Source: http://www.google.com/patents/US20040073617?dq=7222078
Timestamp: 2017-02-26 12:50:37
Document Index: 151415502

Matched Legal Cases: ['§ 119', 'Application No. 60', '§ 119', 'Application No. 60', '§ 119', 'Application No. 60']

Patent US20040073617 - Hash-based systems and methods for detecting and preventing transmission of ... - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inPatentsA system (120) detects transmission of potentially unwanted e-mail messages. The system (120) may receive e-mail messages and generate hash values based on one or more portions of the e-mail messages. The system (120) may then determine whether the generated hash values match hash values associated with...http://www.google.com/patents/US20040073617?utm_source=gb-gplus-sharePatent US20040073617 - Hash-based systems and methods for detecting and preventing transmission of unwanted e-mailAdvanced Patent SearchTry the new Google Patents, with machine-classified Google Scholar results, and Japanese and South Korean patents.Publication numberUS20040073617 A1Publication typeApplicationApplication numberUS 10/654,771Publication dateApr 15, 2004Filing dateSep 4, 2003Priority dateJun 19, 2000Also published asUS8204945, US8272060, US20090031129, US20090031136, US20090132669, US20090158046, US20090158435, US20090182867, US20090313339, US20100205265, US20100205670, US20100205671, US20100205672, US20130014261Publication number10654771, 654771, US 2004/0073617 A1, US 2004/073617 A1, US 20040073617 A1, US 20040073617A1, US 2004073617 A1, US 2004073617A1, US-A1-20040073617, US-A1-2004073617, US2004/0073617A1, US2004/073617A1, US20040073617 A1, US20040073617A1, US2004073617 A1, US2004073617A1InventorsWalter Milliken, William Strayer, Stephen MilliganOriginal AssigneeMilliken Walter Clark, Strayer William Timothy, Milligan Stephen DouglasExport CitationBiBTeX, EndNote, RefManPatent Citations (99), Referenced by (277), Classifications (13), Legal Events (6) External Links: USPTO, USPTO Assignment, EspacenetHash-based systems and methods for detecting and preventing transmission of unwanted e-mail
RELATED APPLICATIONS [0001] This application claims priority under 35 U.S.C. § 119 based on U.S. Provisional Application No. 60/407,975, filed Sep. 5, 2002, the disclosure of which is incorporated herein by reference. This application is also a continuation-in-part of U.S. patent application Ser. No. 10/251,403, filed Sep. 20, 2002, which claims priority under 35 U.S.C. § 119 based on U.S. Provisional Application No. 60/341,462, filed Dec. 14, 2001, both of which are incorporated herein by reference. This application is also a continuation-in-part of U.S. patent application Ser. No. 09/881,145, and U.S. patent application Ser. No. 09/881,074, both of which were filed on Jun. 14, 2001, and both of which claim priority under 35 U.S.C. § 119 based on U.S. Provisional Application No. 60/212,425, filed Jun. 19, 2000, all of which are incorporated herein by reference.
DETAILED DESCRIPTION [0023] The following detailed description of the invention refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements. Also, the following detailed description does not limit the invention. Instead, the scope of the invention is defined by the appended claims and equivalents. [0024] Systems and methods consistent with the present invention provide virus, worm, and unsolicited e-mail detection and/or prevention in e-mail servers. Placing these features in e-mail servers provides a number of new advantages, including the ability to align hash blocks to crucial boundaries found in e-mail messages and eliminate certain counter-measures by the attacker, such as using small Internet Protocol (IP) fragments to limit the detectable content in each packet. It also allows these features to relate e-mail header fields with the potentially-harmful segment of the message (usually an “attachment”), and decode common file-packing and encoding formats that might otherwise make a virus or worm undetectable by the packet-based technique (e.g., “.zip files”). [0025] By placing these features within an e-mail server, the ability to detect replicated content in the network at points where large quantities of traffic are present is obtained. By relating many otherwise-independent messages and finding common factors, the e-mail server may detect unknown, as well as known, viruses and worms. These features may also be applied to detect potential unsolicited commercial e-mail (“spam”). [0026] E-mail servers for major Internet Service Providers (ISPs) may process a million e-mail messages a day, or more, in a single server. When viruses and worms are active in the network, a substantial fraction of this e-mail may actually be traffic generated by the virus or worm. Thus, an e-mail server may have dozens to thousands of examples of a single e-mail-borne virus pass through it in a day, offering an excellent opportunity to determine the relationships between e-mail messages and detect replicated content (a feature that is indicative of virus/worm propagation) and spam, among other, more legitimate traffic (such as traffic from legitimate mailing lists). [0027] Systems and methods consistent with the principles of the invention provide mechanisms to detect and stop e-mail-borne viruses and worms before the addressed user receives them, in an environment where the virus is still inert. Current e-mail servers do not normally execute any code in the e-mail being transported, so they are not usually subject to virus/worm infections from the content of the e-mails they process—though, they may be subject to infection via other forms of attack. [0028] Besides e-mail-borne viruses and worms, another common problem found in e-mail is mass-e-mailing of unsolicited commercial e-mail, colloquially referred to as “spam.” It is estimated that perhaps 25%-50% of all e-mail messages now received for delivery by major ISP e-mail servers is spam. [0029] Users of network e-mail services are desirous of mechanisms to block e-mail containing viruses or worms from reaching their machines (where the virus or worm may easily do harm before the user realizes its presence). Users are also desirous of mechanisms to block unsolicited commercial e-mail that consumes their time and resources. [0030] Many commercial e-mail services put a limit on each user's e-mail accumulating at the server, and not yet downloaded to the customer's machine. If too much e-mail arrives between times when the user reads his e-mail, additional e-mail is either “bounced” (i.e., returned to the sender's e-mail server) or even simply discarded, both of which events can seriously inconvenience the user. Because the user has no control over arriving e-mail due to e-mail-borne viruses/worms, or spam, it is a relatively common occurrence that the user's e-mail quota overflows due to unwanted and potentially harmful messages. Similarly, the authors of e-mail-borne viruses, as well as senders of spam, have no reason to limit the size of their messages. As a result, these messages are often much larger than legitimate e-mail messages, thereby increasing the risks of such denial of service to the user by overflowing the per-user e-mail quota. [0031] Users are not the only group inconvenienced by spam and e-mail-borne viruses and worms. Because these types of unwanted e-mail can form a substantial fraction, even a majority, of e-mail traffic in the Internet, for extended periods of time, ISPs typically must add extra resources to handle a peak e-mail load that would otherwise be about half as large. This ratio of unwanted-to-legitimate e-mail traffic appears to be growing daily. Systems and methods consistent with the principles of the invention provide mechanisms to detect and discard unwanted e-mail in network e-mail servers. Exemplary System Configuration [0032] [0032]FIG. 1 is a diagram of an exemplary system 100 in which systems and methods consistent with the present invention may be implemented. System 100 includes mail clients 110 connected to a mail server 120 via a network 130. Connections made in system 100 may be via wired, wireless, and/or optical communication paths. While FIG. 1 shows three mail clients 110 and a single mail server 120, there can be more or fewer clients and servers in other implementations consistent with the principles of the invention. [0033] Network 130 may facilitate communication between mail clients 110 and mail server 120. Typically, network 130 may include a collection of network devices, such as routers or switches, that transfer data between mail clients 110 and mail server 120. In an implementation consistent with the present invention, network 130 may take the form of a wide area network, a local area network, an intranet, the Internet, a public telephone network, a different type of network, or a combination of networks. [0034] Mail clients 110 may include personal computers, laptops, personal digital assistants, or other types of wired or wireless devices that are capable of interacting with mail server 120 to receive e-mails. In another implementation, clients 110 may include software operating upon one of these devices. Client 110 may present e-mails to a user via a graphical user interface. [0035] Mail server 120 may include a computer or another device that is capable of providing e-mail services for mail clients 110. In another implementation, server 120 may include software operating upon one of these devices. [0036] [0036]FIG. 2 is an exemplary diagram of mail server 120 according to an implementation consistent with the principles of the invention. Server 120 may include bus 210, processor 220, main memory 230, read only memory (ROM) 240, storage device 250, input device 260, output device 270, and communication interface 280. Bus 210 permits communication among the components of server 120. [0037] Processor 220 may include