Spam detection
AssigneeWithsecure Corporation
InventorHeikki Hannikainen
Life of this patent
Estimating the term…
Abstract
A method of determining that a client is likely engaged in the sending of spam emails via a network node. The method comprises, at the network node, defining a message size threshold and a message sending rate threshold, detecting the opening of Simple Mail Transfer Protocol, SMTP connections between a client device and an email server, identifying messages sent from the client over the SMTP connections which exceed said message size threshold and counting the identified messages to determine a client email message sending rate. The method further comprises making an assumption that the client is engaged in the sending of spam emails if the client message sending rate exceeds said message sending rate threshold.
Claims21
A method of determining that a client is likely engaged in the sending of spam emails via a network node, the method comprising, at the network node:
- defining a message size threshold and a message sending rate threshold;
- detecting the opening of Simple Mail Transfer Protocol, SMTP connections between a client device and an email server;
- identifying messages sent from the client over the SMTP connections which exceed said message size threshold and counting the identified messages to determine a client email message sending rate;
- and
- making an assumption that the client is engaged in the sending of spam emails if the client message sending rate exceeds said message sending rate threshold.
A system for determining that a client is likely engaged in the sending of spam emails via a network node, the system comprising the network node configured to:
- define a message size threshold and a message sending rate threshold;
- detect the opening of Simple Mail Transfer Protocol, SMTP connections between a client device and an email server;
- identify messages sent from the client over the SMTP connections which exceed said message size threshold and count the identified messages to determine a client email message sending rate;
- and
- make an assumption that the client is engaged in the sending of spam emails if the client message sending rate exceeds said message sending rate threshold.
(canceled)
Dependencies are inferred from the claim text.