Patent ID: 9634970
Date: 2017-04-25
CPC Classifications: H04L,H04W

Claim:
1. A computer, comprising: a processor; and a memory connected to the processor, the memory storing instructions executed by the processor to: receive an electronic mail message with original network nodes specifying original host names and original Internet Protocol (IP) addresses, perform a machine lookup to identify additional host names and additional IP addresses associated with the original host names and original IP addresses, augment the electronic mail message with network node attributes including the additional host names and additional IP addresses, wherein the network node attributes are added to the electronic mail message in a header section, generate message signatures representing the network node attributes, and evaluate the message signatures to characterize the message, wherein the evaluate operation imputes unsolicited bulk electronic message (spam) characteristics to related nodes in a graph linking an original network node specified in the electronic mail message to additional network nodes associated with the original network node.