System and method for analyzing and managing spam e-mail
AssigneeMicrosoft Corporation
InventorsNancy Pettigrew, Amit Jhawar
Life of this patent
Estimating the term…
Abstract
The present invention provides an improved system and method for analyzing spam e-mail. The system and method monitors instances of spam across a distributed network, and creates and stores records of these instances as encoded information strings, which are attached to each message as a header. The system and method use information and statistics obtained from the information strings to dynamically create, modify and retire rules for analyzing and managing spam e-mail. The system also allows analysts to dynamically create, modify and retire rules based upon feedback regarding unidentified spam messages and false positives.
Claims30
A dynamic email spam analysis and management system comprising:
- a database including a plurality of spam rules, each of the plurality of spam rules having attributes including a score;
- a spam analyzer operable to process a log file received from each of a plurality of message switches, each message switch processing an email against each of the plurality of spam rules thus determining if the processed email will be marked as spam, and for each match between the processed email and each of the plurality of spam rules, each message switch creating an entry in its log file corresponding to the processed email and the matching spam rule wherein each entry includes the score from each matching spam rule, the spam analyzer operable to update the attributes of at least one of the plurality of spam rules in the database, the updating including modifying the score of the at least one of the plurality of spam rules, the updating based on statistics calculated from at least one of the log files, wherein the spam analyzer is distinct from each of the plurality of message switches, and wherein each of the plurality of message switches are software being executed on one of a plurality of mail servers;
- and
- a select rules file including one or more select rules from the database of the plurality of spam rules, each of the one or more select rules being included in the select rules file based on its attributes, the select rules file being replicated to each of the message switches.
A dynamic email spam analysis and management system comprising:
- a message switch including a spam filter operable to receive an email message wherein the message switch is one of a plurality of message switches that are each software being executed on one of a plurality of mail servers comprising a conventional server;
- and
- a select rules file including a plurality of spam rules, each of the plurality of spam rules having attributes including a score, wherein the spam filter analyzes the email message to determine if the email message will be marked as spam wherein the analyzing includes creating an entry in a log file, the entry including the score from each of the plurality of spam rules that matches the email message, and wherein the message switch periodically communicates the contents of the log file to a central server and periodically receives an updated select rules file from the central server, the updated select rules file differing from the select rules file, and the updated select rules file becoming the select rules file once received, and wherein the central server is distinct from each of the plurality of message switches.
A method for dynamically updating spam rules, the method comprising:
- receiving an email message at a message switch wherein the message switch is one of a plurality of message switches that are each software being executed on one of a plurality of mail servers;
- processing the email message against the spam rules to determine if the email message will be marked as spam, each of the spam rules having attributes including a score;
- creating a spam information entry in a log file, the spam information entry including the score from each of the spam rules that the processed email message matches;
- calculating statistics for the spam rules based on the spam information in the log file;
- updating a database of the spam rules based on the statistics, the updating including modifying the score of at least one of the spam rules;
- selecting a set of select rules from the database of the updated spam rules to form a select rules set;
- and
- replicating the select rules set to the message switch wherein the select rules set, once received by the message switch, becomes the spam rules.
Dependencies are inferred from the claim text.