Method, system, apparatus, and software product for filtering out spam more efficiently

• US 8,135,779 B2
• Filed: 06/07/2005
• Issued: 03/13/2012
• Est. Priority Date: 06/07/2005
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Nokia Corporation
• Inventors: Rainisto, Jonni
• Primary Examiner(s): Joo, Joshua
• Application Number:
  US11/147,981
• Publication Number:
  US 20060277264A1
• Time in Patent Office: 2,471 Days
• Field of Search: 709223-225, 709204-206
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method, network element, system, and software product are presented for differentiating spam from email so that the spam can be deleted, or placed in a separate location, or identified as spam. Email is received at a server, and the email is initially filtered to differentiate at least part of the spam from the other email. Then the filter is improved, for example by using an updated database to identify spam. Subsequently, the email is intermediately filtered to differentiate further spam at least once before a user device attempts to access the email. Some of the further spam was overlooked by the initial filtering, but not overlooked by the intermediate filtering.

Claims

1. A method comprising:

causing, at least in part, reception of at least one email at a server,

initially filtering the at least one email to identify whether the at least one email is a spam email or a non-spam email, the non-spam email being accessible to a user device;

improving the filtering by updating a spam filter;

performing at least one intermediate filtering on the initially identified non-spam email, to further identify whether the initially identified non-spam email is a spam email or a non-spam email using the updated spam filter, at least once before detecting that the user device attempts to access the initially identified non-spam email, a further identified spam email being overlooked by the initial filtering; and

finally filtering the initially or further identified non-spam email in response to the user device attempting to access the initially or further identified non-spam email, while omitting final filtering of the initially or further identified non-spam email, if the spam filter is not updated since the initial filtering or a most recent intermediate filtering,

wherein the intermediate filtering only occurs if there are more than a predetermined amount of initially or further identified non-spam emails to be filtered, or if an email storage threshold is reached at the server.

2. The method of claim 1, wherein the intermediately filtering is performed while maintaining filter processing demand below a filter processing power threshold.

3. The method of claim 1, wherein each of the at least one intermediate filtering only filters a portion of the initially identified non-spam email, after improving the filtering.

4. The method of claim 1, wherein the intermediate filtering occurs if available processing capability exceeds a predetermined threshold.

5. The method of claim 1, wherein the initial filtering and the intermediate filtering have at least one filtering technique in common.

6. The method of claim 5, wherein the at least one filtering technique is updated between said initial filtering and at least one of said intermediate filtering, at least by using an updated database.

7. The method of claim 6, wherein the updated database is developed at least partly by using information gleaned from the initial filtering.

8. The method of claim 1, wherein the initial filtering and each of said at least one intermediate filtering are performed at different time points separated by a predetermined minimum time period.

9. The method of claim 1, wherein the initially identified non-spam email remains accessible to the user device at least until the intermediate filtering.

10. The method of claim 1, wherein each of the at least one intermediate filtering only filters the initially or further identified non-spam mail that is unopened.

11. An apparatus comprising:

at least one processor;

a filter, responsive to receipt of at least one email, configured to initially filter the at least one email to identify whether the at least one email is a spam email or a non-spam email, the non-spam email being accessible to a user device; and

a filter improvement module, configured to update, via the at least one processor, the filter in response to a filter improvement signal,

wherein the filter is also configured to perform at least one intermediate filtering on the initially identified non-spam email, to further identify whether the initially identified non-spam email is a spam email or a non-spam email using the updated filter, at least once before detecting that the user device attempts to access the initially identified non-spam email by the user device, a further identified spam email being overlooked by the initial filtering,

wherein the filter is further configured to finally filter the initially or further identified non-spam email in response to the user device attempting to access the initially or further identified non-spam email, while omitting final filtering of the initially or further identified non-spam email, if the filter is not updated since the initial filtering or a most recent intermediate filtering, and

wherein the intermediate filtering only occurs if there are more than a predetermined amount of initially or further identified non-spam emails to be filtered, or if an email storage threshold is reached.

12. The apparatus of claim 11, wherein the filter is configured to postpone the intermediate filtering in response to a threshold signal indicating that filter processing demand is above a filter processing power threshold.

13. A non-transitory computer readable storage medium carrying one or more sequences of one or more instructions which, when executed by one or more processors, cause an apparatus to at least perform the following steps:

receiving at least one email,

initially filtering the at least one email to identify whether the at least one email is a spam email or a non-spam email, the non-spam email being accessible to a user device;

improving the filtering by updating a spam filter;

performing at least one intermediate filtering on the initially identified non-spam email, to further identify whether the initially identified non-spam email is a spam email or a non-spam email using the updated spam filter, at least once before detecting that the user device attempts to access the initially identified non-spam email, a further identified spam email being overlooked by the initial filtering; and

finally filtering the initially or further identified non-spam email in response to the user device attempting to access the initially or further identified non-spam email, while omitting final filtering of the initially or further identified non-spam email, if the spam filter is not updated since the initial filtering or a most recent intermediate filtering,

wherein the intermediate filtering only occurs if there are more than a predetermined amount of initially or further identified non-spam emails to be filtered, or if an email storage threshold is reached.

14. The non-transitory computer readable storage medium of claim 13, wherein the intermediately filtering is performed while maintaining filter processing demand below a filter processing power threshold.

15. The non-transitory computer readable storage medium of claim 13, wherein the apparatus performs each of the at least one intermediate filtering by only filtering a portion of the initially identified non-spam email, after improving the filtering.

16. The non-transitory computer readable storage medium of claim 13, wherein the initial filtering and the intermediate filtering have at least one filtering technique in common.

17. The non-transitory computer readable storage medium of claim 13, wherein the initial filtering and each of said at least one intermediate filtering are performed at different time points separated by a predetermined minimum time period.

18. The non-transitory computer readable medium storage of claim 13, wherein the apparatus performs each of the at least one intermediate filtering by filtering only the initially or further identified non-spam mail that is unopened.

19. An apparatus comprising:

at least one processor; and

at least one memory including computer program code,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following,

receive at least one email;

initially filter the at least one email to identify whether the at least one email is a spam email or a non-spam email, the non-spam email being accessible to a user device,

improve the filtering by updating a spam filter;

perform at least one intermediate filtering on the initially identified non-spam email, to further identify whether the initially identified non-spam email is a spam email or a non-spam email using the updated spam filter, at least once before detecting that the user device attempts to access the initially identified non-spam email, a further identified spam email being overlooked by the initial filtering; and

finally filter the initially or further identified non-spam email in response to the user device attempting to access the initially or further identified non-spam email, while omitting final filtering of the initially or further identified non-spam email, if the spam filter is not updated since the initial filtering or a most recent intermediate filtering,

wherein the intermediate filtering only occurs if there are more than a predetermined amount of initially or further identified non-spam emails to be filtered, or if an email storage threshold is reached.

20. The apparatus of claim 19, wherein the apparatus performs each of the at least one intermediate filtering by only filtering a portion of the initially identified non-spam email, after improving of the filter.

21. The apparatus of claim 19, wherein the initial filtering and the intermediate filtering have at least one filtering technique in common.

22. The apparatus of claim 19, wherein the initial filtering and each of said at least one intermediate filtering are performed at different time points separated by a predetermined minimum time period.

23. The apparatus of claim 19, wherein the apparatus is further caused to postpone the intermediate filtering in response to a threshold signal indicating that filter processing demand is above a filter processing power threshold.

24. The apparatus of claim 19, wherein the apparatus performs each of the at least one intermediate filtering by filtering only the initially or further identified non-spam mail that is unopened.