E-mail spam refers to unsolicited email messages that are sent by “spammers” to large numbers of recipients, few of whom want to receive them. Spamming is undesirable in many ways, including that it costs recipients time to delete the messages, and requires email service providers to provide resources to distribute and/or store the generally unwanted messages. Moreover, sometimes spam is malicious, containing files that if activated can damage the computer system and/or steal sensitive information.
Many different types of filtering algorithms are run against an email message to determine whether that message is spam, so as to block spam messages or move them to a junk folder. However, processing with these algorithms is expensive due to the large amount of CPU time required to scan the messages. Also, the more algorithms that are run, the greater the chance of mislabeling an email message as being spam when it is not. Any technology that reduces the expense that results from processing email messages for spam, and/or reduces the number of mislabeled messages, is desirable.
This Summary is provided to introduce a selection of representative concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used in any way that would limit the scope of the claimed subject matter.
Briefly, various aspects of the subject matter described herein are directed towards a technology by which emails are scanned with selected filters (e.g., algorithms) corresponding to a selected filtering level, which may be chosen based upon any previous email relationships between senders and recipients, and associated reputation data (e.g., whether a previous email communication was detected as spam). In one implementation, when an email message directed from a sender to a recipient is received at a filtering mechanism, the IP address and domain of the sender are validated as to whether this IP address normally sends from the domain identified in the message. If not, an aggressive filtering level is chosen for scanning the message, e.g., all available filters.
If the IP address and domain of the sender validate, the filtering mechanism determines whether the sender and recipient have a previous good (non-spam) email relationship, e.g., by accessing a data store containing relationship and reputation information. If so, a less aggressive filtering level may be chosen for scanning the message, such as to scan with only filters that detect malware, for example.
In one aspect, if a direct relationship between the sender and recipient does not exist (e.g., there are zero or less than a threshold number of communications), the filtering mechanism may look for an indirect relationship. In one implementation, this corresponds to the sender and recipient each having an email relationship with a common third party. If such an indirect relationship exists, the filtering level may be chosen based upon the indirect relationship, and any associated reputation data.
In one aspect, email messages from bulk senders are differentiated from other email messages. Such bulk sender messages may be categorized (e.g., as a retail message, a newsletter and so on), and may be blocked or filtered based upon their bulk sender status and/or category.
Other advantages may become apparent from the following detailed description when taken in conjunction with the drawings.
The present invention is illustrated by way of example and not limited in the accompanying figures in which like reference numerals indicate similar elements and in which:
Various aspects of the technology described herein are generally directed towards enhancing the classification of which emails are spam and which are not, by using social relationships of users (when possible) to determine how aggressive spam filtering will be, and thus how much CPU time is used, in scanning the email message. In addition to taking overall less CPU time, the technology also reduces the number of emails which are mislabeled as spam by not applying more aggressive filtering on emails deemed via the relationship data as likely to be good (that is, not spam).
In one aspect, the technology makes use of the history that users have of sending email back and forth to each other, and uses that information to determine how aggressively email messages are scanned for spam. The technology also may use the relationships between two users to infer new relationships between one of those users and a third user when a new connection between such users is made. In one aspect, the technology also allows classification of (non-spam) bulk senders so that end users can decide what type of bulk email they receive.
It should be understood that any of the examples herein are non-limiting. As such, the present invention is not limited to any particular embodiments, aspects, concepts, structures, functionalities or examples described herein. Rather, any of the embodiments, aspects, concepts, structures, functionalities or examples described herein are non-limiting, and the present invention may be used various ways that provide benefits and advantages in spam detection and email message processing in general.
To filter messages, each incoming message 104 is processed using a number of filtering algorithms, referred to as filters 1061-106n. In general, the filters 1061-106n range in aggressiveness from very aggressive/expensive filters to less aggressive, inexpensive filters. For example, one filter may quickly scan for bad URLs, which is a very fast inexpensive filter, whereas an aggressive filter that scans the message body looking for certain words is a relatively slow, expensive filter. As will be understood, unlike existing filtering systems that apply all of the filters, (or none of them for senders designated by the user as “safe senders”), the number and type of filters that are applied are variable as described herein, based upon information known about the sender and the targeted recipient.
