# US 7,610,342 B1 · System and method for analyzing and managing spam e-mail

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,610,342 B1
- Document ID: US7610342B1
- Status: Granted
- Kind: B1
- Application number: 10/690,422
- Filed: 2003-10-21
- Granted: 2009-10-27
- Earliest claimed: 2003-10-21
- Assignees: Microsoft Corporation
- Inventors: Nancy Pettigrew; Amit Jhawar
- Web page: https://patentgrep.com/patent/US7610342B1

## CPC

- G06Q 10/107: Computer-aided management of electronic mailing [e-mailing]
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

The present invention provides an improved system and method for analyzing spam e-mail. The system and method monitors instances of spam across a distributed network, and creates and stores records of these instances as encoded information strings, which are attached to each message as a header. The system and method use information and statistics obtained from the information strings to dynamically create, modify and retire rules for analyzing and managing spam e-mail. The system also allows analysts to dynamically create, modify and retire rules based upon feedback regarding unidentified spam messages and false positives.

## Claims

### Claim 1

A dynamic email spam analysis and management system comprising:
a database including a plurality of spam rules, each of the plurality of spam rules having attributes including a score;
a spam analyzer operable to process a log file received from each of a plurality of message switches, each message switch processing an email against each of the plurality of spam rules thus determining if the processed email will be marked as spam, and for each match between the processed email and each of the plurality of spam rules, each message switch creating an entry in its log file corresponding to the processed email and the matching spam rule wherein each entry includes the score from each matching spam rule, the spam analyzer operable to update the attributes of at least one of the plurality of spam rules in the database, the updating including modifying the score of the at least one of the plurality of spam rules, the updating based on statistics calculated from at least one of the log files, wherein the spam analyzer is distinct from each of the plurality of message switches, and wherein each of the plurality of message switches are software being executed on one of a plurality of mail servers; and
a select rules file including one or more select rules from the database of the plurality of spam rules, each of the one or more select rules being included in the select rules file based on its attributes, the select rules file being replicated to each of the message switches.

### Claim 2 (depends on 1)

The system of claim 1 wherein the spam analyzer processes each log file to determine how many times each of the plurality of spam rules was hit and accordingly updates the attributes corresponding to the each of the plurality of spam rules.

### Claim 3 (depends on 1)

The system of claim 1 wherein the attributes corresponding to each of the plurality of spam rules are updated to indicate how many times each of the plurality of spam rules was false-positive-hit.

### Claim 4 (depends on 1)

The system of claim 1 wherein one or more other select rules of the plurality of spam rules are retired, each of the one or more other select rules being retired based on its attributes.

### Claim 5 (depends on 1)

The system of claim 1 wherein the select rules file further includes one or more new rules.

### Claim 6 (depends on 1)

The system of claim 1 wherein the spam analyzer calculates, based on information derived from the log file, how many times each of the plurality of spam rules was hit.

### Claim 7 (depends on 1)

The system of claim 1 wherein the attributes of each of the plurality of spam rules are modified to indicate how many times each of the plurality of spam rules was false-positive-hit.

### Claim 8 (depends on 1)

The system of claim 1 wherein the spam analyzer calculates, based on information derived from the log file, how many hits of each of the plurality of spam rules was determined to be for spam email messages and accordingly modifies the corresponding attributes of the each of the plurality of spam rules.

### Claim 9 (depends on 1)

The system of claim 1 wherein the spam analyzer calculates based on information derived from the log file, how many hits of each of the plurality of spam rules was determined to be for non-spam email messages and accordingly modifies the corresponding attributes of the each of the plurality of spam rules.

### Claim 10 (depends on 1)

The system of claim 1 wherein the score of one of the plurality of spam rules is modified manually.

### Claim 11 (depends on 4)

The system of claim 4 wherein the one or more other select rules have not been hit within a predetermined amount of time.

