36 results about "Email filtering" patented technology

The present invention is an adaptive method for filtering spam by using the reputations associated with recipients of email messages to determine the reputations of message and content attributes, then using the attribute reputations to determine whether or not the email message is spam and then using the determination of spam to update the reputations associated with the recipients of the email message. The present invention can also be used in conjunction with existing spam algorithms. Optionally, training of existing spam algorithms may be implemented by the use of recipient reputations or training types derived from recipient reputations.

Systems and methods of the present invention allow filtering out spam and phishing email messages based on the links embedded into the email messages. In a preferred embodiment, an Email Filter extracts links from the email message and obtains desirability values for the links. The Email Filter may route the email message based on desirability values. Such routing includes delivering the email message to a Recipient, delivering the message to a Quarantine Mailbox, or deleting the message.

Various embodiments of the invention address two critical problems that current email service providers face. First, there is the problem of maintaining high levels of customer service when email server systems are inundated with spam. Second, there is the problem of reducing the system-wide impact that spam has on the email delivery system. Current embodiments are directed to determining whether an email message is an unwanted bulk email message without necessarily considering the message that is conveyed by any portion of the email message. Through analyses of patterns of delivery of these email messages, profiles are built that allow an email server to ascertain whether there is a likelihood that any one particular email message constitutes an unwanted email message. If an email message is determined to likely constitute an unwanted email message, then memory-saving measures are implemented. In preferred embodiments, one copy of the email message is saved at a central, shared location that can be accessed by each of the intended recipients. This avoids having to replicate the email message across the system for each of the recipients.

The invention provides a system and a method for anti-phishing emails based on link domain name and user feedback. The system comprises an email receiving device, an email pre-processing device, an email property judging device, an outputting device and a feedback processing device. The method comprises the following steps: analyzing characteristics of the link domain name in the email, combiningwith a controlled network user feedback strategy, and identifying phishing emails and doubtful phishing emails. The invention has advantages of high identification efficiency, low resource consumptionand no error rate. The invention can be configured to email servers, gateway servers and the like that require high real-time performance, protect the controlled network user against cheating by thephishing emails, resist the interference from the spiteful user in the controlled network, and can be widely applied to the application fields of network email filtering management, anti-phishing attack and the like.

An Email filtering system is disclosed which comprises: a user interface module is mounted on a server and allows access by one or more end-users; a database module containing one or more configuration options relating to the end-users, and which is connected to the interface and allows configuration options to be set and altered by the end-users; a SMTP listener module connected to the database module and to an incoming data stream containing Email messages, and whose behaviour is controlled on an Email by Email basis by the configuration options; a scanning engine module connected to the database module and to the SMTP listener module, so that the configuration options for the end-users modify the scanning engine module behaviour on an Email by Email basis; and a SMTP relay module connected to the database module and to the scanning engine module for SMTP Email delivery to end-user Email. The present invention also comprises a process for filtering Email which involves listening to a data stream comprising SMTP Email messages to detect the Email messages; processing the Email messages according to one or more configuration options specific to one or more end-users stored in a user database; transferring the Email messages to a scanning engine module; scanning the Email messages for the presence of viruses, spam or unwanted content according to the configuration options specific to the end-users; and transferring the Email messages not containing viruses, spam or unwanted content to an SMTP relay module. The invention also comprises a process for modifying the configuration options specific to one or more end-users stored in a user database by displaying to the end-users said one or more configuration options; modifying the configuration options according to the preferences of the end-users; and transmitting the new configuration options to the database.

The invention provides a novel system for email users to provide feedback to email routing, filtering and classification systems. The invention uses email generated by standard email client software as the transport mechanism for providing this feedback, and thereby eliminates the need for custom, client-side software to be installed on the user's computer.

A document classification system updates the logistic regression parameters of the logistic regression algorithm used to classify the documents, using a coherent gradient method based upon the coherency between the update data regarding the classifications of the documents and the combined data including both the update data and the original data used to generate the original logistic regression parameters. The classification system can be applied to an email filtering system for filtering spam email.

