Abstract:
Methods and apparatus of classifying received email are provided. At least one initial desirability scan is performed on a received email. When the received email passes the at least one initial desirability scan, it is determined if the received email comprises one or more browser-interpretable scripts. When the received email comprises one or more browser-interpretable scripts, a secondary desirability scan is performed on the received email as a function of the one or more browser-interpretable scripts. The received email is identified as undesirable email when the received email fails the at least one initial desirability scan, or the received email fails the secondary desirability scan. The received e-mail is identified as desirable email when the received email does not comprise one or more browser-interpretable scripts or the received email passes the secondary desirability scan.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention relates to email environments and, more particularly, to methods and apparatus for classifying received emails. 
       BACKGROUND OF THE INVENTION 
       [0002]    Internet spam typically includes one or more unsolicited messages sent, or posted, as part of a larger collection of messages, all having substantially identical content. Spam, as used herein, refers to email spam. Perpetrators that generate and send such spam may harvest email addresses of prospective recipients from Usenet postings or web pages, obtain them from databases, or simply guess them by using common names and domains. By popular definition, spam occurs without the permission of the recipients. 
         [0003]    Spam is a significant burden for recipients as well as those who support the networking infrastructures that provide email services. Spam is chiefly utilized to deliver unwanted advertisements. Spammers, or those sending spam, also send spam for other agendas, such as denial of service, for example through the clogging of an email inbox using excessive bandwidth or disk space. Additional agendas may also include politics or malicious pornography. While other spamming motives exist, the common characteristic despite motive is that unwanted email circumvents devised email defenses, causing much productivity loss and great annoyance. 
         [0004]    Presently there is a plurality of spam identifying and filtering techniques. Such means and apparatus may be provided at the client (end-user) end, or imbedded in various other stages of email handling, such as a central server. A system or algorithm has not yet emerged that is capable of identifying all spam due to the multitude of factors spammers use to camouflage the email content. Generally, the camouflage consists of random content to thwart identification of a pattern of consistency from one spam email to the next. The subject, the body of text, and even the normally invisible hypertext content may differ slightly in each spam email. Mass mailings containing legitimate and repetitious content are conversely known as non-spam, and may include, for example, proxy notices, billings, and customer services notifications. Invariably, the spam contains an active link implemented as hypertext or a script-activated button for the purpose of user response. 
         [0005]    Presently, common signatures of email spam are identified and continually manually added for handling new patterns of spam content, resulting in a vicious circle of spam and defender warfare, with screening provided at mail server and client levels in the hierarchy. However, conventional screenings are failing to identify root spammers, thus allowing the spam to continually clog a user&#39;s inbox. 
       SUMMARY OF THE INVENTION 
       [0006]    The present invention provides techniques for filtering or classifying email, and more particularly, for separating undesirable or spam email from desirable email. 
         [0007]    For example, in one aspect of the present invention, a method of classifying received email is provided. At least one initial desirability scan is performed on a received email. When the received email passes the at least one initial desirability scan, it is determined if the received email comprises one or more browser-interpretable scripts. When the received email comprises one or more browser-interpretable scripts, a secondary desirability scan is performed on the received email as a function of the one or more browser-interpretable scripts. The received email is identified as undesirable email when the received email fails the at least one initial desirability scan, or the received email fails the secondary desirability scan. The received e-mail is identified as desirable email when the received email does not comprise one or more browser-interpretable scripts or the received email passes the secondary desirability scan. 
         [0008]    In additional embodiments of the present invention, an initial desirability scan is performed by identifying one or more uniform resource locators (URLs) in the received e-mail, and determining if the one or more URLs are associated with at least one of an undesirable domain name and an undesirable IP address. Further, a secondary desirability scan may be performed by simulating an invocation of each of the one or more browser-interpretable scripts, and determining if content exposed from each simulation is associated with at least one of an undesirable domain name and an undesirable IP address. 
         [0009]    The embodiments of the present invention describe how to identify root domains of a spam email. Furthermore, such embodiments include means to determine the obvious invalidity of many entries thus eliminating manual adjustment to newly discovered patterns. The primary advantage is the increased acuity in identifying root spamming domains including new domains at an email server by removing the camouflage and determining the target domains despite scripting in the email content. This identification at the email server also helps to reduce the impact to system resources and mail clients. 
         [0010]    These and other objects, features and advantages of the present invention will become apparent from the following detailed description of illustrative embodiments thereof, which is to be read in connection with the accompanying drawings. 
     
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]      FIG. 1  is a diagram illustrating a network for identifying spam email, according to an embodiment of the present invention; 
           [0012]      FIG. 2  is a diagram illustrating a network for identifying spam email with an augmented domain name server, according to an embodiment of the present invention; 
           [0013]      FIG. 3  is a flow diagram illustrating a spam identification methodology, according to an embodiment of the present invention; 
           [0014]      FIG. 4  is a flow diagram illustrating an augmented domain name server entry retrieval methodology, according to an embodiment of the present invention; 
           [0015]      FIG. 5  is a flow diagram illustrating an augmented domain name server organization methodology, according to an embodiment of the present invention; 
           [0016]      FIG. 6  is a flow diagram illustrating an augmented domain name server spam indication methodology, according to an embodiment of the present invention; and 
           [0017]      FIG. 7  is a diagram illustrating an illustrative hardware implementation of a computing system in accordance with which one or more components/methodologies of the present invention may be implemented, according to an embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
       [0018]    As will be illustrated in detail below, the present invention introduces techniques for classification of received email for the purpose of filtering out spam email. 