any type of conventional processor or microprocessor that interprets and executes instructions. Main memory 230 may include a random access memory (RAM) or another type of dynamic storage device that stores information and instructions for execution by processor 220. ROM 240 may include a conventional ROM device or another type of static storage device that stores static information and instructions for use by processor 220. Storage device 250 may include a magnetic and/or optical recording medium and its corresponding drive. [0038] Input device 260 may include one or more conventional mechanisms that permit an operator to input information to server 120, such as a keyboard, a mouse, a pen, voice recognition and/or biometric mechanisms, etc. Output device 270 may include one or more conventional mechanisms that output information to the operator, such as a display, a printer, a pair of speakers, etc. Communication interface 280 may include any transceiver-like mechanism that enables server 120 to communicate with other devices and/or systems. For example, communication interface 280 may include mechanisms for communicating with another device or system via a network, such as network 130. [0039] As will be described in detail below, server 120, consistent with the present invention, provides e-mail services to clients 110, while detecting unwanted e-mails and/or preventing unwanted e-mails from reaching clients 110. Server 120 may perform these tasks in response to processor 220 executing sequences of instructions contained in, for example, memory 230. These instructions may be read into memory 230 from another computer-readable medium, such as storage device 250 or a carrier wave, or from another device via communication interface 280. [0040] Execution of the sequences of instructions contained in memory 230 may cause processor 220 to perform processes that will be described later. Alternatively, hardwired circuitry may be used in place of or in combination with software instructions to implement processes consistent with the present invention. Thus, processes performed by server 120 are not limited to any specific combination of hardware circuitry and software. [0041] [0041]FIG. 3 is an exemplary functional block diagram of mail server 120 according to an implementation consistent with the principles of the invention. Server 120 may include a Simple Mail Transfer Protocol (SMTP) block 310, a Post Office Protocol (POP) block 320, an Internet Message Access Protocol (IMAP) block 330, and a hash processing block 340. [0042] SMTP block 310 may permit mail server 120 to communicate with other mail servers connected to network 130 or another network. SMTP is designed to efficiently and reliably transfer e-mail across networks. SMTP defines the interaction between mail servers to facilitate the transfer of e-mail even when the mail servers are implemented on different types of computers or running different operating systems. [0043] POP block 320 may permit mail clients 110 to retrieve e-mail from mail server 120. POP block 320 may be designed to always receive incoming e-mail. POP block 320 may then hold e-mail for mail clients 110 until mail clients 110 connect to download them. [0044] IMAP block 330 may provide another mechanism by which mail clients 110 can retrieve e-mail from mail server 120. IMAP block 330 may permit mail clients 110 to access remote e-mail as if the e-mail was local to mail clients 1110. [0045] Hash processing block 340 may interact with SMTP block 310, POP block 320, and/or IMAP block 330 to detect and prevent transmission of unwanted e-mail, such as e-mails containing viruses or worms and unsolicited commercial e-mail (spam). [0046] [0046]FIG. 4 is an exemplary diagram of hash processing block 340 according to an implementation consistent with the principles of the invention. Hash processing block 340 may include hash processor 410 and one or more hash memories 420. Hash processor 410 may include a conventional processor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or some other type of device that generates one or more representations for each received e-mail and records the e-mail representations in hash memory 420. [0047] An e-mail representation will likely not be a copy of the entire e-mail, but rather it may include a portion of the e-mail or some unique value representative of the e-mail. For example, a fixed width number may be computed across portions of the e-mail in a manner that allows the entire e-mail to be identified. [0048] To further illustrate the use of representations, a 32-bit hash value, or digest, may be computed across portions of each e-mail. Then the hash value may be stored in hash memory 420 or may be used as an index, or address, into hash memory 420. Using the hash value, or an index derived therefrom, results in efficient use of hash memory 420 while still allowing the content of each e-mail passing through mail server 120 to be identified. [0049] Systems and methods consistent with the present invention may use any storage scheme that records information about one or more portions of each e-mail in a space-efficient fashion, that can definitively determine if a portion of an e-mail has not been observed, and that can respond positively (i.e., in a predictable way) when a portion of an e-mail has been observed. Although systems and methods consistent with the present invention can use virtually any technique for deriving representations of portions of e-mails, the remaining discussion will use hash values as exemplary representations of portions of e-mails received by mail server 120. [0050] In implementations consistent with the principles of the invention, hash processor 410 may hash one or more portions of a received e-mail to produce a hash value used to facilitate hash-based detection. For example, hash processor 410 may hash one or more of the main text within the message body, any attachments, and one or more header fields, such as sender-related fields (e.g., “From:,” “Sender:,” “Reply-To:,” “Return-Path:,” and “Error-To:”). Hash processor 410 may perform one or more hashes on each of the e-mail portions using the same or different hash functions. [0051] As described in more detail below, hash processor 410 may use the hash results of the hash operation to recognize duplicate occurrences of e-mails and raise a warning if the duplicate e-mail occurrences arrive within a short period of time and raise their level of suspicion above some threshold. It may also be possible to use the hash results for tracing the path of an unwanted e-mail through the network. [0052] Each hash value may be determined by taking an input block of data and processing it to obtain a numerical value that represents the given input data. Suitable hash functions are readily known in the art and will not be discussed in detail herein. Examples of hash functions include the Cyclic Redundancy Check (CRC) and Message Digest 5 (MD5). The resulting hash value, also referred to as a message digest or hash digest, may include a fixed length value. The hash value may serve as a signature for the data over which it was computed. [0053] The hash value essentially acts as a fingerprint identifying the input block of data over which it was computed. Unlike fingerprints, however, there is a chance that two very different pieces of data will hash to the same value, resulting in a hash collision. An acceptable hash function should provide a good distribution of values over a variety of data inputs in order to prevent these collisions. Because collisions occur when different input blocks result in the same hash value, an ambiguity may arise when attempting to associate a result with a particular input. [0054] Hash processor 410 may store a representation of each e-mail it observes in hash memory 420. Hash processor 410 may store the actual hash values as the e-mail representations or it may use other techniques for minimizing storage requirements associated with retaining hash values and other information associated therewith. A technique for minimizing storage requirements may use one or more arrays or Bloom filters. [0055] Rather than storing the actual hash value, which can typically be on the order of 32 bits or more in length, hash processor 410 may use the hash value as an index for addressing an array within hash memory 420. In other words, when hash processor 410 generates a hash value for a portion of an e-mail, the hash value serves as the address location into the array. At the address corresponding to the hash value, a count value may be incremented at the respective storage location, thus, indicating that a particular hash value, and hence a particular e-mail portion, has been seen by hash processor 410. In one implementation, the count value is associated with an 8-bit counter with a maximum value that sticks at 255. While counter arrays are described by way of example, it will be appreciated by those skilled in the relevant art, that other storage techniques may be employed without departing from the spirit of the invention. [0056] Hash memory 420 may store a suspicion count that is used to determine the overall suspiciousness of an e-mail message. For example, the count value (described above) may be compared to a threshold, and the suspicion count for the e-mail may be incremented if the threshold is exceeded. Hence, there may be a direct relationship between the count value and the suspicion count, and it may be possible for the two values to be the same. The larger the suspicion count, the more important the hit should be considered in determining the overall suspiciousness of the packet. Alternatively, the suspicion count can be combined in a “scoring function” with values from this or other hash blocks in the same message in order to determine whether the message should be considered suspicious. [0057] It