The invention discloses a sensitive email filtering system and method based on a client / server mode and particularly relates to a method for filtering out sensitive emails in real time without an email proxy server or an email gateway. The method can be used for detecting, analyzing and intercepting titles, text, attachment names and attachment content of sent emails in real time.

The invention provides a spam email filtering system and a method capable of intelligently selecting training samples. Sample sets which are labeled in categories and sample sets which are not labeled in categories are initialized; samples in the labeled sample sets are used as a training set to train an initial classification model, and uncertainty of every unlabeled sample in the unlabeled sample sets are computed through the classification model, and the uncertainty refers to uncertainty of the samples belonging to categories; P samples with large uncertainty are selected in the samples which are not labeled in category, and the unlabeled P samples are labeled in category; the labeled samples are added in a final training set as labeled samples, and a novel category model is constructed on the final training set. The model is used for filtering emails, and determining whether an email is a spam email or a legal email. According to the spam email filtering system and the method, people can avoid learning samples which are not greatly favorable for category, and accuracy of the classification model is improved.

The invention provides a spam detection device and a method based on user relationship mining and credit evaluation. The detection device comprises a user relationship modeling device, a fingerprint collecting device, a path mining device, an email evaluating device, an email outputting device, a user evaluating device and a credit updating device. The method comprises the following steps: establishing a user relationship model according to the user communication relationship in a controlled network, then mining a specific path set according to the user relationship model, and finally establishing email determination records through the historical evaluation of the user on the path set and identifying email attributes. The device has the advantages that the device has good identification ability and can well identify malicious users and resist the interferences of the malicious users, can be deployed at entrances and exits of an email server, a gateway and a backbone network and be widely applied in the email filtering technology and other application fields.

The present invention is an adaptive method for filtering spam by using the reputations associated with recipients of email messages to determine the reputations of message and content attributes, then using the attribute reputations to determine whether or not the email message is spam and then using the determination of spam to update the reputations associated with the recipients of the email message. The present invention can also be used in conjunction with existing spam algorithms. Optionally, training of existing spam algorithms may be implemented by the use of recipient reputations or training types derived from recipient reputations.

The invention is suitable for the computer network field, which provides a method, a device and a piece of equipment for filtering e-mails. The method comprises the steps as follows: the address messages of a sender and a receiver are acquired; IP addresses are filtered according to the IP address in the address message of the sender; when the IP address of the mail fails to pass the IP filtration, a white list corresponding to the address message of the receiver is enquired according to the mail address in the address message of the sender and a white list check is then conducted on the mail. The invention carries out the IP address filtration after the sender establishes an IP connection, and performs the white list recheck on the mail which fails to pass the IP address filtration, thus preventing the mail in the user white list from being intercepted mistakenly without influencing the regular communications while processing junk e-mails.

A local gateway device receives email across the internet from a sender of the email and forwards it across the internet to an email filtering system. The email filtering system analyzes the email to determine whether it is spam, phishing or contains a virus and sends it back to the local gateway device along with the filtered determination. The local gateway device forwards the received email and the filtered determination to a local junk store which handles the email appropriately. For example, if the email has been determined to be spam, phishing or containing a virus, the junk store can quarantine the email and if the email has been determined to be non-spun and / or not phishing and / or not containing a virus, the junk store can forward the email to a local mail server for delivery.

A system and machine-implemented method for automatically generating an email filter based on social networking groups, including receiving an indication of one or more social groups associated with a user, wherein each of the one or more social groups is associated with the user's account in a social networking service, determining, using the one or more computing devices, one or more contacts associated with each of the one or more social groups associated with the user at the social networking service, determining, using the one or more computing devices, one or more email addresses corresponding to each of the one or more contacts, generating an email filter according to the one or more email addresses and applying the generated email filter to an email list of a user.

