System And Method For Rating Unsolicited eMail
What It Does (in plain English):
This invention describes a crowd-sourced process for determining if communications (e.g., email) are unwanted and unsolicited (e.g., SPAM). In this system and method, an email user receives and email and, upon reading it, determines it to be either wanted or unwanted. If the email is unwanted, then the user hits a ‘SPAM’ reporting button to a central processing system. Based on the number of unwanted email reports submitted for a given message, a connected email server can mark other copies of this email (and also their sender) as an unwanted email. When other copies of this email are sent to additional users, the email server will place them in a temporary unwanted email holding folder rather than into a user’s main inbox. This allows users to have a cleaner inbox, but also be able to review emails that the system has marked as ‘unwanted’ and subsequently quarantined.
A system and method for an e-mail rating system, where e-mail senders are evaluated based upon past performance. When an individual receives an email message and determines it to be SPAM, they notify a central database, repository or server. This central server, known as a Span Detection Server or SDS, maintains a list of e-mail senders and their associated spam rating. Spam thresholds are applied to incoming e-mail by a spam filter in conjunction with the SDS. Depending upon the sender’s rating as compared to these thresholds, a received message is classified as desirable, undesirable or conditional.
1. Field of the Invention
The present invention relates to data processing methods and systems, and in particular relates to methods and systems for managing e-mail, and more particularly relates to techniques for rating unsolicited e-mail or spam.
2. Background of the Invention
Of the 3.33 trillion e-mail messages sent in 2002, unsolicited and undesirable e-mail (i.e. spam) accounted for about 34% of these messages. By 2006, spam is expected to reach 52% of the total e-mail traffic worldwide. Such spam traffic not only consumes valuable system resources in the routing, delivery and intermediary storage of such spam, but also consumes and wastes the time of end-users who typically must manually filter/delete such unwanted spam messages that are received by the end-user’s email system.
Many tools that combat spam have come about in recent years. There tools have features such as: blacklists/whitelists, content analysis tools, behavioral analysis tools, sender address validation, spam fingerprint tools and graphics scanning tools to check for pornography. While some very elaborate systems to detect and report spam have come about, spam still gets through to end-users. Although automated systems work faster, it is also true that the human user can more accurately identify which e-mails are considered undesirable. While that is true, most users do not want to perpetually report spam—even if reporting would provide a future benefit.
It would thus be desirable to provide an improved spam detection system and method that combines the benefits of human intervention accuracy and automation speed/efficiency.
The present invention is directed to a system and method for an e-mail rating system, where e-mail senders are evaluated based upon past performance. When an individual receives an email message and determines it to be SPAM, they notify a central database, repository or server. This central server, known as a Spam Detection Server or SDS, maintains a list of e-mail senders and their associated spam rating based on user notifications to this central server. Senders who continue to send spam after such notification will receive a lower rating than someone who does not send spam.
All messages received by the e-mail receiver are classified as desirable, undesirable, or conditional, based upon the sender’s previously established rating. This classification can either be performed by the receiver’s e-mail client or by the receiver’s internet service provider (ISP). Spam thresholds are applied to incoming e-mail by a spam filter in conjunction with the SDS. Depending upon the sender’s rating as compared to these thresholds, a received message is classified as desirable, undesirable or conditional. Messages that fall within the desirable range are delivered to the recipient immediately. Messages received from senders having a low, undesirable rating are moved into an undesirable storage area and periodically deleted after some predefined period of time. Messages from senders whose rating falls within the conditional range are handled in two ways. At first, the messages are held in a conditional storage area for a specified period of holding time, after which they are sent to the intended recipient(s). Secondly, during the intervening wait period of time, i.e. before expiration of the specified period of conditional holding time, it is possible that the sender’s rating will vary either up or down. If so, the received message being held in the conditional storage area is handled according to whether the sender is subsequently rated in the desirable or undesirable range as determined by the spam threshold.
The spam server can either operate as a standalone service over the Internet, as a plug-in to an ISP’s or existing e-mail server, or as a plug-in to a user’s e-mail client.
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
Referring now to
The e-mail is sent to the appropriate receiver’s ISP 104 based on this intended receiver’s address. The receiver’s ISP will then forward this e-mail on to the e-mail receiver or recipient 106. This is typically a computer or portable electronic device (e.g. personal, digital assistant or cell phone) having hardware and/or software capable of receiving, storing and displaying e-mail messages for an end-user. In this particular embodiment, there is a spam filter 108 that is associated with and operates in conjunction with the e-mail receiver 106. This spam filter selectively passes e-mails received from receiver ISP 104 and which are destined to e-mail receiver 106. This selective passage of emails is accomplished in concert with Spam Detection Server (SDS) 110. SDS 110 is a centralized server that maintains ratings for senders of e-mail using database 112. The operation of system 100 will now be described with reference to
Referring now to
Turning now to
Referring now to
The sender ratings which are maintained by Spam Detection Server 110 or 310 are influenced by determinations made by end-users who receive emails at email receivers such as 106 and 306. When an end user receives an email message and they determine that it is unsolicited spam, a notification is sent to the SDS that spam has been received. This notification also includes the sender’s email address. This sender’s email address can optionally include wildcards such as an ‘*’, so that emails from an entire domain could be flagged as being undesirable. For example, the email address sent from the user in the server spammer notification could be ‘*.irq’, and all email addresses at the irq domain would be rated as being undesirable by the user. To return this global spam rating, a dialogue box is optionally presented to the end-user when they desire to flag an email message as spam, and this dialogue box includes the sender’s email address. This sender’s email address is modifiable by the end-user to allow them to modify the sender’s address to include such global wildcards.
