Method and apparatus for electronic mail filtering

• US 8,799,388 B2
• Filed: 08/13/2012
• Issued: 08/05/2014
• Est. Priority Date: 05/18/2007
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Websense UK Ltd. (Forcepoint LLC)
• Inventors: Kay, James
• Primary Examiner(s): BOUTAH, ALINA A
• Application Number:
  US13/584,495
• Publication Number:
  US 20120311058A1
• Time in Patent Office: 722 Days
• Field of Search: 709206-207, 726/22
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 51/226 Delivery according to priorities
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes

Abstract

Messages having a reputation score higher than at least one message already on a queue are added to the queue when the queue has already reached the predetermined maximum permitted size. One or more messages having a low reputation score may be discarded from a bottom of the queue in favor of a new incoming message having a higher reputation score. This may be particularly useful in the context of Internet e-mail, wherein mail delivery protocols (i.e. SMTP) allow a connection for an incoming message to be held open for a limited time period and during this period the message processing apparatus does not assume responsibility for onward transmission of the message. Thus, the message processing apparatus is able to selectively accept only those messages having a highest reputation score for detailed analysis, without adversely affecting the operations performed by other parts of the electronic messaging system.

Claims

1. A method of prioritizing messages, comprising:

receiving one or more first incoming messages from a computer network, the incoming messages having a reputation score below a first threshold;

adding the one or more first incoming messages to a receiving queue;

receiving a second incoming message from the computer network, the second incoming message having a reputation score above the first threshold;

determining via electronic processing circuitry that the receiving queue'"'"'s content is above a capacity threshold;

in response to the determination that the content is above the capacity threshold, selecting a first queued message for removal from the receiving queue based on the selected message having a reputation score below the first threshold;

removing the selected message from the receiving queue; and

adding the second incoming message to the receiving queue.

2. The method of claim 1, further comprising closing an incoming network connection for the removed message.

3. The method of claim 1, further comprising discarding the removed message.

4. The method of claim 1, further comprising removing a second queued message from the receiving queue, in response to the determination, the second queued message having a reputation score below the first threshold.

5. The method of claim 1, wherein the determining is based on a number of messages in the receiving queue or a total quantity of data held within the receiving queue.

6. The method of claim 1, wherein the selection of the first queued message is further based on the reputation score of the first queued message being below reputation scores of other queued messages which have reputation scores that are below the first threshold.

7. A message prioritizing apparatus, comprising:

a processor;

a memory operably connected to the processor, and the memory configured to store;

a message receiving unit configured to receive incoming electronic messages;

a reputation score allocation unit configured to allocate a reputation score to the incoming electronic messages;

a message queuing unit configured to store the electronic messages in a message queue; and

a queue size unit configured to remove one or more electronic messages having a relatively low allocated reputation score from the message queue to make room on the queue to add a new incoming message having a higher reputation score.

8. The apparatus of claim 7, wherein the queue size unit is configured to signal the message receiving unit to close incoming connections for removed messages.

9. The apparatus of claim 7, further comprising a message analysis unit configured to extract-from the message queue a message with the highest reputation score of the messages stored in the message queue, and to analyze the extracted message.

10. The apparatus of claim 7, wherein the message receiving unit is further configured to:

receive each of the incoming messages over a network connection,

hold open each network connection while the reputation score allocation unit allocates the reputation score to the incoming message and the message queuing unit holds the incoming message on the message queue, and

close the network connection for a message when the message is removed from the message queue.

11. The apparatus of claim 10, wherein each of the incoming messages is received over a simple mail transfer protocol (SMTP) connection.

12. A non-transitory, computer readable medium storing instructions that when executed cause a processor to perform a method of:

receiving one or more first incoming messages from a computer network, the incoming messages having a reputation score below a first threshold;

adding the one or more first incoming messages to a receiving queue;

receiving a second incoming message from the computer network, the second incoming message having a reputation score above the first threshold;

determining that the receiving queue'"'"'s content is above a capacity threshold;

in response to the determination that the content is above the capacity threshold, selecting a first queued message for removal from the receiving queue based on the selected message having a reputation score below the first threshold;

removing the selected message from the receiving queue; and

adding the second incoming message to the receiving queue.

13. The non-transitory, computer readable medium of claim 12, further comprising instructions that cause the processor to close an incoming connection for the removed message.

14. The non-transitory, computer readable medium of claim 12, further comprising instructions that cause the processor to discard the removed message.

15. The non-transitory, computer readable medium of claim 12, further comprising instructions that cause the processor to remove a second queued message from the receiving queue in response to the determination, the second message having a reputation score below the first threshold.

16. The non-transitory, computer readable medium of claim 12, wherein the determining is based on a number of messages in the receiving queue or a total quantity of data held within the receiving queue.

17. A message prioritizing apparatus, comprising:

means for receiving one or more first incoming messages from a computer network, the incoming messages having a reputation score below a first threshold;

means for adding the one or more first incoming messages to a receiving queue;

means for receiving a second incoming message from the computer network, the incoming message having a reputation score above the first threshold;

means for determining that the receiving queue'"'"'s content is above a capacity threshold;

means for selecting a first queued message for removal from the receiving queue based on the selected message having a reputation score below the first threshold, wherein the means for selecting is configured to select the first queued message in response to the means for determining'"'"'s determination that the content is above the capacity threshold;

means for removing the selected message from the receiving queue; and

means for adding the second incoming message to the receiving queue.

18. The apparatus of claim 17, further comprising means for closing an incoming connection for the removed message.

19. The apparatus of claim 17, further comprising means for discarding the removed message.

20. The apparatus of claim 17, further comprising means for removing a second queued message from the receiving queue in response to the determining, the second message having a reputation score below the first threshold based on the determining.

21. The apparatus of claim 17, wherein the determining is based on a number of messages in the receiving queue or a total quantity of data held within the receiving queue.