Method and system for filtering communication

• US 20020199095A1
• Filed: 05/22/2002
• Published: 12/26/2002
• Est. Priority Date: 07/24/1997
• Status: Active Grant

• Current Assignee: Mailgate, LLC
• Original Assignee: Tumbleweed Communications Corporation (Axway Software SA)
• Inventors: Dolinsky, Dmitry, Bandini, Jean-Christophe, Odnert, Daryl
• Granted Patent: US 7,117,358 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload

Abstract

A e-mail relay provides message filtering services to an e-mail network. The e-mail relay monitors incoming communication and intercepts e-mail messages. The e-mail relay compares attributes of the messages to data derived from SPAM messages, which is stored in a SPAM database. The e-mail relay restricts the delivery of message based on the comparison such as by restricting the delivery of messages having attributes close to those of SPAM messages from the SPAM database. The SPAM database is constructed by responding to user or administrator indications as to whether received messages are SPAM messages.

Claims

1. A method for controlling reception of messages from unknown entities in an e-mail network, each message is associated with a message source, comprising:

providing a e-mail relay, the e-mail relay interposed along a message communication path associated with a public network and an e-mail server of the e-mail network;

the e-mail relay receiving a message intended for a recipient associated with the e-mail network;

the e-mail relay comparing the message data to message data in a SPAM database;

the e-mail relay executing at least one predetermined action in response to determining that the message is SPAM; and

the e-mail relay allowing the message to proceed to at least one recipient in response to determining that the message is not SPAM.

2. The method of claim 1, wherein the e-mail message protocol is SMTP.

3. The method of claim 1, wherein the public network is the Internet.

4. The method of claim 1, wherein said at least one predetermined action comprises adding said message data to the SPAM database.

5. The method of claim 1, wherein said comparing the message to message data in a known SPAM database comprises:

identifying a comparison for evaluating by reference to the message;

identifying at least one evaluation associated with the comparison;

for each evaluation associated with the comparison;

extracting data from the message in accordance with parameters associated with the identified evaluation;

executing the evaluation for the extracted data by comparing the extracted data to data from the SPAM database;

determining a new comparison score based on the executed evaluation; and

determining that the message is SPAM if the comparison score is beyond a threshold.

6. The method of claim 5, wherein the threshold is a threshold range.

7. The method of claim 5, wherein said at least one evaluation comprises comparing the sender address of the message to a sender address of records in the SPAM database.

8. The method of claim 5, wherein said at least one evaluation comprises comparing an unknown recipient of the message to unknown recipient address of records in the SPAM database.

9. The method of claim 5, wherein said at least one evaluation comprises comparing a recipient list of the message with a recipient lists of records in the SPAM database.

10. The method of claim 5, wherein said at least one evaluation comprises comparing content from a portion of the subject field of the message header with the content of the subject field of records in the SPAM database.

11. The method of claim 5, wherein said at least one evaluation comprises generating a hash value based on the message body and further comparing the generated hash value to a hash value of records in the SPAM database.

12. The method of claim 5, wherein said at least one evaluation comprises comparing a portion of the message body text to message body text of records in the SPAM database.

13. The method of claim 5, wherein said at least one evaluation comprises comparing URLs embedded in the message to URLs of records in the SPAM database.

14. The method of claim 5, wherein said at least one evaluation comprises comparing the IP domain of the sending relay associated with the message to IP domain of the sending relay of records in the SPAM database.

15. The method of claim 5, wherein said at least one evaluation comprises storing in the SPAM database the number of times a SPAM message was received by the e-mail relay.

16. The method of claim 6, wherein a comparison score within the threshold range results in a “

borderline”

determination, indicating that it is not certain that the message is SPAM.

17. The method of claim 16, further wherein the e-mail relay quarantines a message in response to a borderline determination.

18. The method of claim 17, wherein an administrator associated with the e-mail relay reviews quarantined messages for classifying messages as SPAM or “

clean.”