The end-user initiates the spam notification action in one of several different ways. For intelligent email systems with integrated spam functionality, such as a plug-in module that installs a Spam Server Notification toolbar on the email client system, the user would select such toolbar upon receipt of undesirable spam, and the email client system would automatically send a spam notice to the spam server. Alternatively, the user could forward the received spam to some centralized server address, such as ‘abuse@SDS.com’.
The Spam Detection Server 110/310 maintains sender ratings in a database 112/312. These ratings are influenced by receipt of spam notifications by end users who receive unsolicited e-mail. While there are many ways to rate senders, the approach taken here is as follows.
A sender is initially given a rating of five hundred (500), which is the default acceptable spam threshold. A rating of five hundred is a conditional rating, meaning that the sender’s status as being a spammer is not presently known. A numeric rating greater than five hundred means that the sender is not a spammer, and a numeric rating equal to or less than four hundred fifty means the sender is a spammer. Of course, other scales and thresholds are possible within the scope of the present invention, such as use of a rating range of 0-to-9 or 0-to-99, for example. Similarly, spammers could be given ratings greater than the spam threshold and good (non-spam) email could be given ratings less than the threshold. In the preferred embodiment, as previously mentioned, the sender’s rating is initialized to five hundred, meaning a conditional rating, and ratings greater than five hundred (500) are considered good, acceptable, or desirable ratings. If the SDS subsequently receives a spam notification from a receiver for a particular sender, that sender’s rating is decreased by one (1). If the SDS subsequently receives a spam notification from a receiver for this particular sender, that sender’s rating is also decreased by one (1). Because the bad/unacceptable threshold is set at four hundred fifty (450), fifty end users would have to send a spammer notice to this SDS for a particular sender in order to place the sender’s rating at a value that is less than the unacceptable spam threshold of four hundred fifty. This lower rating would then be sent to the spam filter upon receipt of any subsequent emails from this sender, as previously described with respect to
As can be seen by the user email data store 316, 318 and 320 in
For example, when the very first email from a given sender is received, the sender’s status is initialized to a rating of five hundred (500), meaning that the email is placed in the conditional holding queue as its status as being spam is unknown (since this is the first email message received from this particular sender). If the user views mail in their Conditional Spam mailbox, and determines that the email is in fact spam, the user would notify the SDS as previously described, resulting in a lowering of the sender’s spam rating. If fifty or more receivers notified the SDS that this is spam, the senders rating would be decremented by one for each receiver notice, resulting in the sender having a spam value below the unacceptable spam rating threshold. Upon a subsequent periodic scanning of the Conditional Spam mailbox by the email client system, any email from this sender would be reclassified as undesirable spam based on this lower rating, and all such emails in the Conditional Spam mailbox would then be moved to the Undesirable Spam mailbox for purging during the next purge interval of the Undesirable Spam mailbox.
It is also possible that the sender with the conditional rating has actually had an improvement made to their spam rating. This is possible since the SDS server knows what emails were sent to a recipient/receiver from a particular sender such as by maintaining an email traffic log. If no negative spammer notice is received by the server after some predetermined time period such as one day or one week, the server presumes that the email was desirable/acceptable to the receiver, and was not spam. In that case, the rating of the sender will be updated by the SDS accordingly, such as by increasing the spam rating by one for each sent email that is presumed to be acceptable. In this way, a sender who has been labeled as a spammer (by having a spam rating below the unacceptable spam threshold) can actually rehabilitate their rating by sending out good/acceptable emails which effectively counter-balances any bad/unacceptable emails that were previously sent.
Assuming the spam rating for emails in the Conditional Spam mailbox have not dropped below the unacceptable threshold, and have not risen above the acceptable threshold, then after some period of time (the conditional queue hold time), these conditional emails are sent to their intended recipients for normal processing. Thus, an email from a new sender that does not yet have a spam rating is effectively delayed in delivery to the intended recipient. This allows for the possibility that others will label the sender as being a spammer while the email is in a given end-user’s Conditional Spam mailbox, thereby causing the unread email to subsequently be placed in the end-users Spam mailbox without any action from that particular end user.
In effect, the conditional holding queue for Conditional Spam merely results in delayed delivery of emails if the sender’s rating doesn’t change during the conditional queue hold time. If the sender’s rating does change during the conditional queue hold time, the email is treated according to whether the sender’s rating has changed to unacceptable or acceptable, using techniques as previously described.
It is important to note that while the present invention has been described in the context of a fully functioning data processing system, those of ordinary skill in the art will appreciate that the processes of the present invention are capable of being distributed in the form of a computer readable medium of instructions and a variety of forms and that the present invention applies equally regardless of the particular type of signal bearing media actually used to carry out the distribution. Examples of computer readable media include recordable-type media such a floppy disc, a hard disk drive, a RAM, CD-ROMs, and transmission-type media such as digital and analog communications links.
The description of the present invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiment was chosen and described in order to best explain the principles of the invention, the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.