Detecting spam e-mail with backup e-mail server traps

• US 7,650,382 B1
• Filed: 04/24/2003
• Issued: 01/19/2010
• Est. Priority Date: 04/24/2003
• Status: Expired due to Fees

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: McCorkendale, Bruce, Sobel, William E
• Primary Examiner(s): JEAN GILLES, JUDE
• Application Number:
  US10/425,123
• Time in Patent Office: 2,462 Days
• Field of Search: 709204-209, 709/219, 709/201, 709/245, 709/228, 709/224, 709/223, 715/531, 715/530, 707/3, 707/6, 707/100
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A domain (101) has a primary e-mail server (103) with an e-mail delivery address (109), and at least one backup e-mail server (105) with an e-mail delivery address (111). A trap manager (115) adds at least one trap e-mail delivery address (113) to an e-mail delivery address list (107) associated with the domain (101), the trap e-mail delivery address (113) resembling a backup e-mail server delivery address (111) and pointing to the trap manager (115). The trap manager (115) receives (201) e-mail sent to the trap address (113), and determines whether received e-mail comprises spam (119).

Claims

1. A computer implemented method for detecting spam e-mail received by a domain, the domain having a primary e-mail server with an e-mail delivery address, and at least one backup e-mail server with an e-mail delivery address, the method comprising the steps of:

adding at least one trap e-mail delivery address to an e-mail delivery address list associated with the domain, the trap e-mail delivery address resembling a backup e-mail server delivery address and pointing to the trap manager;

a trap manager receiving e-mail sent to the trap address;

the trap manager determining whether the primary e-mail server is reachable by an e-mail sender; and

using a determination that the primary e-mail server is reachable by an e-mail sender as an indication that the received email is spam, and subsequently classifying the received email as spam.

2. The method of claim 1 wherein:

the trap manager is associated with the primary e-mail server.

3. The method of claim 2 wherein:

the trap manager comprises a transparent proxy associated with the primary e-mail server.

4. The method of claim 2 wherein:

the trap manager comprises a component of the primary e-mail server.

5. The method of claim 2 wherein:

the trap manager comprises a plug-in to the primary e-mail server.

6. The method of claim 1 wherein:

the trap manager is associated with a non-primary e-mail server.

7. The method of claim 1 wherein:

the trap manager comprises a transparent proxy associated with a back-up e-mail server.

8. The method of claim 1 wherein:

the trap manager comprises a component of a back-up e-mail server.

9. The method of claim 1 wherein:

the trap manager comprises a plug-in to a back-up e-mail server.

10. The method of claim 1 wherein:

the trap manager comprises a component of a special e-mail server.

11. The method of claim 1 further comprising the step of:

the trap manager routing the received e-mail to a backup e-mail server, responsive to the determination that the primary e-mail server is unreachable by an e-mail sender.

12. The method of claim 1 further comprising the step of:

the trap manager acting as a backup e-mail server, and processing the received e-mail according to appropriate e-mail processing logic.

13. The method of claim 1 wherein:

the step of adding at least one trap e-mail delivery address to an e-mail delivery address list associated with the domain is performed by the trap manager.

14. A computer implemented method for detecting spam e-mail received by a domain, the domain having a primary e-mail server with an e-mail delivery address, and at least one backup e-mail server with an e-mail delivery address, the method comprising the steps of:

adding at least one trap e-mail delivery address to an e-mail delivery address list associated with the domain, the trap e-mail delivery address resembling a backup e-mail server delivery address and pointing to the trap manager, the trap manager being associated with the primary e-mail server;

receiving e-mail by the trap manager;

determining whether the primary e-mail server is reachable by an e-mail sender; and

classifying the received e-mail as spam, responsive to a determination that the primary e-mail server is reachable by an e-mail sender.

15. The method of claim 14 wherein:

the step of adding at least one trap e-mail delivery address to an e-mail delivery address list associated with the domain is performed by the trap manager.

16. A tangible computer readable medium containing a computer program product for detecting spam e-mail received by a domain, the domain having a primary e-mail server with an e-mail delivery address, and at least one backup e-mail server with an e-mail delivery address, the computer program product comprising:

program code to facilitate adding at least one trap e-mail delivery address to an e-mail delivery address list associated with the domain, the trap e-mail delivery address resembling a backup e-mail server delivery address and pointing to the trap manager;

program code for enabling the trap manager to receive e-mail sent to the trap address;

program code for enabling the trap manager to determine whether the primary e-mail server is reachable by an e-mail sender; and

program code for enabling the trap manager to, responsive to a determination that the primary e-mail server is unreachable by an e-mail sender, use the determination as an indication that the received email is legitimate, and subsequently classifying the received email as legitimate.

17. The tangible computer readable medium of claim 16 further comprising:

program code for enabling the trap manager to determine that received e-mail was addressed to the trap address.

18. The tangible computer readable medium of claim 16 wherein:

the trap manager is associated with a non-primary e-mail server.

19. The tangible computer readable medium of claim 16 further comprising:

program code for enabling the trap manager to use a determination that the primary e-mail server is unreachable by an e-mail sender as a factor in the classification of the received e-mail as legitimate.

20. The tangible computer readable medium of claim 19 further comprising:

program code for enabling the trap manager to act as a backup e-mail server, and processing the received e-mail according to appropriate e-mail processing logic.

21. A computer system for detecting spam e-mail received by a domain, the domain having a primary e-mail server with an e-mail delivery address, and at least one backup e-mail server with an e-mail delivery address, the computer program system comprising:

a list seeding module, stored on a tangible medium, for adding at least one trap e-mail delivery address to an e-mail delivery address list associated with the domain, the trap e-mail delivery address resembling a backup e-mail server delivery address and pointing to a trap manager;

a reception module, stored on a tangible medium, for receiving e-mail sent to the trap address, the reception module being communicatively coupled to the list seeding module; and

a determination module, stored on a tangible medium, for determining whether the primary e-mail server is reachable by an e-mail sender, using a determination that the primary e-mail server is reachable by an e-mail sender as an indication that the e-mail sent to the trap address is spam, and subsequently classifying the received email as spam, the determination module being communicatively coupled to the reception module.

22. The computer system of claim 21 wherein:

the determination module is further adapted to determine whether received e-mail was addressed to the trap address.