METHOD AND APPARATUS FOR ELECTRONIC MAIL FILTERING

• US 20140337452A1
• Filed: 08/01/2014
• Published: 11/13/2014
• Est. Priority Date: 05/18/2007
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Websense UK Ltd. (Forcepoint LLC)
• Inventors: Kay, James
• Granted Patent: US 9,473,439 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 51/226 Delivery according to priorities
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes

Abstract

Messages having a reputation score higher than at least one message already on a queue are added to the queue when the queue has already reached the predetermined maximum permitted size. One or more messages having a low reputation score may be discarded from a bottom of the queue in favor of a new incoming message having a higher reputation score. This may be particularly useful in the context of Internet e-mail, wherein mail delivery protocols (i.e. SMTP) allow a connection for an incoming message to be held open for a limited time period and during this period the message processing apparatus does not assume responsibility for onward transmission of the message. Thus, the message processing apparatus is able to selectively accept only those messages having a highest reputation score for detailed analysis, without adversely affecting the operations performed by other parts of the electronic messaging system.

Claims

1. A message processing apparatus comprising:

a processor;

a memory storing instructions that configure the processor to perform a method of processing messages on a communication path between a client unit and a server unit, the method comprising;

receiving an incoming message from a client unit and determining a client identity with respect to the client unit,

allocating a reputation score to the incoming message with respect to the determined client identity,

storing the incoming message with a plurality of messages in a message queue ordered according to the reputation score allocated to the incoming message,

extracting a message with the highest reputation score from the message queue, and

transmitting the extracted message to the server unit.

2. The message processing apparatus of claim 1, wherein the method further comprises:

storing a plurality of reputation scores, each associated with one of a plurality of client identities; and

allocating the reputation score to the incoming message according to the stored reputation scores and with respect to the determined client identity.

3. The message processing apparatus of claim 2, wherein the method further comprises updating one or more of the plurality of stored reputation scores.

4. The message processing apparatus of claim 1, wherein the method further comprises determining an updated reputation score associated with a particular client identity according to statistics derived from a history of previous messages from the particular client identity.

5. The message processing apparatus of claim 4, wherein the method further comprises determining the updated reputation score for a particular client identity according to a proportion of wanted messages as determined by one or more filtering functions with respect to a total number of messages from the particular client identity.

6. The message processing apparatus of claim 5, wherein the method further comprises determining the updated reputation score according to a volume of traffic received from a particular client identity, a rate at which the traffic is received, and a percentage of the traffic which is determined to be unwanted messages.

7. The message processing apparatus of claim 3, wherein the method further comprises updating the stored reputation scores with reference to an external source.

9. The message processing apparatus of claim 1, wherein the method further comprises holding open each of the plurality of incoming connections while the reputation score to each of the incoming messages is allocated and the incoming messages are on the message queue.

10. The message processing apparatus of claim 1, wherein the message receiving unit is arranged to determine the client identity with respect to an IP address of the client unit.

11. The message processing apparatus of claim 1, wherein the method further comprises monitoring a timing field associated with the incoming message with respect to a permitted total time to live so as to determine the incoming message as a timed-out message when the timing field indicates that the permitted total time to live has expired.

12. The message processing apparatus of claim 11, wherein the method further comprises removing the timed-out message from the message queue when the timing field indicates that the permitted total time to live has expired.

13. The message processing apparatus of claim 12, wherein the method further comprises terminating a connection to the client unit for the incoming message so that a message transaction is not successfully completed in response to the determination that the incoming message is a timed-out message.

14. The message processing apparatus of claim 1, wherein the method further comprises selectively removing one or more incoming messages from the message queue having a low reputation score in favor of a new incoming message having a higher allocated reputation score, while maintaining a predetermined maximum size of the message queue.

15. The message processing apparatus of claim 1, wherein the method further comprises analyzing the extracted message with respect to one or more message filtering functions to determine whether the extracted message is either a wanted message or an unwanted message according to the one or more message filtering functions.

8. The message processing apparatus of claim 8, wherein the external source is another message processing apparatuses.

16. A method of processing messages, comprising:

receiving an incoming message from a client unit and determining a client identity with respect to the client unit;

allocating a reputation score to the incoming message with respect to the determined client identity;

storing the incoming message with a plurality of messages in a message queue ordered according to the reputation score allocated to the incoming message;

extracting a message with the highest reputation score from the message queue; and

transmitting the extracted message to the server unit.

17. The method of claim 16, further comprising determining an updated reputation score associated with a particular client identity according to statistics derived from a history of previous messages from the particular client identity.

18. The method of claim 17, the method further comprising determining the updated reputation score for a particular client identity according to a proportion of wanted messages as determined by one or more filtering functions with respect to a total number of messages from the particular client identity.

19. The method of claim 18, further comprising determining the updated reputation score according to a volume of traffic received from a particular client identity, a rate at which the traffic is received, and a percentage of the traffic which is determined to be unwanted messages.

20. An electronic messaging system, comprising:

a plurality of client units arranged to send electronic messages wherein each of the client units is associated with a predetermined client identity in the system;

a plurality of server units arranged to receive the electronic messages sent by the plurality of client units;

at least one message processing apparatus arranged to intercept the electronic messages with store-and-forward type interception between the plurality of client units and at least one of the plurality of server units, wherein the message processing apparatus comprises;

an electronic processor, and

an electronic memory storing instructions that configure the processor to perform a method, the method comprising;

receiving one of the electronic messages from a particular client unit amongst the plurality of client units and to determine the client identity with respect to the particular client unit,

allocating a reputation score to the electronic message with respect to the client identity,

storing the electronic message in a message queue containing a plurality of the electronic messages and ordered according to the reputation score allocated to each of the electronic messages,

extracting an electronic message with the highest reputation score in the message queue from the message queue, and

forwarding the extracted electronic message to the at least one of the plurality of server units.

21. The electronic messaging system of claim 20, wherein the plurality of client units include a plurality of sending terminals arranged to originate the electronic messages and a plurality of outgoing message servers arranged to send the electronic messages originating from the plurality of sending terminals.

22. The electronic messaging system of claim 20, wherein the plurality of server units include a plurality of receiving message servers arranged to receive one or more of the electronic messages according to a recipient identity provided for each electronic message, and a plurality of recipient terminals arranged to accept one or more of the electronic messages from one of the receiving message servers according to the recipient identity of each electronic message.