Network domain reputation-based spam filtering

• US 7,487,217 B2
• Filed: 02/04/2005
• Issued: 02/03/2009
• Est. Priority Date: 02/04/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Buckingham, Jay T., Rounthwaite, Robert L., Mehr, John D., Rehfuss, Paul S
• Primary Examiner(s): Maung; Zarni
• Application Number:
  US11/051,495
• Publication Number:
  US 20060179113A1
• Time in Patent Office: 1,460 Days
• Field of Search: 709/206, 709/207, 713/201, 713/202
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Network domain reputation-based spam filtering is described. In an embodiment, emails are received from a network domain and a reputation of the network domain is established. Additional emails are filtered as they are received to determine a status of each email as spam email or not spam email. An email can be determined to be a spam email based on any one or more of the reputation of the network domain, an authentication status of an email, and other information that can be derived from an email.

Claims

1. An email system, comprising:

an email server configured to receive emails from a network domain; and

a spam filter configured to determine a status of an email based on a reputation of the network domain and a message feature of the email, the status of the email determined to be at least one of spam email or not spam email,

wherein the message feature includes at least one of the following;

the size of the email, number of recipients, time of day, or day of the week.

2. An email system as recited in claim 1, wherein the reputation of the network domain is established based on an authentication determination of additional emails received from the network domain.

3. An email system as recited in claim 1, wherein the reputation of the network domain can be modified based on the determined status of the emails received from the network domain.

4. An email system as recited in claim 1, wherein the spam filter is further configured to determine the status of the email based on the reputation of the network domain and an authentication determination.

5. An email system as recited in claim 1, wherein the emails are received from a computing device in the network domain, and wherein the spam filter is further configured to determine the status of the email based on the reputation of the network domain and the computing device.

6. An email system as recited in claim 1, wherein the emails are received from a computing device in the network domain, and wherein the spam filter is further configured to determine the status of the email based on an authentication determination of the email and based on the reputation of the network domain and the computing device.

7. An email system as recited in claim 1, further comprising a domain reputation filter configured to determine a score corresponding to the email based on the reputation of the network domain and an authentication determination, and wherein the spam filter includes the domain reputation filter and is further configured to determine the status of the email based on the score corresponding to the email.

8. An email system as recited in claim 1, further comprising:

a domain reputation filter configured to determine a first score of the email based on the reputation of the network domain;

an IP address filter configured to determine a second score of the email based on a reputation of a computing device via which the email is received from the network domain; and

wherein the spam filter includes the domain reputation filter and the IP address filter and is further configured to determine the status of the email based on a combination of the first score of the email and the second score of the email.

9. A method, comprising:

receiving emails from a network domain;

establishing a reputation of the network domain based on an authentication determination of each of the emails received from the network domain;

receiving additional emails from the network domain; and

filtering the additional emails to determine a status of each email as spam email or not spam email based on the reputation of the network domain and a message feature of the email,

wherein the message feature includes at least one of the following;

the size of the email, number of recipients, time of day, or day of the week.

10. A method as recited in claim 9, further comprising determining the status of each of the additional emails based on the reputation of the network domain and an authentication determination.

11. A method as recited in claim 9, further comprising determining the status of each of the additional emails based on the reputation of the network domain and a message feature of each of the additional emails.

12. A method as recited in claim 9, further comprising determining the status of each of the additional emails based on the reputation of the network domain and a computing device via which the additional emails are received from the network domain.

13. A method as recited in claim 9, further comprising determining the status of each of the additional emails based on an authentication determination of an email and based on the reputation of the network domain and a computing device via which the additional emails are received from the network domain.

14. A method as recited in claim 9, wherein filtering the additional emails includes filtering the additional emails to determine a score corresponding to each of the additional emails based on the reputation of the network domain and a sender authentication determination, and wherein the status the each email is based on the score corresponding to the email.

15. A method as recited in claim 9, wherein filtering the emails includes:

determining a first status of an email based on the reputation of the network domain;

determining a second status of the email based on a reputation of a computing device via which the email is received from the network domain;

determining a third status of the email based on a message feature of the email; and

determining the status of the email as spam email or not spam email based on a combination of the first status of the email, the second status of the email, and the third status of the email.

16. One or more computer readable storage media comprising computer executable instructions that, when executed by a processor, directs a spam email filter to:

establish a reputation of a network domain based on an authentication determination of emails received from the network domain;

receive one or more additional emails from the network domain; and

filter an additional email received from the network domain to determine a status of the email based on the reputation of the network domain and a message feature of the email,

wherein the message feature includes at least one of the following;

the size of the email, number of recipients, time of day, or day of the week.

17. One or more computer readable media as recited in claim 16, further comprising computer executable instructions that, when executed, direct the spam email filter to determine the status of the additional email as spam email or not spam email based on the reputation of the network domain and an authentication determination.

18. One or more computer readable media as recited in claim 16, further comprising computer executable instructions that, when executed, direct the spam email filter to determine the status of the additional email as spam email or not spam email based on the reputation of the network domain and a computing device via which the additional email is received from the network domain.

19. One or more computer readable media as recited in claim 16, further comprising computer executable instructions that, when executed, direct the spam email filter to filter the additional email to determine a score corresponding to the additional email based on the reputation of the network domain and a sender authentication determination, and determine the status of the additional email based on the score corresponding to the additional email.