is not enough, however, for hash memory 420 to simply identify that an e-mail contains content that has been seen recently. There are many legitimate sources (e.g., e-mail list servers) that produce multiple copies of the same message, addressed to multiple recipients. Similarly, individual users often e-mail messages to a group of people and, thus, multiple copies might be seen if several recipients happen to receive their mail from the same server. Also, people often forward copies of received messages to friends or co-workers. [0058] In addition, virus/worm authors typically try to minimize the replicated content in each copy of the virus/worm, in order to not be detected by existing virus and worm detection technology that depends on detecting fixed sequences of bytes in a known virus or worm. These mutable viruses/worms are usually known as polymorphic, and the attacker's goal is to minimize the recognizability of the virus or worm by scrambling each copy in a different way. For the virus or worm to remain viable, however, a small part of it can be mutable in only a relatively small number of ways, because some of its code must be immediately-executable by the victim's computer, and that limits the mutation and obscurement possibilities for the critical initial code part. [0059] In order to accomplish the proper classification of various types of legitimate and unwanted e-mail messages, multiple hash memories 420 can be employed, with separate hash memories 420 being used for specific sub-parts of a standard e-mail message. The outputs of different ones of hash memories 420 can then be combined in an overall “scoring” or classification function to determine whether the message is undesirable or legitimate, and possibly estimate the probability that it belongs to a particular class of traffic, such as a virus/worm message, spam, e-mail list message, normal user-to-user message. [0060] For e-mail following the Internet mail standard RFC 822 (and its various extensions), hashing of certain individual e-mail header fields into field-specific hash memories 420 may be useful. Among the header fields for which this may be helpful are: (1) various sender-related fields, such as “From:”, “Sender:”, “Reply-To:”, “Return-Path:” and “Error-To:”; (2) the “To:” field (often a fixed value for a mailing list, frequently missing or idiosyncratic in spam messages); and (3) the last few “Received:” headers (i.e., the earliest ones, since they are normally added at the top of the message), excluding any obvious timestamp data. It may also be useful to hash a combination of the “From:” field and the e-mail address of the recipient (transferred as part of the SMTP mail-transfer protocol, and not necessarily found in the message itself). [0061] Any or all of hash memories 420 may be pre-loaded with knowledge of known good or bad traffic. For example, known viruses and spam content (e.g., the infamous “Craig Shergold letter” or many pyramid swindle letters) can be pre-hashed into the relevant hash memories 420, and/or periodically refreshed in the memory as part of a periodic “cleaning” process described below. Also, known legitimate mailing lists, such as mailing lists from legitimate e-mail list servers, can be added to a “From:” hash memory 420 that passes traffic without further examination. [0062] Over time, hash memories 420 may fill up and the possibility of overflowing an existing count value increases. The risk of overflowing a count value may be reduced if the counter arrays are periodically flushed to other storage media, such as a magnetic disk drive, optical media, solid state drive, or the like. Alternatively, the counter arrays may be slowly and incrementally erased. To facilitate this, a time-table may be established for flushing/erasing the counter arrays. If desired, the flushing/erasing cycle can be reduced by computing hash values only for a subset of the e-mails received by mail server 120. While this approach reduces the flushing/erasing cycle, it increases the possibility that a target e-mail may be missed (i.e., a hash value is not computed over a portion of it). [0063] Non-zero storage locations within hash memories 420 may be decremented periodically rather than being erased. This may ensure that the “random noise” from normal e-mail traffic would not remain in a counter array indefinitely. Replicated traffic (e.g., e-mails containing a virus/worm that are propagating repeatedly across the network), however, would normally cause the relevant storage locations to stay substantially above the “background noise” level. [0064] One way to decrement the count values in the counter array fairly is to keep a total count, for each hash memory 420, of every time one of the count values is incremented. After this total count reaches some threshold value (probably in the millions), for every time a count value is incremented in hash memory 420, another count value gets decremented. One way to pick the count value to decrement is to keep a counter, as a decrement pointer, that simply iterates through the storage locations sequentially. Every time a decrement operation is performed, the following may done: (a) examine the candidate count value to be decremented and if non-zero, decrement it and increment the decrement pointer to the next storage location; and (b) if the candidate count value is zero, then examine each sequentially-following storage location until a non-zero count value is found, decrement that count value, and advance the decrement pointer to the following storage location. [0065] It may be important to avoid decrementing any counters below zero, while not biasing decrements unfairly. Because it may be assumed that the hash is random, this technique should not favor any particular storage location, since it visits each of them before starting over. This technique may be superior to a timer-based decrement because it keeps a fixed total count population across all of the storage locations, representing the most recent history of traffic, and is not subject to changes in behavior as the volume of traffic varies over time. [0066] A variation of this technique may include randomly selecting a count value to decrement, rather than processing them cyclically. In this variation, if the chosen count value is already zero, then another one could be picked randomly, or the count values in the storage locations following the initially-chosen one could be examined in series, until a non-zero count value is found. Exemplary Processing For Unwanted E-Mail Detection/Prevention [0067] FIGS. 5A-5E are flowcharts of exemplary processing for detecting and/or preventing transmission of unwanted e-mail, such as an e-mail containing a virus or worm, including a polymorphic virus or worm, or an unsolicited commercial e-mail (spam), according to an implementation consistent with the principles of the invention. The processing of FIGS. 5A-5E will be described in terms of a series of acts that may be performed by mail server 120. In implementations consistent with the principles of the invention, some of the acts may be optional and/or performed in an order different than that described. In other implementations, different acts may be substituted for described acts or added to the process. [0068] Processing may begin when hash processor 410 (FIG. 4) receives, or otherwise observes, an e-mail message (act 502) (FIG. 5A). Hash processor 410 may hash the main text of the message body, excluding any attachments (act 504). When hashing the main text, hash processor 410 may perform one or more conventional hashes covering one or more portions, or all, of the main text. For example, hash processor 410 may perform hash functions on fixed or variable sized blocks of the main text. It may be beneficial for hash processor 410 to perform multiple hashes on each of the blocks using the same or different hash functions. [0069] It may be desirable to pre-process the main text to remove attempts to fool pattern-matching mail filters. An example of this is HyperText Markup Language (HTML) e-mail, where spammers often insert random text strings in HTML comments between or within words of the text. Such e-mail may be referred to as “polymorphic spam” because it attempts to make each message appear unique. This method for evading detection might otherwise defeat the hash detection technique, or other string-matching techniques. Thus, removing all HTML comments from the message before hashing it may be desirable. It might also be useful to delete HTML tags from the message, or apply other specialized, but simple, pre-processing techniques to remove content not actually presented to the user. In general, this may be done in parallel with the hashing of the message text, since viruses and worms may be hidden in the non-visible content of the message text. [0070] Hash processor 410 may also hash any attachments, after first attempting to expand them if they appear to be known types of compressed files (e.g., “zip” files) (act 506). When hashing an attachment, hash processor 410 may perform one or more conventional hashes covering one or more portions, or all, of the attachment. For example, hash processor 410 may perform hash functions on fixed or variable sized blocks of the attachment. It may be beneficial for hash processor 410 to perform multiple hashes on each of the blocks using the same or different hash functions. [0071] Hash processor 410 may compare the main text and attachment hashes with known viruses, worms, or spam content in a hash memory 420 that is pre-loaded with information from known viruses, worms, and spam content (acts 508 and 510). If there are any hits in this hash memory 420, there is a probability that the e-mail message contains a virus or worm or is spam. A known polymorphic virus may have only a small number of hashes that match in this hash