Unwanted e-mail filtering system including voting feedback

• US 8,838,714 B2
• Filed: 03/24/2012
• Issued: 09/16/2014
• Est. Priority Date: 02/20/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hart, Matthew Thomas
• Primary Examiner(s): CHOUDHURY, AZIZUL Q
• Application Number:
  US13/429,345
• Publication Number:
  US 20120185550A1
• Time in Patent Office: 906 Days
• Field of Search: None
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04M 1/2478 Telephone terminals specially adapted for non-voice services, e.g. email, internet access centralized arrangements where telephones services are combined H04M7/0024; for recording text messages H04M3/5322; for accessing Internet H04M3/4938
• CPC Class Codes: H04M 3/5322 for recording text messages

Abstract

A filter mechanism for unwanted e-mail messages uses a downloadable central source (1, 2) of filter rule data. User reports of received unwanted e-mail messages are relayed back to the central source of the filter data and used to automatically update that filter data. An algorithmic approach to identifying characteristics of unwanted e-mail messages may be applied based upon the preponderance of predetermined words within an e-mail message or characteristics of the addressee list. If an e-mail message is identified as suspect, but not definitely unwanted, then it may be encapsulated within a HTML document and sent to its addressee together with buttons (28) allowing the recipient to provide feedback in the form of votes as to whether or not that e-mail message is unwanted. This recipient feedback may be used to establish a new local rule.

Claims

1. A method, comprising:

providing message filter rules from a rules database to gateways, wherein the filter rules include at least one rule associated with classifying a suspect email message as unwanted based, at least in part, on a larger number of invalid e-mail addresses as compared to valid e-mail addresses being part of addressee information in the suspect email message;

receiving notifications from at least some of the gateways indicative of a new local message filter rule for at least some of the gateways, wherein the new local message filter rule is associated with an unwanted message received by at least some of the gateways;

counting the received notifications;

determining if a threshold number of the notifications are received from the gateways, which had previously and independently evaluated the suspect email message as being unwanted before the new local message filter rule was generated based on each of the gateways receiving their own respective threshold number of notifications for the suspect email message;

notifying a central authority for confirming the new local message filter rule based, at least in part, on the threshold number of notifications being received from the gateways;

adding the new local message filter rule to the rules database if a confirmation is received from the central authority; and

terminating the counting of the received notifications from the gateways for the suspect email message if the confirmation is not received from the central authority.

2. The method of claim 1, wherein the filter rules are algorithmic filter rules.

3. The method of claim 1, wherein the filter rules comprise scoring algorithms responsive to identification of predetermined words within received messages and a size of the received messages.

4. The method of claim 1, wherein the filter rules comprise scoring algorithms responsive to validity of addressees of received messages.

5. The method of claim 1, wherein the filter rules comprise scoring algorithms responsive to identification of predetermined words within received messages, a size of the received messages, and validity of addressees of the received messages.

6. One or more non-transitory media having logic for execution and when executed by one or more processors is operable to perform operations comprising:

providing message filter rules from a rules database to gateways, wherein the filter rules include at least one rule associated with classifying a suspect email message as unwanted based, at least in part, on a larger number of invalid e-mail addresses as compared to valid e-mail addresses being part of addressee information in the suspect email message;

receiving notifications from at least some of the gateways indicative of a new local message filter rule for at least some of the gateways, wherein the new local message filter rule is associated with an unwanted message received by at least some of the gateways;

counting the received notifications;

determining if a threshold number of the notifications are received from the gateways, which had previously and independently evaluated the suspect email message as being unwanted before the new local message filter rule was generated based on each of the gateways receiving their own respective threshold number of notifications for the suspect email message;

notifying a central authority for confirming the new local message filter rule based, at least in part, on the threshold number of notifications being received from the gateways;

adding the new local message filter rule to the rules database if a confirmation is received from the central authority; and

terminating the counting of the received notifications from the gateways for the suspect email message if the confirmation is not received from the central authority.

7. The non-transitory media of claim 6, wherein the filter rules are algorithmic filter rules.

8. The non-transitory media of claim 6, wherein the filter rules comprise scoring algorithms responsive to identification of predetermined words within received messages and a size of the received messages.

9. The non-transitory media of claim 6, wherein the filter rules comprise scoring algorithms responsive to validity of addressees of received messages.

10. The non-transitory media of claim 6, wherein the filter rules comprise scoring algorithms responsive to identification of predetermined words within received messages, a size of the received messages, and validity of addressees of the received messages.

11. An apparatus, comprising:

a rules database; and

one or more processors operable to execute instructions such that the apparatus is configured for;

providing message filter rules from the rules database to gateways, wherein the filter rules include at least one rule associated with classifying a suspect email message as unwanted based, at least in part, on a larger number of invalid e-mail addresses as compared to valid e-mail addresses being part of addressee information in the suspect email message;

receiving notifications from at least some of the gateways indicative of a new local message filter rule for at least some of the gateways, wherein the new local message filter rule is associated with an unwanted message received by at least some of the gateways;

counting the received notifications;

determining if a threshold number of the notifications are received from the gateways, which had previously and independently evaluated the suspect email message as being unwanted before the new local message filter rule was generated based on each of the gateways receiving their own respective threshold number of notifications for the suspect email message;

notifying a central authority for confirming the new local message filter rule based, at least in part, on the threshold number of notifications being received from the gateways;

adding the new local message filter rule to the rules database if a confirmation is received from the central authority; and

terminating the counting of the received notifications from the gateways for the suspect email message if the confirmation is not received from the central authority.

12. The apparatus of claim 11, wherein the filter rules are algorithmic filter rules.

13. The apparatus of claim 11, wherein the filter rules comprise scoring algorithms responsive to identification of predetermined words within received messages and a size of the received messages.

14. The apparatus of claim 11, wherein the filter rules comprise scoring algorithms responsive to validity of addressees of received messages.

15. The apparatus of claim 11, wherein the filter rules comprise scoring algorithms responsive to identification of predetermined words within received messages, a size of the received messages, and validity of addressees of the received messages.