In one aspect, the filtering mechanism 102 selects the aggressiveness of filters (in part) by keeping track in an automated fashion who the end users exchange emails with, as represented in
Another type of information used in determining how aggressive to filter a message 104 corresponds to whether the domain and IP address of the sender are able to be validated, that is, whether this IP address normally sends from the domain identified in the message. To this end, as represented in
As described below, if the sending domain is not validated for sending from the IP (using SPF, DKIM and/or the accumulated IP/Domain data tracked in the data store 110), the filtering mechanism 102 will aggressively filter the message 104. Conversely, if validated, the filtering mechanism 102 checks the relationship/reputation data store 108 to determine whether the sender address and recipient address have a recorded relationship along with reputation information that is used determine a score or the like (e.g., a classification) representative of how likely the message 104 is to be spam. In general, the relationship/reputation data store 108 is built up over time based on messages that are communicated between users and the results of spam scanning with respect to those messages. It is also feasible to obtain some of the relationship data from other sources, to the extent that such information is available and can be trusted. For example, a user may specify that a relationship exists.
If there is a relationship and the accumulated reputation information indicates a low likelihood of the e-mail being a spam message, only inexpensive, lightweight (less aggressive) filters are applied. In the event that the computed score corresponds to unknown or bad reputation information, then set of more aggressive filters is selected and applied. Those messages that are detected as spam are filtered out in some way, e.g., blocked or sent to a junk folder, while those that pass spam filtering detection are delivered as allowed messages 112.
By way of an example, if sender A has sent some threshold number of messages to recipient B, such as five or more messages, and none have ever contained spam, then the likelihood of the next message being spam is low. As can be readily appreciated, the likelihood score or the like may be computed based upon the number of messages sent from that sender to the recipient and/or messages sent from that recipient to the sender; e.g., the more messages the better the score (the lower the likelihood of spam), with any detected spam worsening the score (increasing the likelihood of spam). Note that the relationship and the accumulated reputation information may be aged or weighted based on time, possibly with older data expired, so that eventually a stale relationship may be considered to no longer exist, an old (e.g., incorrectly detected/false positive) “spam” message will not always remain a factor, and so on.
As is known, typical e-mail exchanges tend to cluster around social or business relationships, e.g., a large percentage of email messages that a typical user receives involve the same senders. For such senders and corresponding repeated mail exchanges, the expense and aggressiveness of anti-spam scanning may be lessened where there is little or no risk of spam, without reducing the overall effectiveness of anti-spam detection.
Turning to another aspect, in addition to direct relationships between senders and recipients, indirect relationships may also be used to reduce the aggressiveness of spam filtering. For example, when the filtering mechanism 102 encounters an unknown relationship, the mechanism can scan the data store 108 to see if the sender has a relationship already built with others in the system, and use that information to infer a good relationship. For example if A and B have a good relationship, B and C have a good relationship, but a qualified relationship between A and C does not exist (including when there is some previous communications, but not enough to meet a threshold), the filtering mechanism 102 is able to infer an indirect relationship and thereby filter the mail less aggressively to some extent, (possibly not to the same extent as if there was a direct relationship). For example, instead of an initial score (e.g., zero) indicating no qualified relationship exists, the initial score may be set to some (e.g. non-zero) starting value if there is an indirect relationship.
Note that the above example only describes a relationship through a single intermediary used to determine the indirect relationship, although it is feasible to have more than one intermediary. For example, (A,B), (B,C), (C,D) may represent direct relationships, whereby not only may a single intermediary indirect relationship of (A-C) be inferred, but also a double intermediary indirect relationship (A-D), and so on.
It is possible that a formerly good sender will start sending bad email, such as if that sender's computer becomes infected with malware. To detect such a situation, a small percentage (sampling) of emails may be more aggressively filtered regardless of the reputation/relationship status. To this end, various rules and parameters 114 may be set (e.g., by an administrator) to override the reputation/relationship processing. In the event that a formerly good user starts sending spam in any quantity, any existing relationships will be quickly invalidated. Another situation that can result in a relationship being invalidated is when an end user or administrator reports back to the system that an email message they received was spam/unwanted.