         [0019]    Referring initially to  FIG. 1 , a diagram illustrates a network for identifying spam email, according to an embodiment of the present invention. In the present environment, senders and receivers of email are facilitated by Internet connection services and infrastructure, and corresponding mail servers. In this environment, there is at least one spammer&#39;s client system  102  and at least one receiver&#39;s client system  104 . Spammer&#39;s client system  102  may generate spam which can be distributed by a corresponding spammer&#39;s mail server  106 , or may transmit packets which bypass spammer&#39;s mail server  106  because they conform to the proper content to be acceptable to a typical receiver&#39;s mail server  108 . Thus, the embodiments of the present invention are not restricted by the spammer&#39;s adoption of a sending mail server. 
         [0020]    The typical flow of spam is as follows: spam is generated at a spammer&#39;s client system  102 , forwarded optionally to an intermediate spammer&#39;s mail server  106 , via a network, such as, for example, the Internet  110 . The email is forwarded to receiver&#39;s mail server  108  and subsequently retrieved by a receiver at receiver&#39;s client system  104 . Receiver&#39;s mail server  108  may potentially identify some spam by deploying known spam email detection techniques. However, without embodiments of the present invention deployed at receiver&#39;s email server  108 , cleverly disguised spam may not be detected, and consequently may be presented as inbound mail to the receiver at receiver&#39;s client system  104 . 
         [0021]    Referring now to  FIG. 2 , a diagram illustrates a network for identifying spam email with an augmented domain name server, according to an embodiment of the present invention. A special augmented domain name server (ADNS)  212  is employed to maintain a copy of the Internet domain registry. The registry is comprised of information concerning the ownership, origin date, term ending date and authoritative name servers for domains. ADNS  212  contains this information as entries within a cache. Entries include a flag designating whether the entry details a known spam site and a timestamp that records the first time the DNS entry was recorded. In general, the newer the domain, the more likely it will come under scrutiny as a potential spammer domain. A more detailed description of the functionality of ADNS  212  is provided below in  FIG. 4 . 
         [0022]    In accordance with an embodiment of the present invention, a spam detection flow is described as follows with respect to  FIG. 2 : The spammer generates spam email at spammer&#39;s client system  202  which, as in  FIG. 1 , is forwarded optionally to an intermediate spammer&#39;s mail server  206  via the Internet  210 , ultimately reaching receiver&#39;s mail server  208 . Receiver&#39;s mail server  208  performs specialized checking, a more detailed description of which is provided below in  FIG. 3 , to determine whether the email is likely spam. In so doing, receiver&#39;s mail server  208 , using a local network  214 , may access archived information on ADNS  212 . If identified as spam, receiver&#39;s client system  204  is spared the inconvenience of receiving spam email because the spam may be sorted into a separate inbox designated for spam or automatically discarded. 
         [0023]    Referring now to  FIG. 3 , a flow diagram illustrates a spam email identification methodology, according to an embodiment of the present invention. In block  302 , the mail server accepts a new email. In block  304 , the straightforward or obvious uniform resource locators (URLs) are enumerated or reduced to the simply identified domains or explicit Internet Protocol (IP) addresses. These domains and IP addresses can then be referenced either in a maintained cache of know spam entities in accordance with the system of  FIG. 1 , or by the augmented domain name server in accordance with the system of  FIG. 2 , in block  306 . 
         [0024]    The invention is not limited to the maintenance of a dynamic registry or to a local cache. The collection of entries can simply be a “blacklist” of domains and IP addresses known to be spam-ridden. Each entry contains standard information as described above plus the spam flag and the first identified timestamp. A domain as described in this invention is not limited to the base Internet assigned domain. Instead, the domain name may be a “name-dot-domain” extension to an existing domain, because that extension might be the only part that is producing spam. In this description, “domain” will refer to either the Internet domain or an extension referring to an Internet resource. If the domain is found to be in the “blacklist” or the augmented domain name server&#39;s cache the determination concerning likelihood of being spam can be obtained. The finding could be the discovery of an extremely new domain entry and although not marked with the spam flag, it might be tentatively marked as spam. In such an application, it would be expected that the receiver would periodically check the separate inbox, provided for spam to validate the results. 