19. The method of claim 17, wherein the intended recipient of the message is notified by the e-mail relay that a message has been quarantined and further wherein the e-mail relay receives data from the intended recipient to indicate whether the message is SPAM.

20. The method of claim 6, wherein a comparison score over the threshold range results in a “

SPAM”

determination, indicating that the message is likely SPAM.

21. The method of claim 6, wherein a comparison score below the threshold range results in a “

Clean”

determination, indicating that the message is likely not SPAM.

22. The method of claim 21, wherein the e-mail relay forward the message to an e-mail server in response to the “

clean”

determination.

23. The method of claim 1, wherein the database storing unwanted message is a local database of SPAM message data maintained by the e-mail relay.

24. The method of claim 1, wherein the database storing unwanted message is a central database, which is shared between a plurality of e-mail relay systems.

25. The method of claim 1, wherein the e-mail relay shares SPAM data from the SPAM database with at least one other e-mail relay associated with a second SPAM database.

26. The method of claim 1, wherein the SPAM database is accumulated by recipients of the e-mail network forwarding unwanted messages to at least one e-mail address associated with the e-mail relay.

27. The method of claim 1, wherein the SPAM database is accumulated by an administrator reviewing quarantined messages and determining that a message is SPAM.

28. The method of claim 1, wherein unwanted messages are collected by recipients replying to unwanted messages and including a special code word within the reply.

29. The method of claim 1, wherein unwanted messages are provided to the database by the e-mail relay adding a reply URL to each message forwarded to the e-mail network, the reply URL designed for a reporting message to the database as an unwanted message.

30. The method of claim 1, wherein said characteristics are selected from the group comprising message content, sender, subject, embedded URLs, Internet domain of the sending relay and IP address of the sending relay.

31. A method for filtering unwanted messages to an e-mail network associated with an e-mail relay, comprising:

providing a database storing a plurality of unwanted messages;

providing an e-mail relay interposed along the communication path between the e-mail network and a public network;

the e-mail relay intercepting a message from the public network to the e-mail network;

the e-mail relay comparing attributes of the intercepted message to attributes of unwanted messages stored in the database to determine whether the intercepted message is an unwanted message; and

the e-mail relay blocking message transmission to the e-mail network in response to determining that the intercepted message is an unwanted message.

32. A method for controlling the delivery of unwanted messages to local recipients associated with an e-mail relay, comprising:

identifying a message from a public network to the e-mail relay as possibly an unwanted message;

transmitting a notification message to an intended recipient of the message, the notification including a URL identifying the message and recipient;

receiving the URL in accordance with an HTTP protocol;

providing information about the message to the recipient in accordance with the HTTP protocol; and

receiving an indication from the recipient according to the HTTP protocol as to whether to proceed with message delivery.

33. The method of claim 32, wherein blocking message transmission comprises storing the message in a quarantine location for review by a system administrator.

34. The method of claim 32, wherein the database of unwanted messages cooperates with other databases of unwanted messages in a peer-to-peer configuration.

35. The method of claim 32, wherein the database is a centralized SPAM database shared by a plurality of e-mail relays.

37. The system of claim 36, wherein the e-mail message protocol is SMTP.

38. The system of claim 36, wherein the public network is the Internet.

39. The system of claim 36, wherein said at least one predetermined action comprises adding said message data to the SPAM database.

40. The system of claim 36, wherein the threshold is a threshold range.

41. The system of claim 36, wherein said at least one evaluation comprises comparing the sender address of the message to a sender address of records in the SPAM database.

42. The system of claim 36, wherein said at least one evaluation comprises comparing an unknown recipient of the message to unknown recipient address of records in the SPAM database.

43. The system of claim 36, wherein said at least one evaluation comprises comparing a recipient list of the message with a recipient lists of records in the SPAM database.

44. The system of claim 36, wherein said at least one evaluation comprises comparing content from a portion of the subject field of the message header with the content of the subject field of records in the SPAM database.