It should be noted that some mail clients/systems provide a “Safe Sender” mechanism for marking email senders as “Safe Senders.” Typically e-mail from Safe Senders is not scanned for spam at all. In contrast, the technology described herein is more efficient and flexible, because rather than excluding e-mails from anti-spam scanning altogether, some scanning may be performed (e.g., at least for malware), with the depth of anti-spam scanning depending on the likelihood of the e-mail message being a spam. Note further that the technology described herein may use broad social networking-style information derived from multiple users, whereas traditional Safe Sender systems are limited to the single user e-mail exchange history and contacts.
Turning to another aspect, the proposed system can also identify when an email address/IP is used for sending legitimate bulk email such as newsletters or sales offers that are legitimate and desired by many users. This may be accomplished by analyzing the volume and type of email the sender is sending out; for example, auto-confirm@bigretalier.com sender may send a very large volume of e-mails across a broad population of users, which can be quickly identified as a legitimate “bulk sender” rather than a spammer, with data for that bulk sender maintained in a suitable data store 116.
Once a bulk sender is identified, a subcategory of what type of mail they send may be set manually by an analyst or an end user to mark the mail as “Mailing list” or “Flyer,” for example, or whatever appropriate categories are desired. In this way, a retailer is categorized differently from a newsletter sender, for example.
Once the bulk mailers are categorized, an end user may specify what types of bulk email they wish to receive and what kinds they do not. For example a home user may wish to receive “Music Industry” email, while a business user does not. Such information may be maintained in the rules/parameters 114 and accessed to determine how to handle a bulk message, including on a per email system (e.g., the administrator blocks all bulk messages from company X, or of category Y) or on per-user basis.
Step 206 represents validating the domain with the IP address. As described above, this may be based upon information accumulated in the domain/IP data store 110, and/or via SPF/DKIM. If not validated, then the filtering level is set to the most aggressive level at step 218, where the corresponding filters for this level (e.g., all available) will be applied at step 220.
If the domain and IP address validate, steps 208 and 210 check whether any qualified, direct relationship exists. If so, the filtering level is set based upon the direct relationship and the reputation score at step 216. The corresponding filters for this filtering level (e.g., if a good reputation, only those that scan for malware) will be applied at step 220. Note that if the reputation is bad, the filtering level is increased accordingly, and may, for example, correspond to the most aggressive level.
If no direct relationship exists as evaluated at step 210, step 212 looks for whether a common relationship exists through a third party (only one intermediary is checked in this example implementation). If so as evaluated at step 214, the filtering level may be set based upon the indirect relationship (and possibly a reputation score based on the third party reputation) at step 216, and applied at step 220.
As described above, step 220 applies the filters that correspond to the filtering level determined via the previous steps. Step 220 also represents updating the data stores based on the IP address and domain, the to/from data, and/or the scanning results.
If not blocked, step 308 checks whether the domain and IP address validate. If not, then there is a possibility that the sender is not actually the bulk sender, but a spammer, whereby the filtering is set to the most aggressive level at step 310, and applied at step 314. Otherwise the filtering is set to a bulk sender level (which may vary by category) at step 312, generally to some less aggressive level since known good bulk senders do not send spam unless hacked. Step 314 also represents updating the databases as appropriate for the bulk message, e.g., a bulk sender may be sending from a new IP address, in which event the domain and new IP address will eventually validate at step 308.
As can be seen, by analyzing the history of message exchanges to determine associations of e-mail domains and authorized IP addresses used to send e-mails for these domains, and using this in combination with relationship/reputation data of the to and from email addresses, a filtering system may determine how aggressively an email message is scanned for spam. The social network of users may be further analyzed to determine if an indirect relationship exists between two users, with that information used to set an initial relationship value, for example, by which some less aggressive filtering may be chosen. Further, the system may implement the automatic identification of good bulk mail senders, so that the bulk sender can be manually classified by administrators and/or end users, with its messages correspondingly handled and/or scanned.
