Real-time detection and prevention of bulk messages

(54) REAL-TIME DETECTION AND PREVENTION OF BULK MESSAGES

(75) Inventor: Amit Jhawar, Bellevue, WA (US)

(73) Assignee: Microsoft Corporation, Redmond, WA (US)

( * ) Notice: Subject to any disclaimer, the term of this patent is extended or adjusted under 35 U.S.C. 154(b) by 985 days.

(21) Appl.No.: 11/458,342

(22) Filed: Jul. 18, 2006

(65) Prior Publication Data

US 2008/0021961 Al Jan. 24, 2008

(51) Int. CI.

G06F15/16 (2006.01)

G06F 9/44 (2006.01)

G06F 9/46 (2006.01)

G06F3/00 (2006.01)

G06F13/00 (2006.01)

G06Q 30/00 (2006.01)

G07G1/14 (2006.01)

(52) U.S. CI 709/206; 709/203; 709/207;

719/315

(58) Field of Classification Search 709/203,

709/206,207,219,230,236; 719/315; 705/14 See application file for complete search history.

(56) References Cited

U.S. PATENT DOCUMENTS

5,781,901 A * 7/1998 Kuzma 707/10

6,018,761 A * 1/2000 Uomini 709/206

6,052,709 A 4/2000 Paul

6,092,101 A * 7/2000 Birrell et al 709/206

6,185,551 Bl* 2/2001 Birrell et al 707/3

6,189,026 Bl* 2/2001 Birrell et al 709/206

6,356,935 Bl * 3/2002 Gibbs 709/206

6,571,290 B2* 5/2003 Selgasetal 709/228

A method and system for detecting and preventing bulk messages in real-time is provided. A detection server detects and prevents bulk messages in real-time by analyzing the network traffic pattern of attributes of messages, such as email messages, that are passing through the network against an expected network traffic pattern. The expected network traffic pattern may be specified as a combination of a rate and one or more thresholds, where each threshold has a corresponding status. The rate specifies a quantity of an attribute measured with respect to a quantity of time. A status associated with a threshold is attained when the rate is exceeded the requisite threshold number of times. The status indicates an action that is to be taken in processing the email message containing the attribute. An email message can then be processed in accordance with a status assigned to an attribute of the email message.

20 Claims, 10 Drawing Sheets

U.S. PATENT DOCUMENTS

6,643,686 Bl 11/2003 Hall

6,654,787 Bl * 11/2003 Aronsonetal 709/206

6,769,016 B2* 7/2004 Rothwell et al 709/206

6,772,196 Bl* 8/2004 Kirschetal 709/206

6,779,021 Bl * 8/2004 Bates et al 709/206

6,829,607 Bl* 12/2004 Tafoyaetal 1/1

6,868,498 Bl * 3/2005 Katsikas 726/14

6,928,465 B2 8/2005 Earnest

6,941,304 B2* 9/2005 Gaineyetal 1/1

7,007,068 B2 * 2/2006 Morkel 709/206

7,016,939 Bl* 3/2006 Rothwell et al 709/206

7,092,992 Bl * 8/2006 Yu 709/206

7,117,246 B2* 10/2006 Christenson et al 709/206

7,149,778 Bl* 12/2006 Patel et al 709/206

7,200,636 B2 * 4/2007 Harding 709/206

7,249,175 Bl * 7/2007 Donaldson 709/225

7,257,564 B2 * 8/2007 Loughmiller et al 706/16

7,277,695 B2 * 10/2007 Petryetal 455/414.1

7,321,922 B2* 1/2008 Zheng et al 709/206

7,325,249 B2 * 1/2008 Sutton et al 726/13

7,412,462 B2* 8/2008 Margolus et al 1/1

7,415,504 B2* 8/2008 Schiavone et al 709/207

7,433,924 B2 * 10/2008 Malcolm 709/206

7,454,470 Bl* 11/2008 Isaacs et al 709/206

7,472,163 Bl* 12/2008 Ben-Yoseph et al 709/206

2002/0107925 Al* 8/2002 Goldschneider et al 709/206

2002/0120600 Al* 8/2002 Schiavone et al 707/1

2002/0174185 Al* 11/2002 Rawat et al 709/206

2002/0199095 Al 12/2002 Bandinietal.

OTHER PUBLICATIONS

"BT Infonet SPAM and Virus Protection Service", ©2005, Infonet

Computer Services Corporation, Sep. 2004, (4 pages).

"Stop Spam Attacks in Real Time," WatchGuard spamBlocker,

WatchGuard Firebox, ©2005 WatchGuard Technologies, Inc., (2

pages).

Cook, Duncan et al., "Catching Spam Before it Arrives: Domain Specific Dynamic Blacklists," ©2006 Australian Computer Society, Inc., (10 pages) http://crpit.com/confpapers/CRPITV54Cook.pdf [last accessed Nov. 15, 2008].

Levitt, Mark and Brian E. Burke, "Choosing the Best Technology to Fight Spam," IDC White Paper, Apr. 2004, ©2004 IDC , (12 pages). PCT International Search Report, International Application No. PCT/US2007/016374, Applicant: Microsoft Corporation, Mailing Date Jan. 15, 2008, (3 pages).

* cited by examiner