memory 420, out of the total number of hash blocks in the message. A non-polymorphic virus may have a very high fraction of the hash blocks hit in hash memory 420. For this reason, storage locations within hash memory 420 that contain entries from polymorphic viruses or worms may be given more weight during the pre-loading process, such as by giving them a high initial suspicion count value. [0072] A high fraction of hits in this hash memory 420 may cause the message to be marked as a probable known virus/worm or spam. In this case, the e-mail message can be sidetracked for remedial action, as described below. [0073] A message with a significant “score” from polymorphic virus/worm hash value hits may or may not be a virus/worm instance, and may be sidetracked for further investigation, or marked as suspicious before forwarding to the recipient. An additional check may also be made to determine the level of suspicion. [0074] For example, hash processor 410 may hash a concatenation of the From and To header fields of the e-mail message (act 512) (FIG. 5B). Hash processor 410 may then check the suspicion counts in hash memories 420 for the hashes of the main text, any attachments, and the concatenated From/To (act 514). Hash processor 410 may determine whether the main text or attachment suspicion count is significantly higher than the From/To suspicion count (act 516). If so, then the content is appearing much more frequently outside the messages between this set of users (which might otherwise be due to an e-mail exchange with repeated message quotations) and, thus, is much more suspicious. [0075] When this occurs, hash processor 410 may take remedial action (act 518). The remedial action taken might take different forms, which may be programmable or determined by an operator of mail server 120. For example, hash processor 410 may discard the e-mail. This is not recommended for anything but virtually-certain virus/worm/spam identification, such as a perfect match to a known virus. [0076] As an alternate technique, hash processor 410 may mark the e-mail with a warning in the message body, in an additional header, or other user-visible annotation, and allow the user to deal with it when it is downloaded. For data that appears to be from an unknown mailing list, a variant of this option is to request the user to send back a reply message to the server, classifying the suspect message as either spam or a mailing list. In the latter case, the mailing list source address can be added to the “known legitimate mailing lists” hash memory 420. [0077] As another technique, hash processor 410 may subject the e-mail to more sophisticated (and possibly more resource-consuming) detection algorithms to make a more certain determination. This is recommended for potential unknown viruses/worms or possible detection of a polymorphic virus/worm. [0078] As yet another technique, hash processor 410 may hold the e-mail message in a special area and create a special e-mail message to notify the user of the held message (probably including From and Subject fields). Hash processor 410 may also give instructions on how to retrieve the message. [0079] As a further technique, hash processor 410 may mark the e-mail message with its suspicion score result, but leave it queued for the user's retrieval. If the user's quota would overflow when a new message arrives, the score of the incoming message and the highest score of the queued messages are compared. If the highest queued message has a score above a settable threshold, and the new message's score is lower than the threshold, the queued message with the highest score may be deleted from the queue to make room for the new message. Otherwise, if the new message has a score above the threshold, it may be discarded or “bounced” (e.g., the sending e-mail server is told to hold the message and retry it later). Alternatively, if it is desired to never bounce incoming messages, mail server 120 may accept the incoming message into the user's queue and repeatedly delete messages with the highest suspicion score from the queue until the total is below the user's quota again. [0080] As another technique, hash processor 410 may apply hash-based functions as the e-mail message starts arriving from the sending server and determine the message's suspicion score incrementally as the message is read in. If the message has a high-enough suspicion score (above a threshold) during the early part of the message, mail server 120 may reject the message, optionally with either a “retry later” or a “permanent refusal” result to the sending server (which one is used may be determined by settable thresholds applied to the total suspicion score, and possibly other factors, such as server load). This results in the unwanted e-mail using up less network bandwidth and receiving server resources, and penalizes servers sending unwanted mail, relative to those that do not. [0081] If the suspicion count for the main text or any attachment is not significantly higher than the From/To suspicion count (act 516), hash processor 410 may determine whether the main text or any attachment has significant replicated content (non-zero or high suspicion count values for many hash blocks in the text/attachment content in all storage locations of hash memories 420) (act 520) (FIG. 5A). If not, the message is probably a normal user-to-user e-mail. These types of messages may be “passed” without further examination. When appropriate, hash processor 410 may also record the generated hash values by incrementing the suspicion count value in the corresponding storage locations in hash memory 420. [0082] If the message text is substantially replicated (e.g., greater than 90%), hash processor 410 may check one or more portions of the e-mail message against known legitimate mailing lists within hash memory 420 (act 522) (FIG. 5C). For example, hash processor 410 may hash the From or Sender fields of the e-mail message and compare it/them to known legitimate mailing lists within hash memory 420. Hash processor 410 may also determine whether the e-mail actually appears to originate from the correct source for the mailing list by examining, for example, the sequence of Received headers. Hash processor 410 may further examine a combination of the From or Sender fields and the recipient address to determine if the recipient has previously received e-mail from the sender. This is typical for mailing lists, but a typical of unwanted e-mail, which will normally not have access to the actual list of recipients for the mailing list. Failure of this examination may simply pass the message on, but mark it as “suspicious,” since the recipient may simply be a new subscriber to the mailing list, or the mailings may be infrequent enough to not persist in the hash counters between mailings. [0083] If there is a match with a legitimate mailing list (act 524), then the message is probably a legitimate mailing list duplicate and may be passed with no further examination. This assumes that the mailing list server employs some kind of filtering to exclude unwanted e-mail (e.g., refusing to forward e-mail that does not originate with a known list recipient or refusing e-mail with attachments). [0084] If there is no match with any legitimate mailing lists within hash memory 420, hash processor 410 may hash the sender-related fields (e.g., From, Sender, Reply-To) (act 526). Hash processor 410 may then determine the suspicion count for the sender-related hashes in hash memories 420 (act 528). [0085] Hash processor 410 may determine whether the suspicion counts for the sender-related hashes are similar to the suspicion count(s) for the main text hash(es) (act 530) (FIG. 5D). If both From and Sender fields are present, then the Sender field should match with roughly the same suspicion count value as the message body hash. The From field may or may not match. For a legitimate mailing list, it may be a legitimate mailing list that is not in the known legitimate mailing lists hash memory 420 (or in the case where there is no known legitimate mailing lists hash memory 420). If only the From field is present, it should match about as well as the message text for a mailing list. If none of the sender-related fields match as well as the message text, the e-mail message may be considered moderately suspicious (probably spam, with a variable and fictitious From address or the like). [0086] As an additional check, hash processor 410 may hash the concatenation of the sender-related field with the highest suspicion count value and the e-mail recipient's address (act 532). Hash processor 410 may then check the suspicion count for the concatenation in a hash memory 420 used just for this check (act 534). If it matches with a significant suspicion count value (act 536) (FIG. 5E), then the recipient has recently received multiple messages from this source, which makes it probable that it is a mailing list. The e-mail message may then be passed without further examination. [0087] If the message text or attachments are mostly replicated (e.g., greater than 90% of the hash blocks), but with mostly low suspicion count values in hash memory 420 (act 538), then the message is probably a case of a small-scale replication of a single message to multiple recipients. In this case, the e-mail message may then be passed without further examination. [0088] If the message text or attachments contain some significant degree of content replication (say, greater than 50% of the hash blocks) and at least some of the hash values have high suspicion count values in hash memory 420 (act 540), then the message is fairly likely to be a virus/worm or spam. A virus or worm should be considered more likely if the high-count matches are in an attachment. If the highly-replicated content is in the message text, then the message is more likely to be