One of ordinary skill in the art can appreciate that the various embodiments and methods described herein can be implemented in connection with any computer or other client or server device, which can be deployed as part of a computer network or in a distributed computing environment, and can be connected to any kind of data store or stores. In this regard, the various embodiments described herein can be implemented in any computer system or environment having any number of memory or storage units, and any number of applications and processes occurring across any number of storage units. This includes, but is not limited to, an environment with server computers and client computers deployed in a network environment or a distributed computing environment, having remote or local storage.
Distributed computing provides sharing of computer resources and services by communicative exchange among computing devices and systems. These resources and services include the exchange of information, cache storage and disk storage for objects, such as files. These resources and services also include the sharing of processing power across multiple processing units for load balancing, expansion of resources, specialization of processing, and the like. Distributed computing takes advantage of network connectivity, allowing clients to leverage their collective power to benefit the entire enterprise. In this regard, a variety of devices may have applications, objects or resources that may participate in the resource management mechanisms as described for various embodiments of the subject disclosure.
Each computing object 410, 412, etc. and computing objects or devices 420, 422, 424, 426, 428, etc. can communicate with one or more other computing objects 410, 412, etc. and computing objects or devices 420, 422, 424, 426, 428, etc. by way of the communications network 440, either directly or indirectly. Even though illustrated as a single element in
There are a variety of systems, components, and network configurations that support distributed computing environments. For example, computing systems can be connected together by wired or wireless systems, by local networks or widely distributed networks. Currently, many networks are coupled to the Internet, which provides an infrastructure for widely distributed computing and encompasses many different networks, though any network infrastructure can be used for exemplary communications made incident to the systems as described in various embodiments.
Thus, a host of network topologies and network infrastructures, such as client/server, peer-to-peer, or hybrid architectures, can be utilized. The “client” is a member of a class or group that uses the services of another class or group to which it is not related. A client can be a process, e.g., roughly a set of instructions or tasks, that requests a service provided by another program or process. The client process utilizes the requested service without having to “know” any working details about the other program or the service itself.
In a client/server architecture, particularly a networked system, a client is usually a computer that accesses shared network resources provided by another computer, e.g., a server. In the illustration of
A server is typically a remote computer system accessible over a remote or local network, such as the Internet or wireless network infrastructures. The client process may be active in a first computer system, and the server process may be active in a second computer system, communicating with one another over a communications medium, thus providing distributed functionality and allowing multiple clients to take advantage of the information-gathering capabilities of the server.
In a network environment in which the communications network 440 or bus is the Internet, for example, the computing objects 410, 412, etc. can be Web servers with which other computing objects or devices 420, 422, 424, 426, 428, etc. communicate via any of a number of known protocols, such as the hypertext transfer protocol (HTTP). Computing objects 410, 412, etc. acting as servers may also serve as clients, e.g., computing objects or devices 420, 422, 424, 426, 428, etc., as may be characteristic of a distributed computing environment.
As mentioned, advantageously, the techniques described herein can be applied to any device. It can be understood, therefore, that handheld, portable and other computing devices and computing objects of all kinds are contemplated for use in connection with the various embodiments. Accordingly, the below general purpose remote computer described below in
Embodiments can partly be implemented via an operating system, for use by a developer of services for a device or object, and/or included within application software that operates to perform one or more functional aspects of the various embodiments described herein. Software may be described in the general context of computer executable instructions, such as program modules, being executed by one or more computers, such as client workstations, servers or other devices. Those skilled in the art will appreciate that computer systems have a variety of configurations and protocols that can be used to communicate data, and thus, no particular configuration or protocol is considered limiting.
With reference to
Computer 510 typically includes a variety of computer readable media and can be any available media that can be accessed by computer 510. The system memory 530 may include computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) and/or random access memory (RAM). By way of example, and not limitation, system memory 530 may also include an operating system, application programs, other program modules, and program data.
