Collecting, aggregating, and managing information relating to electronic messages

• US 7,653,695 B2
• Filed: 02/17/2005
• Issued: 01/26/2010
• Est. Priority Date: 02/17/2004
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Ironport Systems (Cisco Systems, Inc.)
• Inventors: Peterson, Patrick R., Olivier, Michael V., Sprosts, Craig, Flury, Andrew, Banister, Scott
• Primary Examiner(s): Abdullahi; Salad
• Assistant Examiner(s): Hussain; Imad
• Application Number:
  US11/062,320
• Publication Number:
  US 20050193076A1
• Time in Patent Office: 1,804 Days
• Field of Search: 709/206
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages

Abstract

A method and apparatus for managing information relating to electronic messages is provided. A first set of data related to one or more message senders is obtained from a first source, such as an email sever or email gateway. Each message sender has sent one or more electronic messages. A second set of data related to the one or more message senders is obtained from a second source. Message volume information that describes the messages sent by the one or more message senders for a period of time is determined based on the first set of data and the second set of data. The message volume information may be used to determine whether a particular message sent by a particular message sender is unsolicited. If a particular message is determined to be unsolicited, various actions may be performed on messages sent by the sender of the particular message.

Claims

1. A method for managing information relating to electronic messages, comprising the steps of:

receiving, from a plurality of message information collectors, message information that describes characteristics of a set of electronic messages received by the plurality of message information collectors,

wherein the message information is separate and distinct from the set of electronic messages which it describes;

processing, at a data processing unit, the message information to generate message volume information, wherein the message volume information describes characteristics of a set of message senders of electronic messages over a period of time, wherein each of the set of message senders sent one or more of the set of electronic messages identified in the message information, and

wherein the message volume information includes a prediction metric that indicates a likelihood that a particular message sender, of the set of message senders, has been sending unsolicited commercial electronic messages; and

providing, to an email gateway, the prediction metric and at least one other characteristic of the particular message sender described in the message volume information, wherein at least the prediction metric and the at least one other characteristic are used by the email gateway in determining whether to treat a particular electronic message, sent by the particular message sender, received by the email gateway, as an unsolicited commercial electronic message,

wherein said particular message sender is a second email gateway;

wherein the email gateway is separate from the data processing unit;

wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises the step of;

determining how many requests for information about the particular message sender were received during a particular period of time;

wherein the method is performed by one or more computing devices.

2. The method of claim 1, wherein the plurality of message information collectors include one or more of an email gateway, an information request handler, and an email client.

3. The method of claim 1, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises the step of:

determining when a message was sent by the particular message sender.

4. The method of claim 1, wherein:

the particular message sender is associated with a particular Internet Protocol (IP) address, and

the step of processing, at the data processing unit, the message information to generate the message volume information comprises the steps of;

determining second message volume information for the particular message sender based on the particular IP address, and

determining a network topology for the particular message sender based on the particular IP address.

5. The method of claim 4, wherein:

the step of determining the network topology for the particular message sender comprises determining other IP addresses that share high-order significant bits with the particular IP address, and

the step of determining the second message volume information comprises determining third message volume information related to a second set of message senders associated with the other IP addresses.

6. The method of claim 1, wherein:

the step of processing, at the data processing unit, the message information to generate the message volume information comprises the step of determining a category associated with a particular message sender of the set of message senders, and

the generation of the prediction metric is performed, at least in part, using the category.

7. The method of claim 1, wherein:

the step of processing, at the data processing unit, the message information to generate the message volume information comprises determining second message volume information related to the particular message sender,

the particular message sender is associated with a network owner,

the network owner is associated with a category,

the step of determining the second message volume information comprises determining a second category for the particular message sender based on the category associated with the network owner, and

wherein the second message volume information reflects the second category.

8. The method of claim 7, further comprising the step of:

at the email gateway, modifying the delivery of any messages sent from message senders, of the set of message senders that are associated with the second category.

9. The method of claim 1, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises the step of:

determining a geographical location of the particular message sender.

10. The method of claim 9, wherein the step of determining the geographical location of the particular message sender is performed based on an IP address associated with the particular message sender.

11. The method of claim 1, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises the step of:

determining a set of geographical locations for a set of gateways through which the particular electronic message, sent by the particular message sender, has traveled.

12. The method of claim 1, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises the step of:

determining whether a particular condition is satisfied by the message volume information.

13. The method of claim 12, further comprising the steps of:

receiving a request, from a user, to subscribe to a user alert, wherein said user alert is associated with the particular condition; and

if the message volume information indicates that the particular condition is satisfied, then sending a communication to the user indicating that the particular condition has been satisfied.