spam, though it is possible that e-mail text employing a scripting language (e.g., Java script) might also contain a virus. [0089] If the replication is in the message text, and the suspicion count is substantially higher for the message text than for the From field, the message is likely to be spam (because spammers generally vary the From field to evade simpler spam filters). A similar check can be made for the concatenation of the From and To header fields, except that in this case, it is most suspicious if the From/To hash misses (finds a zero suspicion count), indicating that the sender does not ordinarily send e-mail to that recipient, making it unlikely to be a mailing list, and very likely to be a spammer (because they normally employ random or fictitious From addresses). [0090] In the above cases, hash processor 410 may take remedial action (act 542). The particular type of action taken by hash processor 410 may vary as described above. CONCLUSION [0091] Systems and methods consistent with the present invention provide mechanisms within an e-mail server to detect and/or prevent transmission of unwanted e-mail, such as e-mail containing viruses or worms, including polymorphic viruses and worms, and unsolicited commercial e-mail (spam). [0092] Implementation of a hash-based detection mechanism in an e-mail server at the e-mail message level provides advantages over a packet-based implementation in a router or other network node device. For example, the entire e-mail message has been re-assembled, both at the packet level (i.e., IP fragment re-assembly) and at the application level (multiple packets into a complete e-mail message). Also, the hashing algorithm can be applied more intelligently to specific parts of the e-mail message (e.g., header fields, message body, and attachments). Attachments that have been compressed for transport (e.g., “.zip” files) can be expanded for inspection. Without doing this, a polymorphic virus could easily hide inside such files with no repeatable hash signature visible at the packet transport level. [0093] With the entire message available for a single pass of the hashing process, packet boundaries and packet fragmentation do not split sequences of bytes that might otherwise provide useful hash signatures. A clever attacker might otherwise obscure a virus/worm attack by causing the IP packets carrying the malicious code to be fragmented into pieces smaller than that for which the hashing process is effective, or by forcing packet breaks in the middle of otherwise-visible fixed sequences of code in the virus/worm. Also, the entire message is likely to be longer than a single packet, thereby reducing the probability of false alarms (possibly due to insufficient hash-block sample size and too few hash blocks per packet) and increasing the probability of correct identification of a virus/worm (more hash blocks will match per message than per packet, since packets will be only parts of the entire message). [0094] Also, fewer hash-block alignment issues arise when the hash blocks can be intelligently aligned with fields of the e-mail message, such as the start of the message body, or the start of an attachment block. This results in faster detection of duplicate contents than if the blocks are randomly aligned (as is the case when the method is applied to individual packets). [0095] E-mail-borne malicious code, such as viruses and worms, also usually includes a text message designed to cause the user to read the message and/or perform some other action that will activate the malicious code. It is harder for such text to be polymorphic, because automatic scrambling of the user-visible text will either render it suspicious-looking, or will be very limited in variability. This fact, combined with the ability to start a hash block at the start of the message text by parsing the e-mail header, reduces the variability in hash signatures of the message, making it easier to detect with fewer examples seen. [0096] Further, the ability to extract and hash specific headers from an e-mail message separately may be used to help classify the type of replicated content the message body carries. Because many legitimate cases of message replication exist (e.g., topical mailing lists, such as Yahoo Groups), intelligent parsing and hashing of the message headers is very useful to reduce the false alarm rate, and to increase the accuracy of detection of real viruses, worms, and spam. [0097] This detection technique, compared to others which might extract and save fixed strings to be searched for in other pieces of e-mail, includes hash-based filters that are one-way functions (i.e., it is possible, given a piece of text, to determine if it has been seen before in another message). Given the state data contained in the filter, however, it is virtually impossible to reconstruct a prior message, or any piece of a prior message, that has been passed through the filter previously. Thus, this technique can maintain the privacy of e-mail, without retaining any information that can be attributed to a specific sender or receiver. [0098] The foregoing description of preferred embodiments of the present invention provides illustration and description, but is not intended to be exhaustive or to limit the invention to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of the invention. [0099] For example, systems and methods have been described with regard to a mail server. In other implementations, the systems and methods described herein may be used within other devices, such as a mail client. In such a case, the mail client may periodically obtain suspicion count values for its hash memory from one or more network devices, such as a mail server. [0100] It may be possible for multiple mail servers to work together to detect and prevent unwanted e-mails. For example, high-scoring entries from the hash memory of one mail server might be distributed to other mail servers, as long as the same hash functions are used by the same cooperating servers. This may accelerate the detection process, especially for mail servers that experience relatively low volumes of traffic. [0101] Further, certain portions of the invention have been described as “blocks” that perform one or more functions. These blocks may include hardware, such as an ASIC or a FPGA, software, or a combination of hardware and software. [0102] No element, act, or instruction used in the description of the present application should be construed as critical or essential to the invention unless explicitly described as such. Also, as used herein, the article “a” is intended to include one or more items. Where only one item is intended, the term “one” or similar language is used. The scope of the invention is defined by the claims and their equivalents. Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS4641274 *Aug 19, 1985Feb 3, 1987International Business Machines CorporationMethod for communicating changes made to text form a text processor to a remote hostUS4996711 *Jun 21, 1989Feb 26, 1991Chaum David LSelected-exponent signature systemsUS5276735 *Apr 17, 1992Jan 4, 1994Secure Computing CorporationData enclave and trusted path systemUS5276736 *Jul 13, 1992Jan 4, 1994David ChaumOptionally moderated transaction systemsUS5276737 *Apr 20, 1992Jan 4, 1994Silvio MicaliFair cryptosystems and methods of useUS5276869 *Sep 10, 1990Jan 4, 1994International Business Machines CorporationSystem for selecting document recipients as determined by technical content of document and for electronically corroborating receipt of documentUS5276901 *Dec 16, 1991Jan 4, 1994International Business Machines CorporationSystem for controlling group access to objects using group access control folder and group identification as individual userUS5278901 *Apr 30, 1992Jan 11, 1994International Business Machines CorporationPattern-oriented intrusion-detection system and methodUS5280527 *Apr 14, 1992Jan 18, 1994Kamahira Safe Co., Inc.Biometric token for authorizing access to a host systemUS5283887 *Dec 19, 1990Feb 1, 1994Bull Hn Information Systems Inc.Automatic document format conversion in an electronic mail system based upon user preferenceUS5379340 *Aug 2, 1991Jan 3, 1995Betterprize LimitedText communication systemUS5379374 *Nov 21, 1991Jan 3, 1995Hitachi, Ltd.Collaborative information processing system and workstationUS5386470 *Aug 24, 1993Jan 31, 19953Com IrelandRepeaters for secure local area networksUS5388189 *Oct 28, 1993Feb 7, 1995Racal-Datacom, Inc.Alarm filter in an expert system for communications networkUS5481312 *Nov 18, 1994Jan 2, 1996At&T Corp.Method of and apparatus for the transmission of high and low priority segments of a video bitstream over packet networksUS5481613 *Apr 15, 1994Jan 2, 1996Northern Telecom LimitedComputer network cryptographic key distribution systemUS5483466 *Nov 15, 1993Jan 9, 1996Hitachi, Ltd.Client/server system and mail reception/display control methodUS5485409 *Apr 30, 1992Jan 16, 1996International Business Machines CorporationAutomated penetration analysis system and methodUS5485460 *Aug 19, 1994Jan 16, 1996Microsoft CorporationSystem and method for running multiple incompatible network protocol stacksUS5491750 *Dec 30, 1993Feb 13, 1996International Business Machines CorporationMethod and apparatus for three-party entity authentication and key distribution using message authentication codesUS5495610 *Jul 13, 1995Feb 27, 1996Seer Technologies, Inc.Software distribution system to build and distribute a software releaseUS5602918 *Dec 22, 1995Feb 11, 1997Virtual Open Network Environment Corp.Application level security system and methodUS5604490 *Sep 9, 1994Feb 18, 1997International Business Machines CorporationMethod and system for providing a user access to multiple secured subsystemsUS5606668 *Dec 15, 1993Feb 25, 1997Checkpoint Software Technologies Ltd.System for