Email filtering system and method

• US 7,580,982 B2
• Filed: 12/14/2004
• Issued: 08/25/2009
• Est. Priority Date: 12/14/2004
• Status: Active Grant

• Current Assignee: Go Daddy Operating Company LLC (GoDaddy, Inc.)
• Original Assignee: Go Daddy Group Incorporated (GoDaddy, Inc.)
• Inventors: Steiner, Jason, Owen, Brad
• Primary Examiner(s): Donaghue, Larry D
• Assistant Examiner(s): Gillis, Brian J
• Application Number:
  US11/011,630
• Publication Number:
  US 20060129644A1
• Time in Patent Office: 1,715 Days
• Field of Search: 709/206, 709/207, 709/224, 709/232
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Systems and methods of the present invention allow filtering out spam and phishing email messages based on the links embedded into the email messages. In a preferred embodiment, an Email Filter extracts links from the email message and obtains desirability values for the links. The Email Filter may route the email message based on desirability values. Such routing includes delivering the email message to a Recipient, delivering the message to a Quarantine Mailbox, or deleting the message.

Claims

1. A method, comprising the steps of:

a) building a general mail corpus, a general spam corpus, a user mail corpus and a user spam corpus,

b) building a general probability table based on said general mail corpus and said general spam corpus, wherein said general probability table comprises a list of tokens and corresponding probabilities of a token being a part of a spam email message,

c) building a user probability table based on said user mail corpus and said user spam corpus, wherein said user probability table comprises a list of tokens and corresponding probabilities of a token being a part of a spam email message,

d) receiving an email message,

e) extracting a link from said email message,

f) downloading a content of a resource referred by said link,

g) parsing said content into a plurality of tokens,

h) finding a token score for each token in said plurality of tokens, comprising the steps of;

h1) searching said user probability table for each token,

h2) if said token is not listed in said user probability table, searching said general probability table for said token, and

h3) if said token is not listed in said general probability table, ignoring said token or setting said token to a nominal value,

i) determining a desirability value for said link, and

j) routing said email message based on said desirability value.

2. The method of claim 1, wherein said link refers to a resource.

3. The method of claim 2, wherein said resource is a webpage or a website.

4. The method of claim 1, wherein said link is a URL.

5. The method of claim 1, wherein said link is an IP address.

6. The method of claim 1, wherein said link is a domain name.

7. The method of claim 1, wherein said routing said email message comprises delivering said email message to a Recipient.

8. The method of claim 1, wherein said routing said email message comprises deleting said email message.

9. The method of claim 1, wherein said routing said email message comprises delivering said email message to a Quarantine Mailbox.

10. A method, comprising the steps of:

a) building a general mail corpus, a general spam corpus, a user mail corpus and a user spam corpus,

b) building a general probability table based on said general mail corpus and said general spam corpus, wherein said general probability table comprises a list of tokens and corresponding probabilities of a token being a part of a spam email message,

c) building a user probability table based on said user mail corpus and said user spam corpus, wherein said user probability table comprises a list of tokens and corresponding probabilities of a token being a part of a spam email message,

d) a Sender transmitting an email message addressed to a Recipient,

e) an Email Filter receiving said email message,

f) said Email Filter extracting a link from said email message,

g) downloading a content of a resource referred by said link,

h) parsing said content into a plurality of tokens,

i) finding a token score for each token in said plurality of tokens, comprising the steps of;

i1) searching said user probability table for each token,

i2) if said token is not listed in said user probability table, searching said general probability table for said token, and

i3) if said token is not listed in said general probability table, ignoring said token or setting said token to a nominal value,

j) a Link Characterization Means determining a desirability value for said link, and

k) said Email Filter routing said email message based on said desirability value.

11. The method of claim 10, wherein said Email Filter comprises a computer program.

12. The method of claim 10, wherein said Email Filter comprises a computer device.

13. The method of claim 10, wherein said Email Filter is located at a Recipient'"'"'s client level.

14. The method of claim 10, wherein said Email Filter is located at a Recipient'"'"'s mail server level.

15. The method of claim 10, wherein said Email Filter is located at a network gateway.

16. The method of claim 10, wherein said Email Filter is located at a Mail Transfer Agent.

17. The method of claim 10, wherein said resource is a webpage or a website.

18. The method of claim 10, wherein said link is a URL.

19. The method of claim 10, wherein said link is an IP address.

20. The method of claim 10, wherein said link is a domain name.

21. The method of claim 10, wherein said routing said email message comprises delivering said email message to said Recipient.

22. The method of claim 10, wherein said routing said email message comprises deleting said email message.

23. The method of claim 10, wherein said routing said email message comprises delivering said email message to a Quarantine Mailbox.

24. The method of claim 10, wherein said Link Characterization Means comprises a computer program.

25. The method of claim 10, wherein said Link Characterization Means comprises a computer device.

26. The method of claim 10, wherein said Link Characterization Means comprises a database, wherein said database includes an ability to store said desirability value for said link.

27. The method of claim 10, wherein said Link Characterization Means comprises a web crawler, wherein said web crawler includes an ability to download said content of said resource.

28. The method of claim 10, wherein said email message travels from said Sender to said Recipient via a computer network.

29. The method of claim 28, wherein said computer network is the Internet.