E-mail management services

• US 8,725,889 B2
• Filed: 03/01/2007
• Issued: 05/13/2014
• Est. Priority Date: 02/19/2002
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Petry, Scott M., Akamine, Shinya, Lund, Peter Kevin, Cox, Fred, Oswall, Michael John
• Primary Examiner(s): Cheema, Umar
• Application Number:
  US11/712,675
• Publication Number:
  US 20070156830A1
• Time in Patent Office: 2,630 Days
• Field of Search: 709206-230
• US Class Current: 709/230
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention provides an electronic message management system (EMS) that includes a real-time feedback loop where data is collected from the electronic messages on incoming connection attempts, outgoing delivery attempts, and message content analysis, and written to a centralized data matrix. A separate process accesses the data matrix and analyzes trends in that data. The detected data patterns, trends or behavior is based on configuration parameters for the recipient. Based on these determinations, the process is able to instruct components in the EMS to accept, redirect, refuse, modify, defer, or otherwise dispose of the connection request, the delivery attempt, or the message. Associated methods for managing the transmission of electronic messages are also disclosed.

Claims

1. A messaging system for managing the transmission of electronic messages from sending mail servers having a network domain associated therewith, comprising:

an intermediate service that comprises a message management system and intercepts the electronic messages from a sending mail server to a destination mail server before the electronic messages are received at any gateway to a network having the destination mail server and any terminals connected thereto for receiving incoming electronic messages from the destination mail server;

a data structure that stores source data and destination data for at least some of the electronic messages and metadata derived from at least some of the electronic messages;

an interpreter process that analyzes the source data, destination data, and metadata stored in the data structure to detect message traffic patterns;

responsive to the detected message traffic patterns violating at least one predetermined rule, said interpreter process updating disposition instructions for subsequent electronic messages; and

a computer process that is coupled to the data structure and the interpreter process, the computer process managing the transmission of a subsequent electronic message according to the disposition instructions thereby managing the transmission of the subsequent electronic message.

2. The messaging system of claim 1, wherein managing the transmission of the subsequent electronic message comprises determining a status of the electronic message to be one of spam email or not spam email.

3. The messaging system of claim 1, wherein the disposition instructions comprise instructions including:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message redirect;

connection rejection; and

black hole.

4. The messaging system of claim 1, wherein the predetermined rule is based, at least in part, on a number of electronic messages sent from an internet protocol address associated with the network domain using the stored source data.

5. The messaging system of claim 1, wherein the predetermined rule is based, at least in part, on a number of electronic messages sent from an internet protocol address associated with the network domain and identified as spam using the stored source data and metadata.

6. The messaging system of claim 1, wherein the predetermined rule is based, at least in part, on a number of electronic messages sent from an internet protocol address associated with the network domain and identified as having unwanted attachments or unwanted content using the stored source data and metadata.

7. The messaging system of claim 1, wherein the computer process further comprises:

a traffic monitor that collects incoming SMTP connection data, or message metadata, or both, associated with at least some of the electronic messages; and

wherein the computer process further comprises;

the interpreter process that is associated with the traffic monitor, and

a mail handler that blocks the transmission of the subsequent electronic message based on the disposition instructions.

8. The messaging system of claim 1, wherein the metadata derived from the electronic messages that may be used by the interpreter to detect message traffic patterns includes:

count of connection attempts from a source IP address;

count of current open connections form source IP address;

duration of connections from source IP address;

count of messages from source IP address;

count of messages from a network domain;

message size;

count of recipients on messages;

count of spam messages from a source IP address;

count of virus infected messages from a source IP address;

count of messages from a source IP address with unwanted binary attachment;

count of messages from a source IP address with unwanted content; and

count of messages from a source IP address against which the disposition option was blocked, black-holed, spooled, or quarantined.

9. A method of managing the transmission of incoming electronic messages from sending email servers having respective network domains associated therewith, wherein electronic messages from the sending mail servers comprise source data, comprising:

intercepting the electronic messages sent from the sending mail servers to the destination mail servers before the electronic messages are received by any gateway to a network having one of the destination mail servers and any terminals connected thereto receiving incoming electronic messages from the destination mail server;

storing the source data and destination data for at least some of the incoming electronic messages;

supplementing the source data with metadata derived from at least some of the electronic messages; and

an interpreter process that analyzes the source data, destination data, and metadata stored in the data structure to detect message traffic patterns;

responsive to the detected message traffic patterns violating at least one predetermined rule, said interpreter process updating disposition instructions for subsequent electronic messages; and

managing the transmission of a subsequent electronic message according to the disposition instructions thereby managing the transmission of the electronic message.

10. The method of claim 9, wherein managing the transmission of the subsequent electronic message comprises determining a status of the electronic message to be one of spam email or not spam email.

11. The method of claim 9, wherein the disposition instructions comprise instructions selected from the group including:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message redirect;

connection rejection; and

black hole.

12. The method of claim 9, wherein the metadata derived from the electronic messages that may be used by the interpreter to detect message traffic patterns includes:

count of connection attempts from a source IP address;

count of current open connections from a source IP address;

duration of connections from a source IP address;

count of messages from a source IP address;

count of messages from a network domain;

message size;

count of recipients on messages;

count of spam messages from a source IP address;

count of virus infected messages from a source IP address;

count of messages from a source IP address with unwanted binary attachment;

count of messages from a source IP address with unwanted content; and

count of messages from a source IP address against which the disposition option was blocked, black-holed spooled, or quarantined.