securing inbound and outbound data packet flow in a computer networkUS5706442 *Dec 20, 1995Jan 6, 1998Block Financial CorporationSystem for on-line financial services using distributed objectsUS5706507 *Jul 5, 1995Jan 6, 1998International Business Machines CorporationSystem and method for controlling access to data located on a content serverUS5708780 *Jun 7, 1995Jan 13, 1998Open Market, Inc.Internet server access control and monitoring systemsUS5708826 *Dec 29, 1995Jan 13, 1998Fujitsu LimitedApparatus and method for converting presentation dataUS5710883 *Mar 10, 1995Jan 20, 1998Stanford UniversityHypertext document transport mechanism for firewall-compatible distributed world-wide web publishingUS5717757 *Nov 19, 1996Feb 10, 1998Micali; SilvioCertificate issue listsUS5717758 *Dec 9, 1996Feb 10, 1998Micall; SilvioWitness-based certificate revocation systemUS5857022 *Feb 19, 1997Jan 5, 1999Certco LlcEnhanced cryptographic system and method with key escrow featureUS5859966 *Oct 10, 1995Jan 12, 1999Data General CorporationSecurity system for computer systemsUS5860068 *Dec 4, 1997Jan 12, 1999Petabyte CorporationMethod and system for custom manufacture and delivery of a data productUS5862325 *Sep 27, 1996Jan 19, 1999Intermind CorporationComputer-based communication system and method using metadata defining a control structureUS5864667 *Aug 22, 1997Jan 26, 1999Diversinet Corp.Method for safe communicationsUS5864683 *Oct 12, 1994Jan 26, 1999Secure Computing CorporartionSystem for providing secure internetwork by connecting type enforcing secure computers to external network for limiting access to data based on user and process access rightsUS5864852 *Apr 26, 1996Jan 26, 1999Netscape Communications CorporationProxy server caching mechanism that provides a file directory structure and a mapping mechanism within the file directory structureUS5872844 *Nov 18, 1996Feb 16, 1999Microsoft CorporationSystem and method for detecting fraudulent expenditure of transferable electronic assetsUS5872849 *Feb 19, 1997Feb 16, 1999Certco LlcEnhanced cryptographic system and method with key escrow featureUS5872931 *Aug 13, 1996Feb 16, 1999Veritas Software, Corp.Management agent automatically executes corrective scripts in accordance with occurrences of specified events regardless of conditions of management interface and management engineUS6012144 *Oct 1, 1997Jan 4, 2000Pickett; Thomas E.Transaction security method and apparatusUS6014651 *Sep 23, 1998Jan 11, 2000Crawford; Christopher M.Commercial online software distribution systems and methods using encryption for securityUS6021510 *Nov 24, 1997Feb 1, 2000Symantec CorporationAntivirus acceleratorUS6023723 *Dec 22, 1997Feb 8, 2000Accepted Marketing, Inc.Method and system for filtering unwanted junk e-mail utilizing a plurality of filtering mechanismsUS6026414 *Mar 5, 1998Feb 15, 2000International Business Machines CorporationSystem including a proxy client to backup files in a distributed computing environmentUS6029256 *Dec 31, 1997Feb 22, 2000Network Associates, Inc.Method and system for allowing computer programs easy access to features of a virus scanning engineUS6178242 *Jan 28, 1998Jan 23, 2001Nds LimitedDigital recording protection systemUS6178509 *Sep 5, 1997Jan 23, 2001Intel CorporationTamper resistant methods and apparatusUS6182142 *Jul 10, 1998Jan 30, 2001Encommerce, Inc.Distributed access management of information resourcesUS6182226 *Mar 18, 1998Jan 30, 2001Secure Computing CorporationSystem and method for controlling interactions between networksUS6185678 *Oct 2, 1998Feb 6, 2001Trustees Of The University Of PennsylvaniaSecure and reliable bootstrap architectureUS6185682 *Jun 3, 1998Feb 6, 2001U.S. Philips CorporationAuthentication systemUS6185689 *Jun 24, 1998Feb 6, 2001Richard S. Carson & Assoc., Inc.Method for network self security assessmentUS6192360 *Jun 23, 1998Feb 20, 2001Microsoft CorporationMethods and apparatus for classifying text and for building a text classifierUS6192407 *Apr 4, 1997Feb 20, 2001Tumbleweed Communications Corp.Private, trackable URLs for directed document deliveryUS6338141 *Sep 30, 1998Jan 8, 2002Cybersoft, Inc.Method and apparatus for computer virus detection, analysis, and removal in real timeUS6341369 *Dec 3, 1998Jan 22, 2002International Business Machines CorporationMethod and data processing system for specifying and applying rules to classification-based decision points in an application systemUS6507851 *Dec 1, 1999Jan 14, 2003Sony CorporationCustomer information retrieving method, a customer information retrieving apparatus, a data preparation method, and a databaseUS6510431 *Jun 28, 1999Jan 21, 2003International Business Machines CorporationMethod and system for the routing of requests using an automated classification and profile matching in a networked environmentUS6510464 *Dec 23, 1999Jan 21, 2003Verizon Corporate Services Group Inc.Secure gateway having routing featureUS6510466 *Dec 14, 1998Jan 21, 2003International Business Machines CorporationMethods, systems and computer program products for centralized management of application programs on a networkUS6675153 *Aug 12, 1999Jan 6, 2004Zix CorporationTransaction authorization systemUS6675209 *Jul 19, 1999Jan 6, 2004Hewlett-Packard Development Company, L.P.Method and system for assigning priority among network segmentsUS6681331 *May 11, 1999Jan 20, 2004Cylant, Inc.Dynamic software system intrusion detectionUS6684335 *Aug 19, 1999Jan 27, 2004Epstein, Iii Edwin A.Resistance cell architectureUS6842860 *Jul 21, 2000Jan 11, 2005Networks Associates Technology, Inc.System and method for selectively authenticating dataUS6842861 *Mar 24, 2000Jan 11, 2005Networks Associates Technology, Inc.Method and system for detecting viruses on handheld computersUS6845449 *Jul 21, 2000Jan 18, 2005Networks Associates Technology, Inc.System and method for fast nested message authentication codes and error correction codesUS6847888 *Mar 6, 2003Jan 25, 2005Hrl Laboratories, LlcMethod and apparatus for geographic shape preservation for identificationUS6985923 *Jun 13, 2000Jan 10, 2006International Business Machines CorporationMethod, article of manufacture and apparatus for processing redundant electronic mail messagesUS6993660 *Dec 10, 2001Jan 31, 2006Mcafee, Inc.System and method for performing efficient computer virus scanning of transient messages using checksums in a distributed computing environmentUS7159237 *Jan 19, 2001Jan 2, 2007Counterpane Internet Security, Inc.Method and system for dynamic network intrusion monitoring, detection and responseUS20020001384 *Apr 4, 2001Jan 3, 2002Broadcom CorporationAuthentication engine architecture and methodUS20020004902 *Jun 21, 2001Jan 10, 2002Eng-Whatt TohSecure and reliable document deliveryUS20020016826 *Jul 16, 2001Feb 7, 2002Olof JohanssonFirewall apparatus and method of controlling network data packet traffic between internal and external networksUS20020016910 *Feb 9, 2001Feb 7, 2002Wright Robert P.Method for secure distribution of documents over electronic networksUS20020019945 *Apr 27, 2001Feb 14, 2002Internet Security System, Inc.System and method for managing security events on a networkUS20020023140 *Jun 8, 2001Feb 21, 2002Hile John K.Electronic document delivery systemUS20020026591 *Apr 12, 2001Feb 28, 2002Hartley Bruce V.Method and apparatus for assessing the security of a computer systemUS20030004688 *Jun 13, 2002Jan 2, 2003Gupta Ramesh M.Virtual intrusion detection system and method of using sameUS20030004689 *Jun 13, 2002Jan 2, 2003Gupta Ramesh M.Hierarchy-based method and apparatus for detecting attacks on a computer systemUS20030005326 *Jun 29, 2001Jan 2, 2003Todd FlemmingMethod and system for implementing a security application services providerUS20030009554 *Jul 9, 2001Jan 9, 2003Burch Hal JosephMethod and apparatus for tracing packets in a communications networkUS20030009693 *Jul 9, 2001Jan 9, 2003International Business Machines CorporationDynamic intrusion detection for computer systemsUS20030009696 *Jan 10, 2002Jan 9, 2003Bunker V. Nelson WaldoNetwork security testingUS20030009699 *Jun 13, 2002Jan 9, 2003Gupta Ramesh M.Method and apparatus for detecting intrusions on a computer systemUS20030014662 *Jun 13, 2002Jan 16, 2003Gupta Ramesh M.Protocol-parsing state machine and method of using sameUS20030014664 *Jun 26, 2002Jan 16, 2003Daavid HentunenIntrusion detection method and systemUS20030021280 *Jul 26, 2001Jan 30, 2003Makinson Graham ArthurMalware scanning using a network bridgeUS20030023692 *Nov 16, 2001Jan 30, 2003Fujitsu LimitedElectronic message delivery system, electronic message delivery managment server, and recording medium in which electronic message delivery management program is recordedUS20030023695 *May 10, 2002Jan 30, 2003Atabok Japan, Inc.Modifying an electronic mail system to produce a secure delivery systemUS20030023873 *Mar 16, 2001Jan 30, 2003Yuval Ben-ItzhakApplication-layer security method and systemUS20030023874 *Jul 16, 2001Jan 30, 2003Rudy ProkupetsSystem for integrating security and access for facilities and information systemsUS20030023875 *Jul 26, 2001Jan 30, 2003Hursey Neil JohnDetecting e-mail propagated malwareUS20040015554 *Jul 16, 2002Jan 22, 2004Brian WilsonActive e-mail filter with challenge-responseUS20050014749 *Jun 21, 2004Jan 20, 2005Amgen Inc.Piperazine derivatives and methods of useUS20050021736 *Oct 16, 2003Jan 27, 2005International Business Machines CorporationMethod and system for monitoring performance of distributed applicationsUS20050021738 *Nov 6, 2003Jan 27, 2005Kenneth GoellerNetwork geo-location system* Cited by examinerReferenced byCiting PatentFiling datePublication dateApplicantTitleUS7076655Jun 18, 2002Jul 11, 2006Hewlett-Packard Development Company, L.P.Multiple trusted computing environments with verifiable environment identitiesUS7159210Jun 18, 2002Jan 2, 2007Hewlett-Packard Development Company, L.P.Performing secure and