SYSTEM FOR RECLASSIFICATION OF ELECTRONIC MESSAGES IN A SPAM FILTERING SYSTEM

• US 20100263045A1
• Filed: 04/05/2010
• Published: 10/14/2010
• Est. Priority Date: 06/30/2004
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Golub, Seth, Dulitz, Daniel Wesley
• Granted Patent: US 8,782,781 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method for indicating probability of spam for email comprises tracking network traffic characteristics for the email, and comparing the tracked characteristics for the email to characteristics for email from trusted or known spam sources.

Claims

1. (canceled)

4. The computer implemented method of claim 1, wherein identifying the spam probability further comprises:

identifying the spam probability of the email based on historical interactions between one or more additional recipients and the sender.

5. The computer implemented method of claim 1, wherein the one or more non-email applications includes a plurality of:

an instant messaging application, an on-line chat application, a file-sharing application, and a collaboration application.

6. The computer implemented method of claim 1, wherein identifying the spam probability further comprises:

identifying a spam probability of the email based at least in part on statistical information relating to previous interactions between the recipient and the sender, wherein the statistical information relating to previous interactions includes one or more of the following;

types of interaction, media of interaction, and frequency of interaction.

2. A computer implemented method for filtering emails on a server system having one or more processors and memory storing one or more programs for execution by the one or more processors, comprising:

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical interactions between the recipient and the sender, wherein the historical interactions include interactions from an email application and one or more non-email applications including at least one of;

a file-sharing application and a collaboration application; and

classifying the email according the identified spam probability.

3. The computer implemented method of claim 2, wherein identifying the spam probability further comprises:

combining historical interactions from the email application and historical interactions from the one or more non-email applications to produce a combined condition; and

identifying the spam probability of the email based at least in part on the combined condition.

7. A system, for filtering emails, comprising:

at least one processor; and

memory storing one or more programs to be executed by the at least one processor;

the one or more programs comprising instructions for;

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical interactions between the recipient and the sender, wherein the historical interactions include interactions from an email application and one or more non-email applications including at least one of;

a file-sharing application and a collaboration application; and

classifying the email according the identified spam probability.

8. The system of claim 7, wherein instructions for identifying the spam probability further comprises instructions for:

combining historical interactions from the email application and historical interactions from the one or more non-email applications to produce a combined condition; and

identifying the spam probability of the email based at least in part on the combined condition.

9. The system of claim 7, wherein instructions for identifying the spam probability further comprises instructions for:

identifying the spam probability of the email based on historical interactions between one or more additional recipients and the sender.

10. The system of claim 7, wherein the one or more non-email applications also includes a plurality of:

an instant messaging application, an on-line chat application, a file-sharing application, and a collaboration application.

11. The system of claim 7, wherein instructions for identifying the spam probability further comprises instructions for:

identifying a spam probability of the email based at least in part on statistical information relating to previous interactions between the recipient and the sender, wherein the statistical information relating to previous interactions includes one or more of the following;

types of interaction, media of interaction, and frequency of interaction.

12. A computer readable storage medium storing one or more programs configured for execution by a computer, the one or more programs comprising instructions for:

receiving an email to a recipient from a sender;

identifying a spam probability of the email based at least in part on historical interactions between the recipient and the sender, wherein the historical interactions include interactions from an email application and one or more non-email applications including at least one of;

a file-sharing application and a collaboration application; and

classifying the email according the identified spam probability.

13. The computer readable storage medium of claim 12, wherein instructions for identifying the spam probability further comprises instructions for:

combining historical interactions from the email application and historical interactions from the one or more non-email applications to produce a combined condition; and

identifying the spam probability of the email based at least in part on the combined condition.

14. The computer readable storage medium of claim 12, wherein instructions for identifying the spam probability further comprises instructions for:

identifying the spam probability of the email based on historical interactions between one or more additional recipients and the sender.

15. The computer readable storage medium of claim 12, wherein the one or more non-email applications also includes a plurality of:

an instant messaging application, an on-line chat application, a file-sharing application, and a collaboration application.

16. The computer readable storage medium of claim 12, wherein instructions for identifying the spam probability further comprises instructions for:

identifying a spam probability of the email based at least in part on statistical information relating to previous interactions between the recipient and the sender, wherein the statistical information relating to previous interactions includes one or more of the following;

types of interaction, media of interaction, and frequency of interaction.

17. A computer implemented method for filtering emails on a server system having one or more processors and memory storing one or more programs for execution by the one or more processors, comprising:

receiving an email to a recipient from a sender;

tracking network traffic burstiness from the network associated with the sender, wherein network traffic burstiness corresponds to variations in email volume relative to time for the network;

identifying a burstiness spam probability of the email based by comparing the network traffic burstiness to the burstiness of known trusted sources and the burstiness of known spam sources; and

classifying the email at least in part based on the burstiness spam probability.

18. The computer implemented method of claim 17, further comprising:

tracking at least one additional network characteristic for the network associated with the sender, the additional tracked network characteristic selected from the group consisting of;

network traffic volume per unit of time, number of recipients, number of purported senders, and mail recipient connection type;

comparing the additional tracked network characteristic for the email to known values for email from trusted or untrusted sources; and

classifying the email at least in part based on the compared additional network characteristic.

19. The computer implemented method of claim 18, further comprising:

combining network traffic burstiness with the at least one additional network characteristic, to produce a combined tracked rating value; and

classifying the email at least in part based on the combined tracked rating value.

20. A system, for filtering emails, comprising:

at least one processor; and

memory storing one or more programs to be executed by the at least one processor;

the one or more programs comprising instructions for;

receiving an email to a recipient from a sender;

tracking network traffic burstiness from the network associated with the sender, wherein network traffic burstiness corresponds to variations in email volume relative to time for the network;

identifying a burstiness spam probability of the email based by comparing the network traffic burstiness to the burstiness of known trusted sources and the burstiness of known spam sources; and

classifying the email at least in part based on the burstiness spam probability.

21. The system of claim 20, further comprising instructions for:

tracking at least one additional network characteristic for network associated with the sender, the additional tracked network characteristic selected from the group consisting of;

network traffic volume per unit of time, number of recipients, number of purported senders, and mail recipient connection type;

comparing the additional tracked network characteristic for the email to known values for email from trusted or untrusted sources; and

classifying the email at least in part based on the compared additional network characteristic.

22. The system of claim 21, further comprising instructions for:

combining network traffic burstiness with the at least one additional network characteristic, to produce a combined tracked rating value; and

classifying the email at least in part based on the combined tracked rating value.

23. A computer readable storage medium storing one or more programs configured for execution by a computer, the one or more programs comprising instructions for:

receiving an email to a recipient from a sender;

tracking network traffic burstiness from the network associated with the sender, wherein network traffic burstiness corresponds to variations in email volume relative to time for the network;

identifying a burstiness spam probability of the email based by comparing the network traffic burstiness to the burstiness of known trusted sources and the burstiness of known spam sources; and

classifying the email at least in part based on the burstiness spam probability.

24. The computer readable storage medium of claim 23, further comprising instructions for:

tracking at least one additional network characteristic for the network associated with the sender, the additional tracked network characteristic selected from the group consisting of;

network traffic volume per unit of time, number of recipients, number of purported senders, and mail recipient connection type;

comparing the additional tracked network characteristic for the email to known values for email from trusted or untrusted sources; and

classifying the email at least in part based on the compared additional network characteristic.

25. The computer readable storage medium of claim 24, further comprising instructions for:

combining network traffic burstiness with the at least one additional network characteristic, to produce a combined tracked rating value; and

classifying the email at least in part based on the combined tracked rating value.