Apparatus and methods for classifying senders of unsolicited bulk emails

Patent metadata

Field	Value
Publication number	US-9710759-B2
Application number	US-68624010-A
Country	US
Kind code	B2
Filing date	Jan 12, 2010
Priority date	Jan 12, 2010
Publication date	Jul 18, 2017
Grant date	Jul 18, 2017

Abstract

In accordance with one aspect, methods and apparatus facilitate the filtering of unsolicited bulk electronic mail (email) sent from spammers. A plurality of recipient patterns for a plurality of emails from known spammers is logged. A plurality of recipient patterns for a plurality of emails from known non-spammers is also logged. A probabilistic model for predicting whether an unknown sender identity is a spammer is generated or modified based on the logged recipient patterns for the emails from known spammers and known non-spammers.

First claim

What is claimed is:

1. A computer implemented method of filtering unsolicited bulk electronic mail (email), comprising:
receiving a plurality of emails associated with a particular sender identifier (ID), the plurality of emails associated with the particular sender ID including emails sent by the particular sender ID;
determining whether the emails sent by the particular sender ID comprise unsolicited bulk email based, at least in part, upon one or more sender characteristics, which are associated with the particular sender ID, using a probabilistic model, wherein the sender characteristics of the particular sender ID includes a particular pattern for messages associated with the particular sender ID, wherein the particular pattern includes identification of recipients to which the particular sender ID sends emails, wherein the particular pattern indicates whether any of the recipients of the emails sent by the particular sender ID have mutually exchanged messages with one another, wherein the particular pattern indicates whether a first one of the recipients previously sent a message to a second one of the recipients; and
inhibiting the emails sent by the particular sender ID from reaching recipients of such emails if the emails sent by the particular sender ID are determined to be unsolicited bulk emails.

2. The method of claim 1 , wherein the probabilistic model is generated from a training process that is based on a training set of sender characteristics that have been associated with indicators for defining whether specific sender IDs are associated with unsolicited bulk emails.

3. The method of claim 1 , wherein the particular pattern further indicates a geographic distance between a sender associated with the sender ID and the recipients.

4. The method of claim 1 , wherein the mutually exchanged messages comprise instant messages.

5. A computer implemented method of facilitating the filtering of unsolicited bulk electronic mail (email), comprising:
logging a plurality of recipient patterns for known spammers based, at least in part, on a plurality of emails associated with the known spammers, the plurality of emails associated with the known spammers including emails sent by the known spammers;
generating or modifying a probabilistic model for predicting whether an unknown sender identity is a spammer based, at least in part, on the logged recipient patterns for the known spammers, wherein the logged recipient patterns for each of the known spammers includes identification of recipients to which the known identified spammer sends emails;
wherein the logged recipient patterns for each of the known spammers indicate whether any of the recipients of the emails sent by the corresponding one of the known spammers have mutually exchanged messages with one another; and
determining whether a particular sender identity is a spammer based, at least in part, upon applying the probabilistic model to logged recipient patterns for the particular sender identity, wherein the logged recipient patterns for the particular sender identity indicate whether any of the recipients of emails sent by the particular sender identity have mutually exchanged messages with one another;
wherein one of the logged recipient patterns for one of the known spammers indicates whether a first one of the recipients of the emails sent by the one of the known spammers previously sent a message to a second one of the recipients of the emails sent by the one of the known spammers, and wherein one of the logged recipient patterns for the particular sender identity indicates whether a first one of the recipients of the emails sent by the particular sender identity previously sent a message to a second one of the recipients of the emails sent by the particular sender identity.

6. The method of claim 5 , wherein the unknown sender identity is a sender Internet Protocol (IP) address.

7. The method of claim 5 , wherein the known spammers have been identified, at least in part, by a plurality of recipients of the emails who identify such received emails as spam.

8. The method of claim 5 , wherein each combination of recipients is associated with a score, and wherein the model is configured to determine a total score for each recipient pattern and predict whether each sender is a spammer based, at least in part, on such total score for the recipient pattern.

9. The method of claim 5 , wherein the logged recipient patterns further comprise at least one of a maximum frequency of emails sent by the particular sender ID or a minimum frequency of emails sent by the particular sender ID.

10. The method of claim 5 , further comprising:
logging a plurality of recipient patterns for known non-spammers based, at least in part, on a plurality of emails associated with the known non-spammers, the plurality of emails associated with the known non-spammers including emails sent by the known non-spammers;
wherein generating or modifying the probabilistic model for predicting whether an unknown sender identity is a spammer is performed further based, at least in part, on the logged recipient patterns for the known non-spammers.

11. The method of claim 5 , further comprising:
logging recipient patterns for the particular sender identity based, at least in part, on the emails sent by the particular sender identity.

12. An apparatus comprising at least a processor and a memory, wherein the processor and/or memory are configured to perform the following operations:
logging a plurality of recipient patterns for known spammers based, at least in part, on a plurality of emails associated with the known spammers, the plurality of emails including emails sent by the known spammers;
generating or modifying a probabilistic model for predicting whether an unknown sender identity is a spammer based, at least in part, on the logged recipient patterns for the known spammers, wherein the logged recipient patterns for each of the known spammers includes identification of recipients to which the known identified spammer sends emails, wherein the logged recipient patterns for each one of the known spammers indicates whether any of the recipients of the emails sent by the one of the known spammers have mutually exchanged messages with one another; and
determining a likelihood that a particular sender identity is a spammer based, at least in part, upon applying the probabilistic model to logged recipient patterns for the particular sender identity, wherein the logged recipient patterns for the particular sender identity indicate whether any of the recipients of emails sent by the particular sender identity have mutually exchanged messages with one another;
wherein one of the logged recipient patterns for one of the known spammers indicates whether a first one of the recipients of the emails sent by the one of the known spammers previously sent a message to a second one of the recipients of the emails sent by the one of the known spammers, and wherein one of the logged recipient patterns for the particular sender identity indicates whether a first one of the recipients of the emails sent by the particular sender identity previously sent a message to a second one of the recipients of the emails sent by the particular sender identity.

13. The apparatus of claim 12 , wherein the known spammers have been identified, at least in part, by a plurality of recipients of the emails who identify such received emails as spam.

14. The apparatus of claim 12 , wherein the processor and/or memory are further configured for using the model to predict a likelihood of an unknown sender being a spammer based on the unknown sender's r

Assignees

• Dasgupta Anirban
• Weinberger Kilian Quirin
• Koren Yehuda
• Yahoo Inc

Inventors

• Dasgupta Anirban
• Weinberger Kilian Quirin
• Koren Yehuda

Classifications

• G06Q10/107

  Computer-aided management of electronic mailing [e-mailing] · CPC title

• G06N99/005 Primary

  Physics · mapped topic

• G06N20/10 Primary

  using kernel methods, e.g. support vector machines [SVM] · CPC title

• G06N20/00 Primary

  Machine learning · CPC title