insecure computing operations in a compartmented operating systemUS7197539Nov 1, 2004Mar 27, 2007Symantec CorporationAutomated disablement of disposable e-mail addresses based on user actionsUS7203964 *Oct 7, 2003Apr 10, 2007Elmer V. PassMethod of stopping internet virusesUS7219131Jan 16, 2003May 15, 2007Ironport Systems, Inc.Electronic message delivery using an alternate source approachUS7249162Feb 25, 2003Jul 24, 2007Microsoft CorporationAdaptive junk message filtering systemUS7272853Jun 4, 2003Sep 18, 2007Microsoft CorporationOrigination/destination features and lists for spam preventionUS7287060 *Jun 12, 2003Oct 23, 2007Storage Technology CorporationSystem and method for rating unsolicited e-mailUS7293063Jun 4, 2003Nov 6, 2007Symantec CorporationSystem utilizing updated spam signatures for performing secondary signature-based analysis of a held e-mail to improve spam email detectionUS7302698Nov 28, 2000Nov 27, 2007Hewlett-Packard Development Company, L.P.Operation of trusted state in computing platformUS7366919Apr 25, 2003Apr 29, 2008Symantec CorporationUse of geo-location data for spam detectionUS7409708May 28, 2004Aug 5, 2008Microsoft CorporationAdvanced URL and IP featuresUS7451184Oct 14, 2003Nov 11, 2008At&T Intellectual Property I, L.P.Child protection from harmful emailUS7461263 *Sep 24, 2003Dec 2, 2008Unspam, Llc.Method and apparatus for a non-revealing do-not-contact list systemUS7464264Mar 25, 2004Dec 9, 2008Microsoft CorporationTraining filters for detecting spasm based on IP addresses and text-related featuresUS7467370Mar 25, 2005Dec 16, 2008Hewlett-Packard Development Company, L.P.Apparatus and method for creating a trusted environmentUS7483947 *May 2, 2003Jan 27, 2009Microsoft CorporationMessage rendering for identification of content featuresUS7490244Sep 14, 2004Feb 10, 2009Symantec CorporationBlocking e-mail propagation of suspected malicious computer codeUS7506031Aug 24, 2006Mar 17, 2009At&T Intellectual Property I, L.P.Filtering email messages corresponding to undesirable domainsUS7519668Jun 20, 2003Apr 14, 2009Microsoft CorporationObfuscation of spam filterUS7530106 *Jul 2, 2008May 5, 2009Kaspersky Lab, ZaoSystem and method for security rating of computer processesUS7543053Feb 13, 2004Jun 2, 2009Microsoft CorporationIntelligent quarantining for spam preventionUS7546349Nov 1, 2004Jun 9, 2009Symantec CorporationAutomatic generation of disposable e-mail addressesUS7548956 *Dec 30, 2003Jun 16, 2009Aol LlcSpam control based on sender account characteristicsUS7555524Sep 16, 2004Jun 30, 2009Symantec CorporationBulk electronic message detection by header similarity analysisUS7558832May 2, 2007Jul 7, 2009Microsoft CorporationFeedback loop for spam preventionUS7610341Oct 14, 2003Oct 27, 2009At&T Intellectual Property I, L.P.Filtered email differentiationUS7617285Sep 29, 2005Nov 10, 2009Symantec CorporationAdaptive threshold based spam classificationUS7640590Dec 21, 2004Dec 29, 2009Symantec CorporationPresentation of network source and executable characteristicsUS7650382Apr 24, 2003Jan 19, 2010Symantec CorporationDetecting spam e-mail with backup e-mail server trapsUS7653695Feb 17, 2005Jan 26, 2010Ironport Systems, Inc.Collecting, aggregating, and managing information relating to electronic messagesUS7660865 *Aug 12, 2004Feb 9, 2010Microsoft CorporationSpam filtering with probabilistic secure hashesUS7664812 *Oct 14, 2003Feb 16, 2010At&T Intellectual Property I, L.P.Phonetic filtering of undesired email messagesUS7664819Jun 29, 2004Feb 16, 2010Microsoft CorporationIncremental anti-spam lookup and update serviceUS7665131Jan 9, 2007Feb 16, 2010Microsoft CorporationOrigination/destination features and lists for spam preventionUS7673342 *Jul 26, 2001Mar 2, 2010Mcafee, Inc.Detecting e-mail propagated malwareUS7676546 *Mar 25, 2003Mar 9, 2010Verisign, Inc.Control and management of electronic messagingUS7680886Apr 9, 2003Mar 16, 2010Symantec CorporationSuppressing spam using a machine learning based spam filterUS7711779Jun 20, 2003May 4, 2010Microsoft CorporationPrevention of outgoing spamUS7739494Sep 13, 2005Jun 15, 2010Symantec CorporationSSL validation and stripping using trustworthiness factorsUS7748038Dec 6, 2004Jun 29, 2010Ironport Systems, Inc.Method and apparatus for managing computer virus outbreaksUS7756930May 28, 2004Jul 13, 2010Ironport Systems, Inc.Techniques for determining the reputation of a message senderUS7756933Dec 12, 2005Jul 13, 2010Collactive Ltd.System and method for deterring rogue users from attacking protected legitimate usersUS7757288May 23, 2005Jul 13, 2010Symantec CorporationMalicious e-mail attack inversion filterUS7769485 *Sep 29, 2007Aug 3, 2010Pitney Bowes Inc.Systems and methods for segregating undesired mailUS7774845 *Nov 6, 2002Aug 10, 2010British Telecommunications Public Limited CompanyComputer security systemUS7788329Jan 12, 2006Aug 31, 2010Aol Inc.Throttling electronic communications from one or more sendersUS7788576 *Oct 4, 2006Aug 31, 2010Trend Micro IncorporatedGrouping of documents that contain markup language codeUS7810160Dec 28, 2005Oct 5, 2010Microsoft CorporationCombining communication policies into common rules storeUS7831667 *May 13, 2004Nov 9, 2010Symantec CorporationMethod and apparatus for filtering email spam using email noise reductionUS7844678Jun 25, 2008Nov 30, 2010At&T Intellectual Property I, L.P.Filtering email messages corresponding to undesirable domainsUS7849142May 27, 2005Dec 7, 2010Ironport Systems, Inc.Managing connections, messages, and directory harvest attacks at a serverUS7853654 *Jan 12, 2005Dec 14, 2010Kddi CorporationMass mail detection system and mail serverUS7856090Aug 8, 2005Dec 21, 2010Symantec CorporationAutomatic spim detectionUS7870200May 27, 2005Jan 11, 2011Ironport Systems, Inc.Monitoring the flow of messages received at a serverUS7873695May 27, 2005Jan 18, 2011Ironport Systems, Inc.Managing connections and messages at a server by associating different actions for both different senders and different recipientsUS7877799Aug 1, 2001Jan 25, 2011Hewlett-Packard Development Company, L.P.Performance of a service on a computing platformUS7904517Aug 9, 2004Mar 8, 2011Microsoft CorporationChallenge response systemsUS7912907Oct 7, 2005Mar 22, 2011Symantec CorporationSpam email detection based on n-grams with feature selectionUS7917588May 26, 2005Mar 29, 2011Ironport Systems, Inc.Managing delivery of electronic messages using bounce profilesUS7921159Oct 14, 2003Apr 5, 2011Symantec CorporationCountering spam that uses disguised charactersUS7930351 *Oct 14, 2003Apr 19, 2011At&T Intellectual Property I, L.P.Identifying undesired email messages having attachmentsUS7930353 *Jul 29, 2005Apr 19, 2011Microsoft CorporationTrees of classifiers for detecting email spamUS7936682Nov 9, 2005May 3, 2011Cisco Technology, Inc.Detecting malicious attacks using network behavior and header analysisUS7941490 *May 11, 2005May 10, 2011Symantec CorporationMethod and apparatus for detecting spam in email messages and email attachmentsUS7941491Jun 3, 2005May 10, 2011Messagemind, Inc.System and method for dynamic adaptive user-based prioritization and display of electronic messagesUS7941842Oct 28, 2008May 10, 2011Unspam, Llc.Method and apparatus for a non-revealing do-not-contact list systemUS7949718Nov 30, 2009May 24, 2011At&T Intellectual Property I, L.P.Phonetic filtering of undesired email messagesUS7966658Apr 8, 2004Jun 21, 2011The Regents Of The University Of CaliforniaDetecting public network attacks using signatures and fast content analysisUS7975010Mar 23, 2005Jul 5, 2011Symantec CorporationCountering spam through address comparisonUS7979907 *Dec 18, 2008Jul 12, 2011The Trustees Of Columbia University In The City Of New YorkSystems and methods for detection of new malicious executablesUS8001193 *May 16, 2006Aug 16, 2011Ntt Docomo, Inc.Data communications system and data communications method for detecting unsolicited communicationsUS8010685Nov 9, 2005Aug 30, 2011Cisco Technology, Inc.Method and apparatus for content classificationUS8028026 *May 31, 2006Sep 27, 2011Microsoft CorporationPerimeter message filtering with extracted user-specific preferencesUS8046832Jun 26, 2002Oct 25, 2011Microsoft CorporationSpam detector with challengesUS8056128 *Sep 30, 2004Nov 8, 2011Google Inc.Systems and methods for detecting potential communications fraudUS8056131 *Apr 26, 2004Nov 8, 2011Cybersoft, Inc.Apparatus, methods and articles of manufacture for intercepting, examining and controlling code, data and files and their transferUS8065370Nov 3, 2005Nov 22, 2011Microsoft CorporationProofs to filter spamUS8090778Dec 11, 2006Jan 3, 2012At&T Intellectual Property I, L.P.Foreign network SPAM blockerUS8103732 *Jan 22, 2010Jan 24, 2012Verisign, Inc.Methods for control and management of electronic messaging based on sender informationUS8122508 *Oct 29, 2007Feb 21, 2012Sonicwall, Inc.Analyzing traffic patterns to detect infectious messagesUS8145710Jun 17, 2004Mar 27, 2012Symantec CorporationSystem and method for filtering spam messages utilizing URL filtering moduleUS8161122Nov 13, 2007Apr 17, 2012Messagemind, Inc.System and method of dynamically prioritized electronic mail graphical user interface, and measuring email productivity and collaboration trendsUS8166310May 26, 2005Apr 24, 2012Ironport Systems, Inc.Method and apparatus for providing temporary access to a network deviceUS8171549 *Apr 26, 2004May 1, 2012Cybersoft, Inc.Apparatus, methods and articles of manufacture for intercepting, examining and controlling code, data, files and their transferUS8180838 *Aug 29, 2008May 15, 2012Microsoft CorporationEfficiently managing modular data storage systemsUS8191105 *Nov 18, 2005May 29, 2012Research In Motion LimitedSystem and method for handling electronic messagesUS8201254Aug 30, 2005Jun 12, 2012Symantec CorporationDetection of e-mail threat accelerationUS8214438Mar 1, 2004Jul 3, 2012Microsoft Corporation(More) advanced