Network domain reputation-based spam filtering

• US 20060179113A1
• Filed: 02/04/2005
• Published: 08/10/2006
• Est. Priority Date: 02/04/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Buckingham, Jay T., Rounthwaite, Robert L., Mehr, John D., Rehfuss, Paul S.
• Granted Patent: US 7,487,217 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Network domain reputation-based spam filtering is described. In an embodiment, emails are received from a network domain and a reputation of the network domain is established. Additional emails are filtered as they are received to determine a status of each email as spam email or not spam email. An email can be determined to be a spam email based on any one or more of the reputation of the network domain, an authentication status of an email, and other information that can be derived from an email.

Claims

1. An email system, comprising:

an email server configured to receive emails from a network domain; and

a spam filter configured to determine a status of an email based on a reputation of the network domain, the status of the email determined to be at least one of spam email or not spam email.

2. An email system as recited in claim 1, wherein the reputation of the network domain is established based on an authentication determination of additional emails received from the network domain.

3. An email system as recited in claim 1, wherein the reputation of the network domain can be modified based on the determined status of the emails received from the network domain.

4. An email system as recited in claim 1, wherein the spam filter is further configured to determine the status of the email based on the reputation of the network domain and an authentication determination.

5. An email system as recited in claim 1, wherein the spam filter is further configured to determine the status of the email based on the reputation of the network domain and a message feature of the email.

6. An email system as recited in claim 1, wherein the emails are received from a computing device in the network domain, and wherein the spam filter is further configured to determine the status of the email based on the reputation of the network domain and the computing device.

7. An email system as recited in claim 1, wherein the emails are received from a computing device in the network domain, and wherein the spam filter is further configured to determine the status of the email based on an authentication determination of the email and based on the reputation of the network domain and the computing device.

8. An email system as recited in claim 1, further comprising a domain reputation filter configured to determine a score corresponding to the email based on the reputation of the network domain and an authentication determination, and wherein the spam filter includes the domain reputation filter and is further configured to determine the status of the email based on the score corresponding to the email.

9. An email system as recited in claim 1, further comprising:

a domain reputation filter configured to determine a first score of the email based on the reputation of the network domain;

an IP address filter configured to determine a second score of the email based on a reputation of a computing device via which the email is received from the network domain; and

wherein the spam filter includes the domain reputation filter and the IP address filter and is further configured to determine the status of the email based on a combination of the first score of the email and the second score of the email.

10. A method, comprising:

receiving emails from a network domain;

establishing a reputation of the network domain based on an authentication determination of each of the emails received from the network domain;

receiving additional emails from the network domain; and

filtering the additional emails to determine a status of each email as spam email or not spam email based on the reputation of the network domain.

11. A method as recited in claim 10, further comprising determining the status of each of the additional emails based on the reputation of the network domain and an authentication determination.

12. A method as recited in claim 10, further comprising determining the status of each of the additional emails based on the reputation of the network domain and a message feature of each of the additional emails.

13. A method as recited in claim 10, further comprising determining the status of each of the additional emails based on the reputation of the network domain and a computing device via which the additional emails are received from the network domain.

14. A method as recited in claim 10, further comprising determining the status of each of the additional emails based on an authentication determination of an email and based on the reputation of the network domain and a computing device via which the additional emails are received from the network domain.

15. A method as recited in claim 10, wherein filtering the additional emails includes filtering the additional emails to determine a score corresponding to each of the additional emails based on the reputation of the network domain and a sender authentication determination, and wherein the status the each email is based on the score corresponding to the email.

16. A method as recited in claim 10, wherein filtering the emails includes:

determining a first status of an email based on the reputation of the network domain;

determining a second status of the email based on a reputation of a computing device via which the email is received from the network domain;

determining a third status of the email based on a message feature of the email; and

determining the status of the email as spam email or not spam email based on a combination of the first status of the email, the second status of the email, and the third status of the email.

17. One or more computer readable media comprising computer executable instructions that, when executed, direct a spam email filter to:

establish a reputation of a network domain based on an authentication determination of emails received from the network domain;

receive one or more additional emails from the network domain; and

filter an additional email received from the network domain to determine a status of the email based on the reputation of the network domain.

18. One or more computer readable media as recited in claim 17, further comprising computer executable instructions that, when executed, direct the spam email filter to determine the status of the additional email as spam email or not spam email based on the reputation of the network domain and an authentication determination.

19. One or more computer readable media as recited in claim 17, further comprising computer executable instructions that, when executed, direct the spam email filter to determine the status of the additional email as spam email or not spam email based on the reputation of the network domain and a computing device via which the additional email is received from the network domain.

20. One or more computer readable media as recited in claim 17, further comprising computer executable instructions that, when executed, direct the spam email filter to filter the additional email to determine a score corresponding to the additional email based on the reputation of the network domain and a sender authentication determination, and determine the status of the additional email based on the score corresponding to the additional email.