Social network email filtering is described. A user's address book includes a first group of email addresses. Those email addresses are used to identify address books that include another group of email addresses. Multiple iterations may be used to identify several groups of email addresses, representing a user's social network. When an email message addressed to the user is received, the message is trusted if the sending email address is within the user's social network. Otherwise, the message is flagged as junk mail. Varying trust levels may be applied to messages that are received based on a distance within a social network between the sending email address and the user and / or how often the sending email address appears within the social network.

An end to end email monitoring system which monitors and verifies the ability of a client mail system to send and receive email messages to and from local and remote networks. The monitor tests inbound email flow, internal email services, database availability, and outbound email flow. It uses checksums for precise identification and allows emails from multiple client environments to arrive in a single, shared Internet test account. The use of multiple targets for email verification eliminates false positives due to a single email destination being unavailable. Moreover, SNMP alerting is used in addition to email alerting to provide an out of band notification method. The SNMP alerting has been enhanced to send the identification of the tested email server as the source. The monitor stores historical information for 45 days and can produce detailed reports summarizing outage events and delay occurrences in addition to providing real-time alerts.

A local gateway device receives email across the internet from a sender of the email and forwards it across the internet to an email filtering system. The email filtering system analyzes the email to determine whether it is spam, phishing or contains a virus and sends it back to the local gateway device along with the filtered determination. The local gateway device forwards the received email and the filtered determination to a local junk store which handles the email appropriately. For example, if the email has been determined to be spam, phishing or containing a virus, the junk store can quarantine the email and if the email has been determined to be non-spun and / or not phishing and / or not containing a virus, the junk store can forward the email to a local mail server for delivery.

A system and machine-implemented method for automatically generating an email filter based on social networking groups, including receiving an indication of one or more social groups associated with a user, wherein each of the one or more social groups is associated with the user's account in a social networking service, determining, using the one or more computing devices, one or more contacts associated with each of the one or more social groups associated with the user at the social networking service, determining, using the one or more computing devices, one or more email addresses corresponding to each of the one or more contacts, generating an email filter according to the one or more email addresses and applying the generated email filter to an email list of a user.

Various embodiments of the invention address two critical problems that current email service providers face. First, there is the problem of maintaining high levels of customer service when email server systems are inundated with spam. Second, there is the problem of reducing the system-wide impact that spam has on the email delivery system. Current embodiments are directed to determining whether an email message is an unwanted bulk email message without necessarily considering the message that is conveyed by any portion of the email message. Through analyses of patterns of delivery of these email messages, profiles are built that allow an email server to ascertain whether there is a likelihood that any one particular email message constitutes an unwanted email message. If an email message is determined to likely constitute an unwanted email message, then memory-saving measures are implemented. In preferred embodiments, one copy of the email message is saved at a central, shared location that can be accessed by each of the intended recipients. This avoids having to replicate the email message across the system for each of the recipients.

An email filter updating system includes a tracking component, and a logic component. The tracking component is provided to track user navigation. This tracking compiles information about websites the user has visited and presumably may “trust” in the event an email associated with one such site or application is later received by the user's email application. The logic component uses information and a set of configurable rule-based criteria to output a characterization that a particular email message has been initiated from a site that the user has visited or should otherwise trust. The characterization is then provided to the email filter to control whether in-bound email is passed to the user's email client inbox. Further, the logic component is operative to generate filter update commands that update the email filter in an automated manner, i.e., without user input.

The invention provides a system and a method for anti-phishing emails based on link domain name and user feedback. The system comprises an email receiving device, an email pre-processing device, an email property judging device, an outputting device and a feedback processing device. The method comprises the following steps: analyzing characteristics of the link domain name in the email, combiningwith a controlled network user feedback strategy, and identifying phishing emails and doubtful phishing emails. The invention has advantages of high identification efficiency, low resource consumption and no error rate. The invention can be configured to email servers, gateway servers and the like that require high real-time performance, protect the controlled network user against cheating by thephishing emails, resist the interference from the spiteful user in the controlled network, and can be widely applied to the application fields of network email filtering management, anti-phishing attack and the like.

