Method and apparatus for filtering electronic mail

• US 20050041789A1
• Filed: 08/19/2004
• Published: 02/24/2005
• Est. Priority Date: 08/19/2003
• Status: Abandoned Application

• Current Assignee: Sophos Plc (Sophos Group Ltd.)
• Original Assignee: Sophos Plc (Sophos Group Ltd.)
• Inventors: Warren-Smith, Rodney, Szalay, Akos
• Application Number:
  US10/921,605
• Publication Number:
  US 20050041789A1
• Time in Patent Office: Days
• US Class Current: 379/93.240
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

An authorisation server (11) is provided which attempts to classify messages as being wanted or unwanted messages. If a message is classified as an unwanted message it is stored in a black inbox (18) as part of an archive of unwanted messages If a message is classified as a wanted message it is sent to a user'"'"'s grey inbox (19) where the message can be reviewed. For messages whose status as a wanted or unwanted message is unclear the authorisation server (11) delays dispatch of such a message so that the message'"'"'s status can be reassessed using additional information received about similar messages. This further information is received either from honey pot computers (12,13) set up to receive unsolicited messages and also from user rejection of similar messages previously dispatched to users'"'"' grey inboxes (19) during the period of delay.

Claims

1. Apparatus for classifying messages comprising:

a classification store configured to store classification data;

an update module operable to update classification data stored in said classification store;

a data store operable to store data indicative of items of content included in messages; and

a message classifier operable to utilise classification data stored in said classification store to classify messages including items of content identified by data stored in said data store, wherein said message classifier is operable to determine whether a message including items of content identified by data stored in said data store can be classified utilising data currently stored in said classification store and if a message can not be classified utilising the currently stored classification data to reassess the classification of a message including items of content identified by data in said data store after a delay utilising the classification data stored in said classification store after said delay as updated by said update module.

2. Apparatus in accordance with claim 1, wherein said data store is operable to store as data indicative of items of content included in messages, copies of the messages to be classified.

3. Apparatus in accordance with claim 1 wherein said message classifier is operable to assign a default classification to messages which can not be classified utilising classification data stored in said data store as updated by said update module within a preset time period.

4. Apparatus in accordance with claim 1 wherein said message classifier comprises:

a delay determination module operable to determine for a message which can not be classified, a time period for the reassessment of the message on the basis of the speed at which said update module is likely to alter the classification data stored in said data store.

5. Apparatus in accordance with claim 1 wherein said message classifier comprises a delay determination module operable to determine for a message which can not be classified, a time period for the reassessment of the message on the basis of an assessment of the likelihood of the message being a wanted message

6. Apparatus in accordance with claim 5, wherein said delay determination module is operable to determine shorter time periods for the reassessment of messages which are more likely to be wanted messages.

7. Apparatus in accordance with claim 4, wherein said message classifier is operable to reassess the possibility of classifying a message after said time period for the reassessment of a message has passed.

8. Apparatus in accordance with claim 4, wherein said message classifier is operable to reassess the possibility of classifying a message during said time period for the reassessment of a message.

9. Apparatus in accordance with claim 1 wherein said update module is operable to update said classification data periodically.

10. Apparatus in accordance with claim 1, wherein said update module is responsive to storage of data in said data store to cause classification data stored in said classification store to be updated.

11. Apparatus in accordance with claim 1, wherein said update module is operable to receive control signals indicative of user assignment of classification of messages and is responsive to receipt of said signals to utilise the content of said messages to update said classification data stored in said classification store.

12. Apparatus in accordance with claim 1, wherein said update module is operable to receive control signals indicative of receipt of messages by one or more computers and is responsive to receipt of said signals to utilise the content of said received message to update said classification data stored in said classification store.

13. Apparatus in accordance, with claim 1 further comprising:

a challenge generator operable to generate and dispatch messages to senders of messages which can not be classified, wherein said update module is responsive to receipt of a response to a message sent by said challenge generator to update said classification data stored in said data store.

14. Apparatus in accordance with claim 1 further comprising:

a challenge generator operable to generate and dispatch messages to senders of messages which can not be classified, wherein said update module is responsive to the failure to receive a response to a message sent by said challenge generator to update said classification data stored in said data store.

15. Apparatus in accordance with claim 1, wherein said classification store is operable to store classification data comprising data indicative of the frequency with which different items of content appear within messages assigned to different classifications, said message classifier being operable to determine the items of content included in messages which are to be classified and to classify a message based on a determined probability of a message being a message assigned to a classification on the basis of the items of content included in said message and the classification data indicative of the frequency with which said items of content appear within messages assigned to different classifications.

