Method and apparatus for controlling unsolicited messaging

• US 20050141486A1
• Filed: 12/21/2004
• Published: 06/30/2005
• Est. Priority Date: 12/24/2003
• Status: Active Grant

• Current Assignee: Wellington Financial LP (Canadian Imperial Bank of Commerce), Borderware Technologies Incorporated (Gladiator Corporation), WatchGuard Technologies Incorporated (Gladiator Corporation)
• Original Assignee: Borderware Technologies Incorporated (Gladiator Corporation)
• Inventors: Osborne, Robert, Gilchrist, Rod, Alsop, John, Fogel, Richard
• Granted Patent: US 7,613,172 B2
• Time in Patent Office: Days
• US Class Current: 370/352
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 65/1079 of unsolicited session attempts, e.g. SPIT
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/403 Arrangements for multi-party communication, e.g. for conferences data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15
• CPC Class Codes: H04M 3/436 Arrangements for screening incoming calls , i.e. evaluating the characteristics of a call before deciding whether to answer it based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42

Abstract

Sensor nodes (or addresses therefore), acting as real-time message decoys, are distributed across a real-time communications network to attract unsolicited real-time messages. Filtering rules are derived from the message characteristics (such as the source address) and messaging content of the traffic encountered at the sensor nodes. The filtering rules are distributed to filtering agents positioned in the communications network in such a way that they can filter traffic for legitimate users. The filtering agents may identify and control the disposition of real-time messaging traffic that is part of a mass communication campaign on behalf of legitimate users of the real-time messaging communication system. Disposition may include suppressing, diverting, or labeling.

Claims

1. A method for controlling unsolicited RTM calls, the method comprising:

assigning one or more system identifiers that do not correspond to an actual user;

receiving a first call to one or more of the system identifiers;

retrieving caller identification information from the first call; and

creating one or more filter rules based upon the caller identification information.

2. The method of claim 1, further comprising:

receiving a second call;

determining if the second call matches one or more of the filter rules;

upon determining that the second call matches one or more of the filter rules, acting upon the second call; and

upon determining that the second call does not match one or more of the filter rules, allowing the second call.

3. The method of claim 2, wherein the first and second call comprises a Voice Over Internet Protocol call.

4. The method of claim 1, wherein the call identifiers correspond to IP addresses.

5. The method of claim 1, wherein the caller identification information includes a calling telephone number or other call identifier.

6. A system for controlling unsolicited messaging in a real-time messaging (RTM) network comprising at least one receiving terminal device adapted to receive RTM messages and at least one sending terminal device adapted to send RTM messages including unsolicited RTM messages via said RTM network to said at least one receiving device, said system comprising:

at least one sensor node coupled to the RTM network, each sensor node adapted to receive RTM messages from said sending terminal devices;

a monitoring and analysis facility coupled to the at least one sensor node, said monitoring and analysis facility adapted to;

collect RTM message characteristics determined from unsolicited RTM messages received by said at least one sensor node;

construct filtering rules to identify and control unsolicited RTM messages; and

provide the filtering rules to one or more filtering agents; and

one or more filtering agents, each filtering agent coupled to the monitoring and analysis facility to receive said filtering rules and coupled to the RTM network to receive RTM messages for at least one receiving terminal device, each filtering agent applying said filtering rules to identify and control unsolicited RTM messages.

7. The system according to claim 6, wherein the RTM message comprises a voice call.

8. The system according to claim 6, wherein the RTM messages include at least one of Voice Over Internet Protocol (VoIP) messaging;

Instant Messaging (IM), voice communications via a POTS or wireless network, or video conferencing.

9. A method for controlling unsolicited messaging in a real-time messaging (RTM) network comprising at least one receiving terminal device adapted to receive RTM messages and at least one sending terminal device adapted to send RTM messages including unsolicited RTM messages via said RTM network to said at least one receiving device, said method comprising:

receiving unsolicited RTM messages from said sending terminal devices;

collecting real-time message characteristics determined from said unsolicited RTM messages;

constructing and providing filtering rules for application to identify and control unsolicited RTM messages;

receiving RTM messages for a first receiving terminal device; and

applying said filtering rules to identify and control unsolicited RTM messages received for said first receiving terminal device.

10. The method of claim 9, wherein the RTM network comprises the Internet, a POTS network, a wireless network, a private IP-based network, a public IP-based network, or a combination thereof.

11. A method of controlling unsolicited real-time messaging (RTM) messages, the method comprising:

receiving unsolicited RTM messages from a sending device;

automatically constructing one or more filtering rules from the unsolicited RTM messages, the filtering rules identifying characteristics of messages that are to be blocked;

receiving a first RTM message sent to a first terminal device;

determining whether the first RTM message matches one or more of the filtering rules;

upon determining that the first RTM message matches one or more of the filtering rules, acting upon the first RTM message; and

upon determining that the first RTM message does not match one or more of the filtering rules, allowing the first RTM message.