14. The method of claim 1, wherein generation of the prediction metric is performed, at least in part, using information regarding a change in ownership of an IP address associated with the particular message sender.

15. The method of claim 1, further comprising the steps of:

receiving a request for information about the message volume information; and

displaying a graphical user interface that comprises one or more panels, wherein each of the one or more panels displays, at least a portion of, the message volume information.

16. The method of claim 1, further comprising the steps of:

receiving a request for information about the message volume information; and

providing the message volume information through an electronic interface.

17. The method of claim 1, further comprising the step of:

estimating a volume of messages sent by the particular message sender during the period of time based on how many requests for information, about the particular message sender during the period of time, were received.

18. The method of claim 1, wherein the prediction metric comprises one value in a sequence of values, and wherein the position of each value in the sequence of values indicates a relative likelihood that messages sent by the particular sender are unsolicited commercial electronic messages.

19. The method of claim 1, wherein:

the method further comprises the step of receiving, from a second plurality of message information collectors, second message information related to, at least a portion of, the set of message senders, and

the generation of the message volume information is based, at least in part, on the second message information.

20. The method of claim 19, wherein the plurality of message information collectors and the second plurality of message information collectors are the same plurality of message information collectors;

and wherein the step of receiving the message information and the step of receiving the second message information are performed at different points in time.

21. The method of claim 1, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises:

determining a first volume of messages sent by the particular message sender during a first time period;

determining a second volume of messages sent by the particular message sender during a second time period; and

determining a change in volume between the first volume of messages and the second volume of messages.

22. The method of claim 21, wherein

the step of determining the first volume of messages comprises determining a first relative magnitude of volume of messages sent by the particular message sender in relation to other message senders, of the set of message senders, during the first time period,

the step of determining the second volume of messages further comprises determining a second relative magnitude of volume of messages sent by the particular message sender in relation to the other message senders, of the set of message senders, during the second time period, and

the generation of the prediction metric is based, at least in part, on the first relative magnitude of volume of messages and the second relative magnitude of volume of messages.

23. The method of claim 1, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises:

determining a percentage of messages sent by the particular message sender relative to the messages sent by a set of other message senders.

24. The method of claim 1, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises:

determining a logarithm of the percentage of messages sent by the particular message sender relative to the messages sent by other message senders.

25. A method of managing information relating to electronic messages, comprising the steps of:

receiving at an email gateway, from a particular message sender, one or more electronic messages;

sending, to a data processing unit that is separate from said email gateway, a request for message volume information related to the particular message sender;

receiving the message volume information related to the particular message sender, wherein the message volume information describes a set of characteristics of the particular message sender over a period of time,

wherein the message volume information is generated based on message information received from a plurality of message information collectors,

wherein the message volume information includes a prediction metric that indicates a likelihood that the particular sender has been sending unsolicited commercial electronic messages, and

wherein the message volume information includes a value based at least in part on the number of requests for information about the particular message sender that were received during a particular period of time;

determining how to modify the delivery of a plurality of messages to one or more recipients, from the particular message sender based, at least in part, on the prediction metric and at least one other characteristic of the particular message sender described in the message volume information; and

modifying the delivery of a plurality of messages to one or more recipients from the particular message sender based on the prediction metric in the message volume information;

wherein said particular message sender is a second email gateway;

wherein the method is performed by one or more computing devices.

26. The method of claim 25, wherein the step of modifying the delivery of a plurality of messages comprises (a) automatically associating the plurality of messages with a particular folder of an email client, (b) deleting the particular message, (c) indicating that the plurality of messages are bulk mail, (d) indicating that the plurality of messages are unsolicited, or (e) throttling the messages.

27. The method of claim 25, further comprising the steps of:

receiving a second plurality of messages from a second message sender;

determining that the particular message sender is related to the second message sender; and

modifying the delivery of the second plurality of messages from the second message sender based on the message volume information related to the particular message sender.

56. The method of claim 25, wherein the step of modifying the delivery of a plurality of message comprises at least one of (a) labeling messages from the particular message sender as spam, (b) throttling messages from the particular message sender based on the message volume information, or (c) blocking messages from the particular message sender from being delivered.