16. Apparatus in accordance with claim 15 wherein said message classifier is operable to classify a message as having a particular classification if the determined probability of the message having said classification exceeds a threshold probability.

17. Apparatus in accordance with claim 15 wherein said update unit is operable to update data indicative of the frequency with which items of content are included in a message assigned to a particular classification when said classification unit determines that a message including said items of content is a message having said particular classification.

18. Apparatus in accordance with claim 17 wherein said classification unit is operable to determine whether a message is a message having a particular classification on the basis of any of the determination of the probability of a message being a message having said classification, receipt of a control signal indicative of user assignment of said classification to said message or receipt of or failure to receive a response from the sender of a message.

19. Apparatus in accordance with claim 12, wherein said classification store is operable to store data indicative of the frequency with which different items of content appear in messages assigned to different classifications by said message classifier and data indicative of the frequency with which items of content appear in messages recently classified by said message classifier, wherein said message classifier is operable to determine estimated frequencies with which items of content appear in correctly classified messages on the basis of the difference between the frequency with which items of content appear in messages assigned to different classification by said message classifier and the frequency with which said items of content appear in messages recently assigned to said classifications by said message classifier.

20. Apparatus in accordance with claim 19 wherein said message classifier further comprises a delay determination module operable to determine a delay for reassessment of a message which can not be classified by said message classifier on the basis of the frequency with which items of content included in said message appear in messages recently classified by said message classifier.

21. Apparatus in accordance with claim 1, wherein said message classifier is operable to identify for a message, a set of similar messages containing similar items of content to said message, and to classify said message based upon classification data relating to said set of similar messages.

22. Apparatus in accordance with claim 21 wherein said classification store is configured to store classification data relating to a set of similar messages comprising data indicative of a calculated average probability of message in said set being a message which should be classified as having a particular classification.

23. Apparatus in accordance with claim 21 wherein said classification store is configured to store classification data relating to a set of similar messages comprising data indicative of the proportion of messages in said set assigned a particular classification by users.

24. Apparatus in accordance with claim 21, wherein said classification store is configured to store classification data relating to a set of similar messages comprising data indicative of the proportion of messages sent to senders of messages in said set which resulted in receipt of responses.

25. Apparatus in accordance with claim 21 wherein said classification store is configured to store classification data relating to a set of similar messages comprising data indicative of the number of messages in said set addressed to one or more predefined addresses.

26. Apparatus in accordance with claim 1, wherein said items of content comprise data identifying strings of characters included in said messages.

27. Apparatus in accordance with claim 1 wherein said items of content comprise data identifying words or phrases included in said messages.

28. Apparatus in accordance with claim 1, wherein said items of content include data identifying the sender or intended recipient of said messages.

29. Apparatus in accordance with claim 1 further comprising:

a dispatch module for dispatching messages wherein said dispatch module is operable to control dispatch messages based upon the classification of messages by said message classifier.

30. Apparatus in accordance with claim 1 further comprising:

a dispatch module operable to dispatch messages classified by said message classifier as being of a particular category.

31. Apparatus in accordance with claim 30 further comprising:

an archive store for storing messages classified by said message classifier as being another category.

32. A distributed computer system for classifying electronic mail messages comprising:

apparatus for classifying messages in accordance with claim 29;

one or more user terminals operable to receive messages; and

a communication network for transmitting messages between said apparatus and said user terminals wherein said communications network is operable to send data indicative of the content of messages addressed to said user terminals to said apparatus for classifying messages for storage in said data store, said apparatus for classifying messages being operable to control dispatch of messages to said user terminals based on the classification of the messages by said message classifier.

33. A distributed computer system in accordance with claim 32, wherein said one or more user terminals are operable to generate user interface displays enabling a user to view received messages and assign classifications to received messages, said user terminals being responsive to user assignment of a classification to a message to cause a control signal indicative of user assigned classification of a message to be sent via said communications network to said apparatus for classifying messages.

34. A distributed computer system in accordance with claim 32 further comprising:

one or more computers operable to receive messages and to send control signals indicative of classifications assigned to said received messages and the content of said messages to said apparatus for classifying messages via said communication network.

35. A distributed computer system in accordance with claim 32 further comprising:

one or more sender computers operable to generate and send messages addressed to said user terminals via said communications network.