12. The method of claim 11, wherein the filtering rules are based upon one or more of header information, sender information, sender network IP address, media type, caller ID, source location, and routing information.

13. The method of claim 11, wherein the RTM message comprises a voice call.

14. The method of claim 11, further comprising identifying one or more network addresses, the network addresses not being related to an actual user, wherein the unsolicited RTM messages comprise messages directed to one or more of the network addresses.

15. The method of claim 14, further comprising displaying a network presence for one or more of the network addresses.

16. The method of claim 11, further comprising expiring a first filter rule upon an occurrence of a first event.

17. The method of claim 16, wherein the first event is an expiration of a first time period without receiving any messages fulfilling the first filter rule.

18. The method of claim 11, wherein acting upon includes one or more of rejecting the first RTM message, quarantining the first RTM message, and flagging and sending the first RTM message to the first terminal device.

19. The method of claim 11, wherein the unsolicited messages and the first message include messages in a format of one or more of Voice Over Internet Protocol (VoIP) messaging, Instant Messaging (IM), voice communications over the POTS or a wireless network, and video conferencing.

20. A method of controlling unsolicited real-time messaging (RTM) messages, the method comprising:

identifying one or more network addresses, the network addresses not being related to an actual user;

receiving unsolicited RTM messages from a sending device; and

constructing one or more filtering rules from the unsolicited RTM messages, the filtering rules identifying characteristics of messages that are to be acted upon.

21. The method of claim 20, wherein the unsolicited RTM messages comprises voice calls.

22. The method of claim 20, further comprising:

receiving a first RTM message sent to a first terminal device;

determining whether the first RTM message matches one or more of the filtering rules;

upon determining that the first RTM message matches one or more of the filtering rules, acting upon the first message; and

upon determining that the first RTM message does not match one or more of the filtering rules, allowing the first RTM message.

23. The method of claim 22, wherein acting upon includes one or more of rejecting the first RTM message, quarantining the first RTM message, and flagging and sending the first RTM message to the first terminal device.

24. The method of claim 20, wherein the filtering rules are based upon one or more of header information, sender information, sender network IP address, media type, caller ID, and routing information.

25. The method of claim 20, further comprising expiring a first filter rule upon an occurrence of a first event.

26. The method of claim 25, wherein the first event is an expiration of a first time period without receiving any messages fulfilling the first filter rule.

27. The method of claim 20, wherein the unsolicited RTM messages include messages of a format corresponding to one or more of Voice Over Internet Protocol (VoIP) messaging, Instant Messaging (IM), voice communications over the POTS or a wireless network, and video conferencing.

28. The method of claim 20, further comprising displaying a network presence for one or more of the network addresses.

29. The method of claim 20, wherein the network address is a telephone number.

30. A computer program product for controlling unsolicited real-time messaging (RTM) messages, the computer program product having a medium with a computer program embodied thereon, the computer program comprising:

computer program code for identifying one or more network addresses, the network addresses not being related to an actual user;

computer program code for receiving unsolicited RTM messages from a sending device; and

computer program code for constructing one or more filtering rules from the unsolicited RTM messages, the filtering rules identifying characteristics of messages that are to be acted upon.

31. The computer program product of claim 30, wherein the unsolicited RTM messages comprise voice communications over a POTS network or a wireless network.

32. The computer program product of claim 30, further comprising:

computer program code for receiving a first RTM message sent to a first terminal device;

computer program code for determining whether the first RTM message matches one or more of the filtering rules;

upon determining that the first RTM message matches one or more of the filtering rules, computer program code for acting upon the first RTM message; and

upon determining that the first RTM message does not match one or more of the filtering rules, computer program code for allowing the first RTM message.

33. The computer program product of claim 32, wherein the computer program code for acting upon includes computer program code for one or more of rejecting the first RTM message, quarantining the first message, and flagging and sending the first RTM message to the first terminal device.

34. The computer program product of claim 30, wherein the filtering rules are based upon one or more of header information, sender information, sender network IP address, media type, caller ID, and routing information.

35. The computer program product of claim 30, further comprising computer program code for expiring a first filter rule upon an occurrence of a first event.

36. The computer program product of claim 35, wherein the first event is an expiration of a first time period without receiving any messages fulfilling the first filter rule.

37. The computer program product of claim 30, wherein the unsolicited RTM messages include messages of a format corresponding to one or more of Voice Over Internet Protocol (VoIP) messaging, Instant Messaging (IM), voice communications over a POTS network or a wireless network, and video conferencing.

38. The computer program product of claim 30, further comprising computer program code for displaying a network presence for one or more of the network addresses.