         [0025]    Referring back to the methodology of  FIG. 3 , if the test of block  306  yields a positive spam result, the methodology terminates at block  308  and the email is maintained as spam or discarded. If the test of block  306  yields a negative spam result, it remains possible that a spam email contains hypertext, or a hyperlink, that does not obviously translate to a known spam target URL. In block  310 , it is determined if the email contains at least one HTML or other suitable browser-interpretable script. If no such scripts exist, the methodology terminates at block  312 , where the email is maintained as non-spam email. If such scripts are found to exist, the methodology continues to block  314  where a succession of user interactions are processed using an apparatus to emulate the end user action via a simulated invocation of the target script to potentially expose more content for verification. If it is determined that any enumerated URLs are spam in block  316 , then the email is maintained as spam and the methodology terminates at block  308 . Otherwise, the email is maintained as non-spam email and the methodology terminates at block  312 . 
         [0026]    Referring now to  FIG. 4 , a flow diagram illustrates an augmented domain name server entry retrieval methodology, according to an embodiment of the present invention. The process of determining if a URL comes from a spammer domain is performed by requesting a lookup by the ADNS in block  402 . In block  404  it is determined if an entry exists. If an entry exists, the entry is found and returned to the caller in block  406  terminating the methodology at block  408 . If an entry does not exist, the ADNS will obtain ADNS resource records in block  410  and create a new entry with its spam flag “off” in block  412 , before returning same to the caller in block  406  and terminating the methodology in block  408 . 
         [0027]    Referring now to  FIG. 5 , a flow diagram illustrates an augmented domain name server organization methodology, according to an embodiment of the present invention. The augmented domain name server can be used to maintain a dynamic list of domains. As described previously, data name servers provide information concerning the registry for a domain. Three scenarios are now described below with respect to  FIG. 5 . 
         [0028]    The methodology begins at block  502 , where ADNS receives routine DNS information. In block  504 , it is determined if the information includes a new entry. If a new entry is included, it is cached along with a “first seen” timestamp in block  506  with the spam flag “off”. If a new entry is not included, it is determined if the information includes an update or reactivation of a previously received entry in block  508 . If the information includes an update or reactivation, the relevant changes are copied without affecting the “first seen” timestamp in block  510 . If the information does not include an update or reactivation, it is determined if the information is for deletion of an entry in block  512 . If the information is for deletion, the previously existing cached entry is repopulated but the spam flag and the “first seen” timestamp is not disturbed in block  514 . The methodology terminates at block  516 , after blocks  506 ,  510  and  514 , or for those updates that are not important to the functioning of the ADNS. The probability that a given entry is filtered out as spam is determined in accordance with the “first seen” timestamp of the entry. More specifically, an entry is weighted higher as probable spam when a “first seen” timestamp is first created. Additionally, an entry is weighted less as probable spam as time passes from the “first seen” timestamp. 
         [0029]    Referring now to  FIG. 6 , a flow diagram illustrates an augmented domain name server spam indication methodology, according to an embodiment of the present invention. The spam flag may be adjusted by a call to the appropriate service in the ADNS in block  602 . The flag is cleared or set in accordance with the call parameter in block  604 , and the methodology terminates in block  606 . Such update calls may result from receiver feedback through the receiver&#39;s mail server. Other updates may occur by agents that collect information from other sources. 
         [0030]    Referring now to  FIG. 7 , a block diagram illustrates an exemplary hardware implementation of a computing system in accordance with which one or more components/methodologies of the invention (e.g., components/methodologies described in the context of  FIGS. 1-6 ) may be implemented, according to an embodiment of the present invention. 
         [0031]    As shown, the computer system may be implemented in accordance with a processor  710 , a memory  712 , I/O devices  714 , and a network interface  716 , coupled via a computer bus  718  or alternate connection arrangement. 
         [0032]    It is to be appreciated that the term “processor” as used herein is intended to include any processing device, such as, for example, one that includes a CPU (central processing unit) and/or other processing circuitry. It is also to be understood that the term “processor” may refer to more than one processing device and that various elements associated with a processing device may be shared by other processing devices. 
         [0033]    The term “memory” as used herein is intended to include memory associated with a processor or CPU, such as, for example, RAM, ROM, a fixed memory device (e.g., hard drive), a removable memory device (e.g., diskette), flash memory, etc. 
         [0034]    In addition, the phrase “input/output devices” or “I/O devices” as used herein is intended to include, for example, one or more input devices (e.g., keyboard, mouse, scanner, etc.) for entering data to the processing unit, and/or one or more output devices (e.g., speaker, display, printer, etc.) for presenting results associated with the processing unit. 
         [0035]    Still further, the phrase “network interface” as used herein is intended to include, for example, one or more transceivers to permit the computer system to communicate with another computer system via an appropriate communications protocol. 
         [0036]    Software components including instructions or code for performing the methodologies described herein may be stored in one or more of the associated memory devices (e.g., ROM, fixed or removable memory) and, when ready to be utilized, loaded in part or in whole (e.g., into RAM) and executed by a CPU. 
         [0037]    Although illustrative embodiments of the present invention have been described herein with reference to the accompanying drawings, it is to be understood that the invention is not limited to those precise embodiments, and that various other changes and modifications may be made by one skilled in the art without departing from the scope or spirit of the invention.