36. A distributed computer system for classifying electronic messages comprising:

a communications network;

a plurality of apparatus for classifying messages in accordance with claim 29, operable to receive data indicative of the content of messages transmitted via said communication network; and

a central classification store connected to said communications network and operable to receive control signals from said plurality of apparatus for classifying messages, wherein said central classification store is operable to store classification data and is responsive to control signals received from apparatus for classifying messages to dispatch to an apparatus from which a control signal is received a copy of said stored classification data, said update module of said apparatus being responsive to receipt of classification data to update classification data stored in said classification store of said apparatus utilising said received classification data.

37. A distributed computer system in accordance with claim 36, wherein said apparatus for classifying messages are responsive to the determination that a message can not be classified to send a control signal to said central classification store to request a copy of the classification data stored by said central classification store.

38. A distributed computer system in accordance with claim 36, wherein said apparatus for classifying messages are responsive to the determination that a message can not be classified to send a control signal to said central classification store indicative of the content of said message and said central classifications store is operable to update stored classification data in response to receipt of said control signals.

39. A distributed computer system in accordance with claim 36, wherein said one or more user terminals are operable to generate user interface displays enabling a user to view received messages and assign a classification to received messages, said user terminals being responsive to user assignment of a classification to a message to cause a control signal indicative of user assignment of a classification to a message to be sent via said communications network to said central classification store, said central classification store being operable to update stored classification data in response to receipt of said control signals.

40. A distributed computer system in accordance with claim 36, further comprising:

one or more computers operable to receive messages and to send control signals indicative of said messages having an assigned classification to said central classification store, said central classification store being operable to update stored classification data in response to receipt of said control signals.

99. A data carrier storing computer implementable instructions for generating within a programmable computer message apparatus in accordance with claim 1.

100. A data carrier storing computer implementable instructions for causing a programmable computer to perform a method in accordance with claim 1.

101. A data carrier in accordance with claim 99, comprising a computer disc.

102. A data carrier in accordance with claim 99, comprising an electric signal transferred via the Internet.

103. A computer disc in accordance with claim 101, wherein said computer disc comprises an optical, magneto-optical or magnetic disc.

41. A method classifying electronic messages, comprising:

storing classification data;

receiving data indicative of the content of a message;

utilising stored classification data to determine whether a message for which data indicative of its content has been received can be classified based on the currently stored classification data; and

if a message can not be classified utilising the currently stored classification data, reassessing the message for which data indicative of content has been received after a delay utilising stored classification data as updated during said delay.

42. A method in accordance with claim 41 wherein said receiving comprises:

receiving a copy of said message; and

generating data indicative of items of content in said received message.

43. A method in accordance with claim 41 further comprising:

assigning a default classification to a message which can not be classified utilising stored classification data as updated within a preset time period.

44. A method in accordance with claim 41 further comprising determining a delay for a message on the basis of the extent stored classification data is likely to be updated.

45. A method in accordance with claim 41 further comprising determining a delay for a message on the basis of an assessment of the likelihood of the message being a wanted message.

46. A method in accordance with claim 45 wherein the time period determined for a message is shorter for reassessment of messages which are more likely to be wanted messages.

47. A method in accordance with claim 44 further comprising:

reassessing the possibility of classifying a message after said determined delay has passed.

48. A method in accordance with claim 44 further comprising:

reassessing the possibility of classifying a message during said determined delay.

49. A method in accordance with claim 41 further comprising updating said stored classification data periodically.

50. A method in accordance with claim 41 further comprising:

updating classification data in response to receiving data indicative of the content of a message.

51. A method in accordance with claim 41 further comprising:

receiving a control signal indicative of user assignment of a classification to a message; and

updating said stored classification data in response to receipt of said control signal.

52. A method in accordance with claim 41 further comprising:

receiving data indicative of the content of a message from one or more pre identified computers; and

updating said classification data in response to receipt of said data.

53. A method in accordance with claim 41 further comprising:

dispatching messages to senders of messages which can not be classified; and

updating said stored classification data in response to receipt of a response from a sender of a message.

54. A method in accordance with claim 41 further comprising:

dispatching a message to a sender of a message which can not be classified; and

responding to failure to receive a response to a message by updating said stored classification data.

55. A method in accordance with claim 41 wherein said classification data comprises data indicative of the frequency with which different items of content appear in messages assigned to different classifications, said method further comprising:

utilising said stored classification data to determine the probability of a message being classified being a message assigned different classifications on the basis of the items of content included in said message.