28. A machine-readable volatile or non-volatile medium storing one or more sequences of instructions for managing information relating to electronic messages, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

receiving, from a plurality of message information collectors, message information that describes characteristics of a set of electronic messages received by the plurality of message information collectors;

wherein the message information is separate and distinct from the set of electronic messages which it describes;

processing, at a data processing unit, the message information to generate message volume information, wherein the message volume information describes characteristics of a set of message senders of electronic messages over a period of time, wherein each of the set of message senders sent one or more of the set of electronic messages identified in the message information, and

wherein the message volume information includes a prediction metric that indicates a likelihood that a particular message sender, of the set of message senders, has been sending unsolicited commercial electronic messages; and

providing, to an email gateway, the prediction metric and at least one other characteristic of the particular message sender described in the message volume information, wherein at least the prediction metric and the at least one other characteristic are used by the email gateway in determining whether to treat a particular electronic message, sent by the particular sender, received by the email gateway, as an unsolicited commercial electronic message,

wherein said particular message sender is a second email gateway;

wherein the email gateway is separate from the data processing unit;

wherein the processing, at the data processing unit, the message information to generate the message volume information comprises;

determining how many requests for information about the particular message sender were received during a particular period of time.

29. The machine-readable medium of claim 28, wherein the plurality of message information collectors include at least one of an email gateway, an information request handler, and an email client.

30. The machine-readable medium of claim 28, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises the step of:

determining when a message was sent by the particular message sender.

31. The machine-readable medium of claim 28, wherein:

the particular message sender is associated with a particular Internet Protocol (IP) address, and

the step of processing, at the data processing unit, the message information to generate the message volume information comprises the steps of;

determining second message volume information for the particular message sender based on the particular IP address, and

determining a network topology for the particular message sender based on the particular IP address.

32. The machine-readable medium of claim 31, wherein:

the step of determining the network topology for the particular message sender comprises determining other IP addresses that share high-order significant bits with the particular IP address, and

the step of determining the second message volume information comprises determining third message volume information related to a second set of message senders associated with the other IP addresses.

33. The machine-readable medium of claim 28, wherein:

the step of processing, at the data processing unit, the message information to generate the message volume information comprises the step of determining a category associated with a particular message sender of the set of message senders, and

the generation of the prediction metric is performed, at least in part, using the category.

34. The machine-readable medium of claim 28, wherein:

the step of processing, at the data processing unit, the message information to generate the message volume information comprises determining second message volume information related to the particular message sender,

the particular message sender is associated with a network owner,

the network owner is associated with a category,

the step of determining the second message volume information comprises determining a second category for the particular message sender based on the category associated with the network owner, and

wherein the second message volume information reflects the second category.

35. The machine-readable medium of claim 34, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the step of:

at the email gateway, modifying the delivery of any messages sent from message senders, of the set of message senders that are associated with the second category.

36. The machine-readable medium of claim 28, wherein the step of determining the processing, at the data processing unit, the message information to generate volume information comprises the step of:

determining a geographical location of the particular message sender.

37. The machine-readable medium of claim 36, wherein the step of determining the geographical location of the particular message sender is performed based on an IP address associated with the particular message sender.

38. The machine-readable medium of claim 28, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises the step of:

determining a set of geographical locations for a set of gateways through which the particular electronic message, sent by from the particular sender, has traveled.

39. The machine-readable medium of claim 28, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises the step of:

determining whether a particular condition is satisfied by the message volume information.

40. The machine-readable medium of claim 39, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the steps of:

receiving a request, from a user, to subscribe to a user alert, wherein said user alert is associated with the particular condition; and

if the message volume information indicates that the particular condition is satisfied, then sending a communication to the user indicating that the particular condition has been satisfied.

41. The machine-readable medium of claim 28, wherein the generation of the prediction metric is performed, at least in part, using information regarding a change in ownership of an IP address associated with the particular message sender.

42. The machine-readable medium of claim 28, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the steps of:

receiving a request for information about the message volume information; and

displaying a graphical user interface that comprises one or more panels, wherein each of the one or more panels displays, at least a portion of, the message volume information.

43. The machine-readable medium of claim 28, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the steps of:

receiving a request for information about the message volume information; and

providing the message volume information through an electronic interface.

44. The machine-readable medium of claim 28, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the step of:

estimating a volume of messages sent by the particular message sender during the period of time based on how many requests for information, about the particular message sender during the period of time, were received.

45. The machine-readable medium of claim 28, wherein the prediction metric comprises one value in a sequence of values, and wherein the position of each value in the sequence of values indicates a relative likelihood that messages sent by the particular sender are unsolicited commercial electronic messages.

46. The machine-readable medium of claim 28, wherein:

the method further comprises the step of receiving, from a second plurality of message information collectors, second message information related to, at least a portion of, the set of message senders, and

the generation of the message volume information is based, at least in part, on the second message information.

