Method and apparatus for scoring unsolicited e-mail

• US 7,761,567 B2
• Filed: 05/04/2009
• Issued: 07/20/2010
• Est. Priority Date: 04/29/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Haverkos, Todd David
• Primary Examiner(s): EL CHANTI, HUSSEIN A
• Application Number:
  US12/435,017
• Publication Number:
  US 20090210507A1
• Time in Patent Office: 442 Days
• Field of Search: 709/204, 709206-207, 709223-225
• US Class Current: 709/224
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases

Abstract

A method for filtering spam is disclosed comprising the steps of: assigning weights to a plurality of recipient e-mail addresses; determining a set of similar e-mails from a plurality of e-mails sent to the recipient addresses; calculating a score based for each set of similar e-mails; placing the score in the header of the e-mail; determining whether the score exceeds a threshold; and responsive to determining that the score exceeds the threshold, tagging and/or filtering the e-mail.

Claims

1. A method for identifying and marking spam e-mails at a server, comprising:

assigning a weight to each of a plurality of e-mail address categories, wherein the weight is based on a probability that an e-mail address category has been captured by a spam sender or a spam address catching program;

determining a set of similar e-mails from a plurality of e-mails sent to the server;

calculating a score for the set of similar e-mails, wherein the score is calculated by adding a plurality of weights, each of the plurality of weights corresponding to an appropriate e-mail address category for each e-mail in the set of similar e-mails;

placing the score in the header of each e-mail in the set of similar e-mails;

determining whether the score exceeds a threshold; and

responsive to determining that the score exceeds the threshold, filtering the e-mail.

2. The method of claim 1 further comprising:

building a database of attributes and attribute values for each of the plurality of e-mails;

tracking the plurality of e-mails based on an alias basis; and

correlating the attributes and attribute values to each of the plurality of e-mails.

3. An apparatus for identifying and marking each e-mail in one or more sets of similar e-mails from a plurality of e-mails, received on a number of different recipient e-mail addresses within a specified period of time at a single server, as spam comprising:

a computer connected to a memory and the internet;

a program stored in the memory and adapted to cause a processor of the computer to perform actions comprising;

establishing a first plurality of e-mail address categories for a single e-mail server;

assigning a weight to each of the first plurality of e-mail address categories;

creating a table containing the plurality of e-mail address categories and a second plurality of weights, each weight corresponding to a single e-mail category;

establishing a third plurality of e-mail attributes;

establishing a threshold;

tracking a fourth plurality of e-mails on an alias basis for the single e-mail server;

building a database for the single e-mail server showing a fifth plurality of values for each e-mail corresponding to the third plurality of e-mail attributes;

using the database, determining one or more sets of similar e-mails by identifying those e-mails in the database having the same attributes and the same values for each of the same attributes;

using the table, determining a weight for each e-mail address in the one or more sets of similar e-mail addresses;

calculating a score for each set of similar e-mails by adding together each weight for each e-mail address in each set;

placing the score in the header of each e-mail in the set;

determining if the score exceeds the threshold;

when the score exceeds the threshold, tagging each e-mail with the score in the header as spam;

wherein each e-mail in the one or more sets of similar e-mails from the plurality of e-mails, received on the number of different recipient e-mail addresses within the specified period of time, is marked as spam.

4. A computer program product for identifying and marking each e-mail in one or more sets of similar e-mails from a plurality of e-mails, received on a number of different recipient e-mail addresses within a specified period of time at a single server, as spam comprising:

a computer readable medium;

a program stored in the computer readable medium and adapted to cause a processor of the computer to perform actions comprising;

establishing a first plurality of e-mail address categories for a single e-mail server;

assigning a weight to each of the first plurality of e-mail address categories;

creating a table containing the plurality of e-mail address categories and a second plurality of weights, each weight corresponding to a single e-mail category;

establishing a third plurality of e-mail attributes;

establishing a threshold;

tracking a fourth plurality of e-mails on an alias basis for the single e-mail server;

building a database for the single e-mail server showing a fifth plurality of values for each e-mail corresponding to the third plurality of e-mail attributes;

using the database, determining one or more sets of similar e-mails by identifying those e-mails in the database having the same attributes and the same values for each of the same attributes;

using the table, determining a weight for each e-mail address in the one or more sets of similar e-mail addresses;

calculating a score for each set of similar e-mails by adding together each weight for each e-mail address in each set;

placing the score in the header of each e-mail in the set;

determining if the score exceeds the threshold;

when the score exceeds the threshold, tagging each e-mail with the score in the header as spam;

wherein each e-mail in the one or more sets of similar e-mails from the plurality of e-mails, received on the number of different recipient e-mail addresses within the specified period of time, is marked as spam.