, wherein the at least one IP address is blocked when used to engage in an abusive outbound email practice;

identifying the at least one IP address from among the plurality of IP addresses by;

dividing the partition into a plurality of sub-partitions;

assigning one or more of the plurality of IP addresses to each of the plurality of sub-partitions;

monitoring the plurality of sub-partitions to detect when a sub-partition is blocked from hosting outbound email communications;

dividing each blocked sub-partition until a single IP address is associated with each blocked sub-partition;

identifying the single IP address as the at least one IP address used to engage in an abusive outbound email practice;

and removing the at least one IP address from the partition.

11. The method of claim 10, further comprising recombining unblocked sub-partitions into a new partition for hosting outbound email communications, the new partition configured with IP addresses from the unblocked sub-partitions.

12. The method of claim 11, further comprising assigning new IP addresses to the new partition.

13. The method of claim 10, further comprising monitoring the plurality of sub-partitions for a designated amount of time to identify customer spamming.

14. The method of claim 10, further comprising automatically identifying the at least one IP address in response to determining that the partition is blocked.

15. The method of claim 10, further comprising identifying at least one customer associated with the at least one IP address.

16. The method of claim 10, further comprising generating rules that randomly assign one or more customers associated with one or more of the plurality of IP addresses to each of the plurality of sub-partitions to identify spamming customers.

17. A non-transitory computer storage device which stores computer-executable instructions that, when executed by a processing unit, operate to:

configure a partition with a plurality of Internet Protocol (IP) addresses;

host outbound email communications using the partition;

determine that the partition is blocked from hosting outbound email communications when at least one of the plurality of IP addresses is blocked, wherein the at least one IP address is blocked when used to engage in an abusive outbound email practice;

identify the at least one IP address from among the plurality of IP addresses by causing the server computer system to;

divide the partition into a plurality of sub-partitions;

assign one or more of the plurality of IP addresses to each of the plurality of sub-partitions;

monitor the plurality of sub-partitions to detect when a sub-partition is blocked from hosting outbound email communications;

divide each blocked sub-partition until a single IP address is associated with each blocked sub-partition;

identify the single IP address as the at least one IP address used to engage in an abusive outbound email practice; and

remove the at least one IP address from the partition.

18. The non-transitory computer storage device of claim 17, the computer-executable instructions further operative to identify at least one customer associated with the at least one IP address.

19. The non-transitory computer storage device of claim 17, the computer-executable instructions further operative to generate rules that randomly assign one or more customers associated with one or more of the plurality of IP addresses to each of the plurality of sub-partitions to identify spamming customers.