The invention relates to an email filtering using relationship and reputation data. The subject disclosure is directed towards reducing the amount of resources needed to scan email messages for spam. In general, the previous email relationship between a sender and recipient, if any, may be considered in determining how aggressive the filtering level is set for scanning a message for spam, e.g., which filters will be used in the scan. For existing relationships where there has been no previously detected spam (there is good reputation data associated with the relationship), a less aggressive filtering level may be used, thereby saving resources. A relationship may be directly between the sender and recipient, or may be indirect, e.g., via a common third party. Also described is differentiating email from bulk senders from other email messages, for different handling, including spam filtering.

The invention provides a junk email filtering system and method based on user behaviour classification. The junk email filtering system comprises a user behaviour classification module, a topological comparability filtering module and an email processing module; the user behaviour classification module comprises a user behaviour classifier and a user type judger; and the topological comparability filtering module comprises a topological comparability filter and an auxiliary filter. The model provided by the invention can effectively extract normal users and junk users according to user sending behaviour characteristics; the number of emails in need of being deeply filtered is reduced; the performance of an email gateway system is improved; and simultaneously, the overall precision rate and the recall rate can be increased.

An email filter updating system includes a tracking component, and a logic component. The tracking component is provided to track user navigation. This tracking compiles information about websites the user has visited and presumably may “trust” in the event an email associated with one such site or application is later received by the user's email application. The logic component uses information and a set of configurable rule-based criteria to output a characterization that a particular email message has been initiated from a site that the user has visited or should otherwise trust. The characterization is then provided to the email filter to control whether in-bound email is passed to the user's email client inbox. Further, the logic component is operative to generate filter update commands that update the email filter in an automated manner, i.e., without user input.

An email message delivery system is disclosed that enables the efficient processing and delivery of email messages by selectively sampling and scanning email messages prior to delivering the email messages to its intended recipients. The system selects an email message for processing and determines a group for the email message. The system determines a sampling probability for the group and based on the sampling probability determines whether the email message is selected for scanning. If the email message is selected for scanning, the system scans content of the email message and based on the scanning, determines whether the email message is to be filtered out. If the email message is not to be filtered out based on the scanning, the system relays the email message for delivery to the recipient.

Described is a technology by which an email filtering service or other gateway includes hybrid proxy and store-and-forward logic. A message is initially processed with proxy logic. If the proxy logic is unable to complete filtering / scanning of a message within a timeout period, the store-and-forward logic is invoked to complete filtering / scanning of the message. The store-and-forward logic also may be invoked if a delivery attempt made by the proxy logic fails or does not complete prior to a delivery timeout period. When such a condition is met, the store-and-forward logic accepts the message, including storing the message, sending a response that indicates the message was accepted, and closing the connection over which the message was received. The store-and-forward logic may complete any scanning if not completed by the proxy logic, and takes over delivery responsibilities.

The technology described herein visibly depicts hidden message traits to help users determine whether an email is genuine or deceptive. The hidden message traits are revealed by identifying and changing attributes that keep the hidden traits from being displayed in a rendered message. Spam messages, phishing messages, and messages that include or link to malicious programs (e.g., malware, ransomware) are examples of unwanted messages that can harm a recipient. These messages often rely on deception to get past email filtering systems and to trick a user into acting on content in a message. The deception often involves including hidden traits in a message that fool an automated filtering system. The technology described herein shows the visible traits to a user by including them in the rendered version of the message.

This invention discloses email filtering using relationship and reputation data. The present invention is directed to reducing the amount of resources required to scan email for spam. Typically, previous email relationships, if any, between the sender and recipient can be considered to determine how aggressively to set the filtering level used to scan messages for spam, eg, which filters to use in the scan. For existing relationships where there is no previously detected spam (with good reputation data associated with the relationship), a less aggressive filtering level may be used, thus saving resources. The relationship between sender and recipient can be direct, or can be indirect, eg, via a common third party. Distinguishing emails from bulk senders from other email messages for different processing, including spam filtering, is also described.