A user can enter commands and information into the computer 510 through input devices 540. A monitor or other type of display device is also connected to the system bus 522 via an interface, such as output interface 550. In addition to a monitor, computers can also include other peripheral output devices such as speakers and a printer, which may be connected through output interface 550.
The computer 510 may operate in a networked or distributed environment using logical connections to one or more other remote computers, such as remote computer 570. The remote computer 570 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, or any other remote media consumption or transmission device, and may include any or all of the elements described above relative to the computer 510. The logical connections depicted in
As mentioned above, while exemplary embodiments have been described in connection with various computing devices and network architectures, the underlying concepts may be applied to any network system and any computing device or system in which it is desirable to improve efficiency of resource usage.
Also, there are multiple ways to implement the same or similar functionality, e.g., an appropriate API, tool kit, driver code, operating system, control, standalone or downloadable software object, etc. which enables applications and services to take advantage of the techniques provided herein. Thus, embodiments herein are contemplated from the standpoint of an API (or other software object), as well as from a software or hardware object that implements one or more embodiments as described herein. Thus, various embodiments described herein can have aspects that are wholly in hardware, partly in hardware and partly in software, as well as in software.
The word “exemplary” is used herein to mean serving as an example, instance, or illustration. For the avoidance of doubt, the subject matter disclosed herein is not limited by such examples. In addition, any aspect or design described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects or designs, nor is it meant to preclude equivalent exemplary structures and techniques known to those of ordinary skill in the art. Furthermore, to the extent that the terms “includes,” “has,” “contains,” and other similar words are used, for the avoidance of doubt, such terms are intended to be inclusive in a manner similar to the term “comprising” as an open transition word without precluding any additional or other elements when employed in a claim.
As mentioned, the various techniques described herein may be implemented in connection with hardware or software or, where appropriate, with a combination of both. As used herein, the terms “component,” “module,” “system” and the like are likewise intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on computer and the computer can be a component. One or more components may reside within a process and/or thread of execution and a component may be localized on one computer and/or distributed between two or more computers.
The aforementioned systems have been described with respect to interaction between several components. It can be appreciated that such systems and components can include those components or specified sub-components, some of the specified components or sub-components, and/or additional components, and according to various permutations and combinations of the foregoing. Sub-components can also be implemented as components communicatively coupled to other components rather than included within parent components (hierarchical). Additionally, it can be noted that one or more components may be combined into a single component providing aggregate functionality or divided into several separate sub-components, and that any one or more middle layers, such as a management layer, may be provided to communicatively couple to such sub-components in order to provide integrated functionality. Any components described herein may also interact with one or more other components not specifically described herein but generally known by those of skill in the art.
In view of the exemplary systems described herein, methodologies that may be implemented in accordance with the described subject matter can also be appreciated with reference to the flowcharts of the various figures. While for purposes of simplicity of explanation, the methodologies are shown and described as a series of blocks, it is to be understood and appreciated that the various embodiments are not limited by the order of the blocks, as some blocks may occur in different orders and/or concurrently with other blocks from what is depicted and described herein. Where non-sequential, or branched, flow is illustrated via flowchart, it can be appreciated that various other branches, flow paths, and orders of the blocks, may be implemented which achieve the same or a similar result. Moreover, some illustrated blocks are optional in implementing the methodologies described hereinafter.
While the invention is susceptible to various modifications and alternative constructions, certain illustrated embodiments thereof are shown in the drawings and have been described above in detail. It should be understood, however, that there is no intention to limit the invention to the specific forms disclosed, but on the contrary, the intention is to cover all modifications, alternative constructions, and equivalents falling within the spirit and scope of the invention.
In addition to the various embodiments described herein, it is to be understood that other similar embodiments can be used or modifications and additions can be made to the described embodiment(s) for performing the same or equivalent function of the corresponding embodiment(s) without deviating therefrom. Still further, multiple processing chips or multiple devices can share the performance of one or more functions described herein, and similarly, storage can be effected across a plurality of devices. Accordingly, the invention is not to be limited to any single embodiment, but rather is to be construed in breadth, spirit and scope in accordance with the appended claims.