Filtering electronic messages based on domain attributes without reputation

• US 9,979,685 B2
• Filed: 11/16/2015
• Issued: 05/22/2018
• Est. Priority Date: 08/19/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Nikolayev, Alexander V., Li, Weisheng, Gandhi, Mauktik
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): BUKHARI, SIBTE H
• Application Number:
  US14/941,975
• Publication Number:
  US 20160072752A1
• Time in Patent Office: 918 Days
• Field of Search: 709206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A messaging application filters electronic messages based on domain attributes without a reputation. A message with a uniform resource identifier (URI) is received and determined to not be included within a trusted or a block list. A total score is computed from weighted scores assigned to factors associated with the message. The message is evaluated for an unsolicited message determination by comparing the total score against a predetermined threshold.

Claims

1. A method executed on a computing device for filtering an electronic message based on domain attributes, the method comprising:

receiving the electronic message with a uniform resource identifier (URI);

determining whether the URI is associated with a reputation;

associating the URI with the reputation when a domain of the URI is located within a list of trusted domains or a list of untrusted domains; and

if the URI lacks an association with the reputation;

assigning weighted scores to one or more factors associated with an attribute and a content of the electronic message, the one or more factors comprising one or more of a message size, a URI count, a number of recipients, a number of recipient domains, a time of arrival, a rate of arrival, or a geo-location of a sender;

computing a total score from the weighted scores;

dynamically adjusting one or more of the weighted scores, the total score, and a predetermined threshold based on accumulated data and statistics associated with the one or more factors; and

evaluating the electronic message to determine whether the electronic message is an unsolicited electronic message by comparing the total score against the predetermined threshold.

2. The method of claim 1, further comprising:

determining the electronic message is an unsolicited electronic message in response to the total score exceeding the predetermined threshold.

3. The method of claim 1, further comprising:

determining the electronic message is not an unsolicited electronic message in response to the total score remaining within the predetermined threshold.

4. The method of claim 1, wherein assigning the weighted scores to the one or more factors associated with the electronic message comprises:

determining the message size of the electronic message; and

assigning a first weighted score to the message size.

5. The method of claim 1, wherein assigning the weighted scores to the one or more factors associated with the electronic message comprises:

incrementing the URI count; and

assigning a second weighted score to the URI count.

6. The method of claim 5, wherein the URI count is a number of URIs without reputations located within the electronic message.

7. The method of claim 1, wherein assigning the weighted scores to the one or more factors associated with the electronic message comprises:

determining a set of electronic messages sent to other recipients within a predefined group having the URI;

computing the number of recipients of the set of electronic messages; and

assigning a third weighted score to the number of recipients.

8. The method of claim 7, further comprising:

computing the number of recipient domains for the set of electronic messages; and

assigning a fourth weighted score to the number of recipient domains.

9. The method of claim 7, further comprising:

computing at least one of;

the time of arrival and the rate of arrival of the set of electronic messages; and

assigning a fifth weighted score to the at least one of;

the time of arrival and the rate of arrival of the set of electronic messages.

10. The method of claim 1, wherein assigning the weighted scores to the one or more factors associated with the electronic message comprises:

determining the geo-location of the sender of the electronic message; and

assigning a sixth weighted score to the geo-location.

11. A computing device for filtering an electronic message based on domain attributes, the computing device comprising:

a memory configured to store instructions; and

a processor coupled to the memory, the processor executing a messaging application in conjunction with the instructions stored in the memory, wherein the messaging application is configured to;

receive the electronic message with a uniform resource identifier (URI) from another computing device;

determine whether the URI is associated with a reputation;

associate the URI with the reputation when a domain of the URI is located within a list of trusted domains or a list of untrusted domains; and

if the URI lacks an associated with the reputation;

assign weighted scores to one or more factors associated with an attribute and a content of the electronic message, the one or more factors comprising one or more of a message size, a URI count, a number of recipients, a number of recipient domains, a time of arrival, a rate of arrival, or a geo-location of a sender;

compute a total score from the weighted scores;

dynamically adjust one or more of the weighted scores, the total score, and a predetermined threshold based on accumulated data and statistics associated with the one or more factors; and

evaluate the electronic message to determine whether the electronic message is an unsolicited electronic message by comparing the total score against the predetermined threshold.

12. The computing device of claim 11, wherein the messaging application is further configured to:

forward the electronic message to another computing device for display in response to a determination that the total score remains within the predetermined threshold and the electronic message is not an unsolicited electronic message.

13. The computing device of claim 11, wherein the messaging application is further configured to:

dynamically adjust the predetermined threshold and the weighted scores based on at least one of;

a current unsolicited message activity and a recipient of the electronic message.

14. A system for filtering an electronic message based on domain attributes, the system comprising:

a communication connection configured to facilitate transmission of the electronic message between one or more servers over a network;

an external message server configured to provide the electronic message with a uniform resource identifier (URI) to a local message server; and

the local message server configured to;

determine whether the URI is associated with a reputation;

associate the URI with the reputation when a domain of the URI is located within a list of trusted domains or a list of untrusted domains; and

if the URI lacks an association with the reputation;

assign weighted scores to one or more factors associated with an attribute and a content of the electronic message, the one or more factors comprising one or more of a message size, a URI count, a number of recipients, a number of recipient domains, a time of arrival, a rate of arrival or a geo-location of a sender;

compute a total score from the weighted scores;

dynamically adjust one or more of the weighted scores, the total score, and a predetermined threshold based on accumulated data and statistics associated with the one or more factors; and

evaluate the electronic message to determine whether the electronic message is an unsolicited electronic message by comparing the total score against the predetermined threshold.

15. The system of claim 14, wherein the local message server is configured to receive the list of trusted domains and the list of untrusted domains from one of a local resource and a trusted external resource.

16. The system of claim 14, wherein at least two of the assigned weighted scores are added to compute the total score.