### Claim 12

A dynamic email spam analysis and management system comprising:
a message switch including a spam filter operable to receive an email message wherein the message switch is one of a plurality of message switches that are each software being executed on one of a plurality of mail servers comprising a conventional server; and
a select rules file including a plurality of spam rules, each of the plurality of spam rules having attributes including a score, wherein the spam filter analyzes the email message to determine if the email message will be marked as spam wherein the analyzing includes creating an entry in a log file, the entry including the score from each of the plurality of spam rules that matches the email message, and wherein the message switch periodically communicates the contents of the log file to a central server and periodically receives an updated select rules file from the central server, the updated select rules file differing from the select rules file, and the updated select rules file becoming the select rules file once received, and wherein the central server is distinct from each of the plurality of message switches.

### Claim 13 (depends on 12)

The system of claim 12 wherein a total spam score for the email message is modified using the score of each of the plurality of spam rules for which there is a hit on the email message.

### Claim 14 (depends on 12)

The system of claim 12 wherein each of the plurality of spam rules has attributes including one or more of: a date and time the spam rule was last_updated, number of hits, number of spam hits, number of non-spam hits, and date and time of last hit.

### Claim 15 (depends on 12)

The system of claim 12 wherein each of the plurality of spam rules are constructed using regular expressions.

### Claim 16 (depends on 13)

The system of claim 13 wherein, if the total spam score exceeds a score threshold, the email message is identified as a spam email message.

### Claim 17 (depends on 13)

The system of claim 13 wherein, if the total spam score does not exceed a score threshold, the email message is identified as a non-spam email message.

### Claim 18 (depends on 17)

The system of claim 17 wherein the email message is transferred to an intended recipient.

### Claim 19

A method for dynamically updating spam rules, the method comprising:
receiving an email message at a message switch wherein the message switch is one of a plurality of message switches that are each software being executed on one of a plurality of mail servers;
processing the email message against the spam rules to determine if the email message will be marked as spam, each of the spam rules having attributes including a score;
creating a spam information entry in a log file, the spam information entry including the score from each of the spam rules that the processed email message matches;
calculating statistics for the spam rules based on the spam information in the log file;
updating a database of the spam rules based on the statistics, the updating including modifying the score of at least one of the spam rules;
selecting a set of select rules from the database of the updated spam rules to form a select rules set; and
replicating the select rules set to the message switch wherein the select rules set, once received by the message switch, becomes the spam rules.

### Claim 20 (depends on 19)

The method of claim 19 wherein the processing includes testing the email message against each of the spam rules for a hit and, if a hit exists for the each of the spam rules, modifying a total spam score of the email message based on the score of the each of the spam rules.

### Claim 21 (depends on 19)

The method of claim 19 wherein the calculating includes calculating, based on the log file, how many times each of the spam rules was hit.

### Claim 22 (depends on 19)

The method of claim 19 wherein the calculating includes calculating, based on the log file, how many hits for each of the spam rules were for a spam email message versus a non-spam email message.

### Claim 23 (depends on 19)

The method of claim 19 wherein the updating includes updating a quantity of false-positive-hits for one or more of the spam rules.

### Claim 24 (depends on 19)

The method of claim 19 wherein the selecting includes retiring one or more of the spam rules wherein the retired spam rules are not included in the select rules set.

### Claim 25 (depends on 19)

The method of claim 19 wherein the updating includes updating the score of one or more of the spam rules based on the statistics.

### Claim 26 (depends on 19)

The method of claim 19 wherein the score of each of the spam rules can be modified manually.

### Claim 27 (depends on 19)

The method of claim 19 wherein the replicating includes replicating the select rules set to each of the plurality of message switches.

### Claim 28 (depends on 19)

The method of claim 19 further comprising, if the email message is determined to be a non-spam email message, transferring the email message to an intended recipient.

### Claim 29 (depends on 19)

The method of claim 19 embodied as computer-executable instructions stored on a computer-readable medium.

### Claim 30 (depends on 20)

The method of claim 20 wherein the spam information entry corresponding to the email message in the log file includes an identifier for each of the spam rules for which there was a hit.