56. A method in accordance with claim 55 wherein said classification of a message is performed by comparing a calculated probability of a message being a message assigned a particular classification with a threshold probability.

57. A method in accordance with claim 55 further comprising:

updating stored classification data indicative of the frequency of different items of content being included in a message assigned a particular classification in response to determining that a message including said items of content is a message assigned to said classification.

58. A method in accordance with claim 57 wherein said determination of whether a message is a message assigned to a particular classification is made on the basis of any of:

the determination of the probability of a message being assigned to said classification, receipt of a control signal indicative of user assignment of said message to a particular classification or receipt of a response from the sender of a message assigned to a particular classification.

59. A method in accordance with claim 54 wherein said classification data comprises data indicative of the frequency with which different items of content appear in classified messages and data indicative of the frequency with which different items of content appear in recently classified messages, said method further comprising:

determining estimated frequencies with which different items of content appear in messages correctly assigned different classifications on the basis of the difference between the frequency with which different items of content appear in classified messages and the frequency with which different items of content appear in recently classified messages.

60. A method in accordance with claim 59 further comprising:

determining a delay for reassessing a message which can not be classified utilising the currently stored classification data, utilising said stored data indicative of the frequency with which different items of content appear in messages recently classified as being in different categories.

61. A method in accordance with claim 41 further comprising:

identifying for a message a set of similar messages containing similar content to said message; and

classifying said message based on classification data relating to said set of similar messages.

62. A method in accordance with claim 61 wherein said classification data relating to a set of similar messages comprises data indicative of the calculated average probability of a message in said set being a message in a particular category.

63. A method in accordance with claim 61 wherein said classification data relating to a set of similar messages comprises data indicative of the proportion of messages in said set assigned a particular category by users.

64. A method in accordance with claim 61 wherein said classification data relating to a set of similar messages comprises data indicative of the proportion of messages sent to senders of messages in said set which result in receipt of responses.

65. A method in accordance with claim 61 wherein said classification data relating to a set of similar messages comprises data indicative of the number of messages in said set addressed to one or more predefined addresses.

66. A method in accordance with claim 41 further comprising:

storing messages classified as belonging to certain categories.

67. A method in accordance with claim 41 further comprising:

dispatching messages classified as belonging to certain categories.

68. A method in accordance with claim 67 further comprising dispatching messages classified as belonging to certain categories to a different destination to messages classified as belonging to other categories.

69. A method of filtering electronic messages comprising:

receiving an electronic message;

classifying a received message; and

selectively performing a control function on a received message on the basis of said classification, wherein said classification of a message includes delaying classification of a message and utilising feedback received on similar messages during said delay period to classify said message.

70. Apparatus for filtering electronic message comprising:

means for receiving an electronic message;

means for classifying a received message; and

means for selectively applying a control function to a received message on the basis of said classification wherein said classification means is operable to classify messages by delaying classification of a message and utilising feedback received on similar messages during said delay period to classify a said message.

71. Apparatus for classifying messages comprising:

a receiver operable to receive data indicative of items of content included in messages to be classified;

a classification store configured to store classification data; and

a message classifier operable to utilise stored classification data to classify messages including items of content as identified by data received by said receiver, wherein said classification store is configured to store data indicative of the content of messages of different categories and data indicative of the content of messages not having a confirmed category, said message classifier being operable to utilise said classification data indicative of the content of messages not having a confirmed category to model an expected variation in the data indicative of the content of messages in different categories and utilise said modelled variation to classify messages including items of content identified as received by said receiver.

72. Apparatus in accordance with claim 71, wherein said receiver is operable to receive as data indicative of items of content included in messages, copies of the messages to be classified.

73. Apparatus in accordance with claim 71, further comprising an update module operable to update classification data stored in said classification store.

74. Apparatus in accordance with claim 73, wherein said update module is operable to receive control signals indicative of user assignment of classification of messages and is responsive to receipt of said signals to utilise the content of said classified messages to update said classification data stored in said classification store.

75. Apparatus in accordance with claim 73, wherein said update module is operable to receive control signals indicative of the receipt of messages by one or more computers and is responsive to receipt of said signals to utilise the content of said received messages to update said classification data indicative of the content of messages of different categories stored in said classification store.

76. Apparatus in accordance with claim 71, wherein said message classifier is operable to store data indicative of the timing of messages and model an expected variation in data indicative of the content of messages utilising said data indicative of timing.