45. The system of claim 36, wherein said at least one evaluation comprises generating a hash value based on the message body and further comparing the generated hash value to a hash value of records in the SPAM database.

46. The system of claim 36, wherein said at least one evaluation comprises comparing a portion of the message body text to message body text of records in the SPAM database.

47. The system of claim 36, wherein said at least one evaluation comprises comparing URLs embedded in the message to URLs of records in the SPAM database.

48. The system of claim 36, wherein said at least one evaluation comprises comparing the IP domain of the sending relay associated with the message to IP domain of the sending relay of records in the SPAM database.

49. The system of claim 36, wherein said at least one evaluation comprises storing in the SPAM database the number of times a SPAM message was received by the e-mail relay.

50. The system of claim 40, wherein a comparison score within the threshold range results in a “

borderline”

determination, indicating that it is not certain that the message is SPAM.

51. The system of claim 50, further wherein the e-mail relay quarantines a message in response to a borderline determination.

52. The system of claim 51, wherein an administrator associated with the e-mail relay reviews quarantined messages for classifying messages as SPAM or “

clean.”

53. The system of claim 51, wherein the intended recipient of the message is notified by the e-mail relay that a message has been quarantined and further wherein the e-mail relay receives data from the intended recipient to indicate whether the message is SPAM.

54. The system of claim 40, wherein a comparison score over the threshold range results in a “

SPAM”

determination, indicating that the message is likely SPAM.

55. The system of claim 40, wherein a comparison score below the threshold range results in a “

Clean”

determination, indicating that the message is likely not SPAM.

56. The system of claim 55, wherein the e-mail relay forward the message to an e-mail server in response to the “

clean”

determination.

57. The system of claim 36, wherein the database storing unwanted message is a local database of SPAM message data maintained by the e-mail relay.

58. The system of claim 36, wherein the database storing unwanted message is a central database, which is shared between a plurality of e-mail relay systems.

59. The system of claim 36, wherein the e-mail relay shares SPAM data from the SPAM database with at least one other e-mail relay associated with a second SPAM database.

60. The system of claim 36, wherein the SPAM database is accumulated by recipients of the e-mail network forwarding unwanted messages to at least one e-mail address associated with the e-mail relay.

61. The system of claim 36, wherein the SPAM database is accumulated by an administrator reviewing quarantined messages and determining that a message is SPAM.

62. The system of claim 36, wherein SPAM messages are collected by recipients replying to unwanted messages and including a special code word within the reply.

63. The system of claim 36, wherein SPAM messages are provided to the database by the e-mail relay adding a reply URL to each message forwarded to the e-mail network, the reply URL designed for a reporting message to the database as an unwanted message. The system of claim 36, wherein message attributes are selected from the group comprising message content, sender, subject, embedded URLs, Internet domain of the sending relay and IP address of the sending relay.

36. A system for controlling the reception of SPAM messages by resources associated with a local network, comprising:

an e-mail relay interposed along the communication path between the resources and a public network, the e-mail relay intercepting messages transmitted between the resources and the public network; and

a SPAM database storing data associated with known SPAM messages, the e-mail relay employing the SPAM database to compare attributed of intercepted messages to attributes of known SPAM messages stored in the SPAM database, the e-mail relay comparing the message to message data from the SPAM database by performing at least one evaluation related to attributes of the intercepted message, the e-mail relay executing at least one predetermined action if matching between the message attributes and attributes from records in the SPAM database exceed a threshold.

64. A system for controlling the reception of SPAM messages by resources associated with a local network, comprising:

relay means interposed along the communication path between the resources and a public network, the relay means intercepting messages transmitted between the resources and the public network; and

storage means for storing data associated with known SPAM messages, the relay means employing the storage means to compare attributed of intercepted messages to attributes of known SPAM messages stored in the storage means, the relay means restricting the delivery of an intercepted message if a match score, based on comparison of message attributes and attributes of SPAM messages in the storage means, exceeds a threshold level.