47. The machine-readable medium of claim 46, wherein the plurality of message information collectors and the second plurality of message information collectors are the same plurality of message information collectors;

and wherein the step of receiving the message information and the step of receiving the second message information are performed at different points in time.

48. The machine-readable medium of claim 28, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises:

determining a first volume of messages sent by the particular message sender during a first time period;

determining a second volume of messages sent by the particular message sender during a second time period; and

determining a change in volume between the first volume of messages and the second volume of messages.

49. The machine-readable medium of claim 48, wherein

the step of determining the first volume of messages comprises determining a first relative magnitude of volume of messages sent by the particular message sender in relation to other message senders, of the set of message senders, during the first time period,

the step of determining the second volume of messages further comprises determining a second relative magnitude of volume of messages sent by the particular message sender in relation to the other message senders, of the set of message senders, during the second time period, and

the generation of the prediction metric is based, at least in part, on the first relative magnitude of volume of messages and the second relative magnitude of volume of messages.

50. The machine-readable medium of claim 28, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises:

determining a percentage of messages sent by the particular message sender relative to the messages sent by a set of other message senders.

51. The machine-readable medium of claim 28, wherein the step of processing, at the data processing unit, the message information to generate the message volume information comprises:

determining a logarithm of the percentage of messages sent by the particular message sender relative to the messages sent by other message senders.

52. A machine-readable volatile or non-volatile medium storing one or more sequences of instructions for managing information relating to electronic messages, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

receiving at an email gateway, from a particular message sender, one or more electronic messages;

sending, to a data processing unit that is separate from said email gateway, a request for message volume information related to the particular message sender;

receiving the message volume information related to the particular message sender, wherein the message volume information describes a set of characteristics of the particular message sender over a period of time,

wherein the message volume information is generated based on message information received from a plurality of message information collectors,

wherein the message volume information includes a prediction metric that indicates a likelihood that the particular sender has been sending unsolicited commercial electronic messages, and

wherein the message volume information includes a value based at least in part on the number of requests for information about the particular message sender were received during a particular period of time;

determining how to modify the delivery of a plurality of messages to one or more recipients, from the particular sender based, at least in part, on the prediction metric and at least one other characteristic of the particular message sender described in the message volume information; and

modifying the delivery of a plurality of messages to one or more recipients from the particular message sender based on the prediction metric in the message volume information;

wherein said particular message sender is a second email gateway.

53. The machine-readable medium of claim 52, wherein the step of modifying the delivery of a plurality of messages comprises (a) automatically associating the plurality of messages with a particular folder of an email client, (b) deleting the plurality of messages, (c) indicating that the plurality of messages are bulk mail, (d) indicating that the plurality of messages are unsolicited, or (e) throttling the messages.

54. The machine-readable medium of claim 52, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to further perform the steps of:

receiving a second plurality of messages from a second message sender;

determining that the particular message sender is related to the second message sender; and

modifying the delivery of the second plurality of messages from the second message sender based on the message volume information related to the particular message sender.

57. The machine-readable medium of claim 52, wherein the step of modifying the delivery of a plurality of messages comprises at least one of (a) labeling messages from the particular message sender as spam, (b) throttling messages from the particular message sender based on the message volume information, or (c) blocking messages from the particular message sender from being delivered.

55. A system for managing information relating to electronic messages, comprising:

a plurality of message information collectors, wherein each of the plurality of message information collectors is configured to transmit message information to a data processing unit,

wherein the message information that is sent by a particular message information collector, of the plurality of message information collectors, to the data processing unit describes characteristics of a set of electronic messages received by the particular message information collector,

wherein the message information is separate and distinct from the set of electronic messages which it describes; and

the data processing unit, wherein the data processing unit is configured to perform the steps of;

processing the message information received by the data processing unit to generate message volume information,

wherein the message volume information describes characteristics of a set of message senders of electronic messages over a period of time, wherein each of the set of message senders sent one or more of the set of electronic messages identified in the message information, and

wherein the message volume information includes a prediction metric that indicates a likelihood that a particular message sender, of the set of message senders, has been sending unsolicited commercial electronic messages; and

providing, to an email gateway, the prediction metric and at least one other characteristic of the particular message sender described in the message volume information, wherein at least the prediction metric and the at least one other characteristic are used by the email gateway in determining whether to treat a plurality of electronic messages, sent by the particular message sender, received by the email gateway, as unsolicited commercial electronic messages,

wherein said particular message sender is a second email gateway;

wherein the email gateway is separate from the data processing unit;

wherein the processing the message information received by the data processing unit to generate the message volume information comprises;

determining how many requests for information about the particular message sender were received during a particular period of time.