77. Apparatus in accordance with claim 76, wherein said message classifier is operable to model expected variation in data indicative of the content of messages in different categories such that a greater proportion of the content of messages not having a confirmed category is assumed to be indicative of content of messages having a particular category as time passes.

78. Apparatus in accordance with claim 71, wherein said message classifier is operable to store data indicative of the proportion of messages assigned to different categories by users and is operable to model the expected variation in data indicative of the content of messages in different categories utilising said stored data.

79. Apparatus in accordance with claim 71, wherein said message classifier is operable to determine whether a message including items of content identified by data received by said receiver can be classified utilising the data currently stored in the classification store and if a message can not be classified utilising the currently stored classification data to reassess the classification of a message including items of content identified by data received by said receiver after a delay utilising the classification data stored in said classification store after said delay as updated by said update module.

80. Apparatus in accordance with claim 79, wherein said message classifier is operable to assign a default classification to messages which can not be classified utilising classification data stored within said data store as updated by said update module within a preset time period.

81. Apparatus in accordance with claim 79, wherein said message classifier is operable to determine whether a message can be classified within a preset time period based on a modelled expected variation in said classification data.

82. A method of classifying electronic messages comprising:

storing classification data indicative of the content of messages of different categories and data indicative of the content of messages not having a confirmed category;

receiving data indicative of items of content included in messages to be classified;

modelling an expected variation in the data indicative of the content of messages in different categories utilising said stored classification data indicative of the content of messages not having a confirmed category; and

classifying messages including items of content as identified by received data utilising classification data and said modelled variation.

83. A method in accordance with claim 82, wherein said data indicative of items of content included in messages comprise copies of the messages to be classified.

84. A method in accordance with claim 82, further comprising updating classification data stored in said classification store.

85. A method in accordance with claim 84, further comprising:

receiving control signals indicative of user assignment of classification of messages; and

utilising the content of said classified messages to update said stored classification data.

86. A method in accordance with claim 84, further comprising:

receiving control signals indicative of the receipt of messages by one or more computers; and

utilising the content of said received messages to update said stored classification data indicative of the content of messages of different categories.

87. A method in accordance with claim 82, further comprising:

storing data indicative of the timing of messages; and

modelling an expected variation in data indicative of the content of messages utilising said data indicative of timing.

88. A method in accordance with claim 87, wherein said modelling an expected variation in data indicative of the content of messages in different categories is such that a greater proportion of the content of messages not having a confirmed category is assumed to be indicative of content of messages having a particular category as time passes.

89. A method in accordance with claim 82, further comprising:

storing data indicative of the proportion of messages assigned to different categories by users; and

modelling the expected variation in data indicative of the content of messages in different categories utilising said stored data.

90. A method in accordance with claim 82, further comprising:

determining whether a message including items of content identified by received data can be classified utilising currently stored data; and

if a message can not be classified utilising the currently stored data, reassessing the classification of a message including items of content identified by received data after a delay utilising updated stored data after said delay.

91. A method in accordance with claim 90, further comprising:

assigning a default classification to messages which can not be classified utilising stored data within a preset time period.

92. A method in accordance with claim 91, further comprising:

determining whether a message can be classified within a preset time period based on a modelled expected variation in said classification data.

93. A method of classifying electronic messages comprising:

storing classification data;

receiving data indicative of the content of a message to be classified; and

classifying a message for which data indicative of content is received utilising said stored classification data and a model of estimated expected changes to said classification data modelled to account for absence of feed back on one or more messages.

94. A method in accordance with claim 93 further comprising:

storing data indicative of the content of one or more messages for which no feedback has been received; and

modelling said expected changes utilising said stored data.

95. A method in accordance with claim 93 further comprising:

receiving feedback on one or more messages; and

updating said classification data in response to receiving said feedback.

96. Apparatus for classifying electronic messages comprising:

means for storing classification data;

means for receiving data indicative of the content of a message to be classified; and

means for classifying a message for which data indicative of content is received by said receiving means utilising classification data stored by said storing means and a model of estimated expected changes to said classification data modelled to account for absence of feed back on one or more messages.

97. Apparatus in accordance with claim 96 further comprising:

means for storing data indicative of the content of one or more messages for which no feedback has been received; and

means for modelling said expected changes utilising data indicative of the content of one or more messages for which no feedback has been received.

98. Apparatus in accordance with claim 96 further comprising:

means for receiving feedback on one or more messages; and

means for updating classification data stored by said storing means in response to receiving said feedback.