Patent ID: 7899866
Filing Date: 2011-03-01
Classification: H04L

Abstract:
1. A method comprising: receiving an email message; determining a sender identity associated with the email message based on a particular IP address from which the email message was sent; calculating a probability that the email message from the sender is spam based on the particular IP address; in an event that there is not enough data that has been previously collected in association with the particular IP address to calculate the probability that the email message from the sender is spam, calculating the probability that the sender's email address is spam according to data associated with a first range of IP addresses based on a top 24 bits of the particular IP address; in an event that there is not enough data that has been previously collected in association with the top 24 bits of the particular IP address to calculate the probability that the email message from the sender is spam, calculating the probability that the sender's email message is spam according to data associated with a second range of IP addresses based on a top 16 bits of the particular IP address; identifying features of the email message; determining a first spam score based, at least in part, on a combination of a reputation associated with the sender identity and data associated with the features of the email message, wherein the reputation indicates whether email messages received from the sender identity tend to be spam, and wherein the data associated with the features of the email message indicates whether email messages having the features tend to be spam; comparing the first spam score to a first spam score threshold in an event that the first spam score is greater than the first spam score threshold: determining a second spam score based, at least in part, on the data associated with the features of the email message; applying different treatments to the email message based on a combination of a first relationship between the first spam score and three first spam score threshold values including in an event that the first spam score is smaller than in an event that the first spam score is smaller than wherein: the features include: each particular features is assigned a numerical value based on a frequency of each particular feature is found in a good email message compared to a frequency of each particular feature is found in a spam email message; the reputation associated with the sender identity is gathered from a user's feedback indicating a number of spam email message from the sender identity and a number of non-spam email message from the sender identity; the indication is reflected by a numerical value; and the determining operation of the second spam score comprises calculating a Sigmoid function, 1/(1+e