spam detection featuresUS8218765Feb 22, 2002Jul 10, 2012Hewlett-Packard Development Company, L.P.Information systemUS8219496Feb 22, 2002Jul 10, 2012Hewlett-Packard Development Company, L.P.Method of and apparatus for ascertaining the status of a data processing environmentUS8224905Dec 6, 2006Jul 17, 2012Microsoft CorporationSpam filtration utilizing sender activity dataUS8250159Jan 23, 2009Aug 21, 2012Microsoft CorporationMessage rendering for identification of content featuresUS8255995May 27, 2010Aug 28, 2012Cisco Technology, Inc.Methods and apparatus providing computer and network security utilizing probabilistic policy reposturingUS8296842Dec 1, 2004Oct 23, 2012The Regents Of The University Of CaliforniaDetecting public network attacks using signatures and fast content analysisUS8301702 *Mar 12, 2004Oct 30, 2012Cloudmark, Inc.Method and an apparatus to screen electronic communicationsUS8316442 *Jan 15, 2008Nov 20, 2012Microsoft CorporationPreventing secure data from leaving the network perimeterUS8332947Jun 27, 2006Dec 11, 2012Symantec CorporationSecurity threat reporting in light of local security toolsUS8392511 *Jan 17, 2008Mar 5, 2013International Business Machines CorporationEmbedding a unique serial number into the content of an email for tracking information dispersionUS8402102Nov 8, 2010Mar 19, 2013Symantec CorporationMethod and apparatus for filtering email spam using email noise reductionUS8413245 *May 1, 2006Apr 2, 2013Cisco Technology, Inc.Methods and apparatus providing computer and network security for polymorphic attacksUS8423616 *May 3, 2007Apr 16, 2013Microsoft CorporationIdentifying and correlating electronic mail messagesUS8463938 *Oct 23, 2009Jun 11, 2013Comcast Cable Communications, LlcAddress couplet communication filteringUS8495037 *Feb 21, 2006Jul 23, 2013Symantec Operating CorporationEfficient isolation of backup versions of data objects affected by malicious softwareUS8495144 *Oct 6, 2004Jul 23, 2013Trend Micro IncorporatedTechniques for identifying spam e-mailUS8495743May 1, 2006Jul 23, 2013Cisco Technology, Inc.Methods and apparatus providing automatic signature generation and enforcementUS8515894 *Dec 30, 2009Aug 20, 2013Gozoom.Com, Inc.Email analysis using fuzzy matching of textUS8515965 *Feb 23, 2012Aug 20, 2013Lsi CorporationConcurrent linked-list traversal for real-time hash processing in multi-core, multi-thread network processorsUS8528084Sep 23, 2011Sep 3, 2013Google Inc.Systems and methods for detecting potential communications fraudUS8533270Jun 23, 2003Sep 10, 2013Microsoft CorporationAdvanced spam detection techniquesUS8539587Mar 22, 2006Sep 17, 2013Hewlett-Packard Development Company, L.P.Methods, devices and data structures for trusted dataUS8572190 *Dec 1, 2009Oct 29, 2013Watchguard Technologies, Inc.Method and system for recognizing desired emailUS8577680Dec 30, 2006Nov 5, 2013Emc CorporationMonitoring and logging voice traffic on data networkUS8606860 *Oct 20, 2005Dec 10, 2013Affini, Inc.System and method for providing filtering email messagesUS8615802Sep 23, 2011Dec 24, 2013Google Inc.Systems and methods for detecting potential communications fraudUS8677490 *Dec 8, 2006Mar 18, 2014Samsung Sds Co., Ltd.Method for inferring maliciousness of email and detecting a virus patternUS8700913Sep 23, 2011Apr 15, 2014Trend Micro IncorporatedDetection of fake antivirus in computersUS8719356Apr 17, 2012May 6, 2014Return Path, IncMethods, systems, and computer readable media for monitoring deliverability of electronic mail based on subscriber and seed deliverability dataUS8732245 *Feb 7, 2003May 20, 2014Blackberry LimitedMethod, system and computer software product for pre-selecting a folder for a messageUS8732825 *May 28, 2008May 20, 2014Symantec CorporationIntelligent hashes for centralized malware detectionUS8745146Jan 13, 2012Jun 3, 2014Verisign, Inc.Control and management of electronic messagingUS8775604 *Nov 2, 2009Jul 8, 2014Barracuda Networks, Inc.Distributed frequency data collection via indicator embedded with DNS requestUS8832202 *Sep 10, 2008Sep 9, 2014Fujitsu LimitedE-mail information management apparatus, and E-mail information management methodUS8850566Oct 29, 2007Sep 30, 2014Sonicwall, Inc.Time zero detection of infectious messagesUS8892673 *Aug 9, 2004Nov 18, 2014Radix Holdings, LlcHybrid challenge-responseUS8904490May 10, 2011Dec 2, 2014Unspam, LlcMethod and apparatus for a non-revealing do-not-contact list systemUS8955106Aug 24, 2007Feb 10, 2015Sonicwall, Inc.Managing infectious forwarded messagesUS8955136Feb 20, 2012Feb 10, 2015Sonicwall, Inc.Analyzing traffic patterns to detect infectious messagesUS8996638Nov 1, 2013Mar 31, 2015Kaspersky Lab ZaoSystem and method for spam filtering using shinglesUS9083695May 13, 2014Jul 14, 2015Verisign, Inc.Control and management of electronic messagingUS9116879May 25, 2011Aug 25, 2015Microsoft Technology Licensing, LlcDynamic rule reordering for message classificationUS9152706Sep 14, 2012Oct 6, 2015Emc CorporationAnonymous identification tokensUS9154442Jul 17, 2013Oct 6, 2015Intel CorporationConcurrent linked-list traversal for real-time hash processing in multi-core, multi-thread network processorsUS9154511Jun 16, 2005Oct 6, 2015Dell Software Inc.Time zero detection of infectious messagesUS9208475 *Jun 11, 2009Dec 8, 2015Hewlett-Packard Development Company, L.P.Apparatus and method for email storageUS9223971 *Jan 28, 2014Dec 29, 2015Exelis Inc.User reporting and automatic threat processing of suspicious emailUS9224000 *Jun 14, 2012Dec 29, 2015Ionic Security, Inc.Systems and methods for providing information security using context-based keysUS9237163Dec 19, 2014Jan 12, 2016Dell Software Inc.Managing infectious forwarded messagesUS9264418 *Feb 20, 2014Feb 16, 2016Amazon Technologies, Inc.Client-side spam detection and preventionUS9264434 *Jun 1, 2009Feb 16, 2016Polyvalor, Limited PartnershipFile presence detection and monitoringUS9286469Aug 4, 2006Mar 15, 2016Cisco Technology, Inc.Methods and apparatus providing computer and network security utilizing probabilistic signature generationUS9305079Aug 1, 2013Apr 5, 2016Microsoft Technology Licensing, LlcAdvanced spam detection techniquesUS9325724Aug 28, 2014Apr 26, 2016Dell Software Inc.Time zero classification of messagesUS9336380Dec 15, 2010May 10, 2016Microsoft Technology Licensing LlcApplying activity actions to frequent activitiesUS9391936Feb 17, 2015Jul 12, 2016AO Kaspersky LabSystem and method for spam filtering using insignificant shinglesUS9461930Nov 28, 2012Oct 4, 2016Intel CorporationModifying data streams without reordering in a multi-thread, multi-flow network processorUS9473405 *Mar 10, 2014Oct 18, 2016Palo Alto Research Center IncorporatedConcurrent hashes and sub-hashes on data streamsUS9473576Apr 7, 2014Oct 18, 2016Palo Alto Research Center IncorporatedService discovery using collection synchronization with exact namesUS9497205 *Jun 30, 2008Nov 15, 2016Emc CorporationGlobal commonality and network loggingUS9516047Apr 20, 2016Dec 6, 2016Dell Software Inc.Time zero classification of messagesUS20020120575 *Feb 22, 2002Aug 29, 2002Hewlett-Packard CompanyMethod of and apparatus for ascertaining the status of a data processing environmentUS20020122543 *Feb 12, 2002Sep 5, 2002Rowen Chris E.System and method of indexing unique electronic mail messages and uses for the sameUS20020124052 *Feb 15, 2002Sep 5, 2002Richard BrownSecure e-mail handling using a compartmented operating systemUS20020194241 *Jun 18, 2002Dec 19, 2002Jonathan GriffinPerforming secure and insecure computing operations in a compartmented operating systemUS20020194493 *Jun 7, 2002Dec 19, 2002Hewlett-Packard CompanyDemonstrating integrity of a compartment of a compartmented operating systemUS20030023875 *Jul 26, 2001Jan 30, 2003Hursey Neil JohnDetecting e-mail propagated malwareUS20030079140 *Oct 24, 2001Apr 24, 2003Yosuke UraMultiple protecting system to protect personal computer data from burglary utilized flash memory driveUS20030084323 *Oct 31, 2001May 1, 2003Gales George S.Network intrusion detection system and methodUS20030149895 *Jan 29, 2002Aug 7, 2003Choo Tse HuongTrusted gateway systemUS20040003283 *Jun 26, 2002Jan 1, 2004Goodman Joshua TheodoreSpam detector with challengesUS20040111531 *Dec 6, 2002Jun 10, 2004Stuart StanifordMethod and system for reducing the rate of infection of a communications network by a software wormUS20040148506 *Sep 24, 2003Jul 29, 2004Prince Matthew B.Method and apparatus for a non-revealing do-not-contact list systemUS20040167964 *Feb 25, 2003Aug 26, 2004Rounthwaite Robert L.Adaptive junk message filtering systemUS20040177110 *Mar 3, 2003Sep 9, 2004Rounthwaite Robert L.Feedback loop for spam preventionUS20040199595 *Jan 16, 2003Oct 7, 2004Scott BanisterElectronic message delivery using a virtual gateway approachUS20040199773 *Apr 26, 2004Oct 7, 2004Radatti Peter V.Apparatus, methods and articles of manufacture for intercepting, examining and controlling code, data and files and their transferUS20040205135 *Mar 25, 2003Oct 14, 2004Hallam-Baker Phillip MartinControl and management of electronic messagingUS20040215977 *Feb 13, 2004Oct 28, 2004Goodman Joshua T.Intelligent quarantining for spam preventionUS20040221062 *May 2, 2003Nov 4, 2004Starbuck Bryan T.Message rendering for identification of content featuresUS20040260776 *Jun 23, 2003Dec 23, 2004Starbuck Bryan T.Advanced spam detection techniquesUS20040260922 *Mar 25, 2004Dec 23, 2004Goodman Joshua T.Training filters for IP address and URL learningUS20050015454 *Jun 20, 2003Jan 20, 2005Goodman Joshua T.Obfuscation of spam filterUS20050021649 *Jun 20, 2003Jan 27, 2005Goodman Joshua T.Prevention of outgoing spamUS20050022008 *Jun 4, 2003Jan 27, 2005Goodman Joshua T.Origination/destination features and lists for spam preventionUS20050022014 *Nov 6, 2002Jan 27, 2005Shipman Robert AComputer security systemUS20050080642 *Oct 14, 2003Apr 14, 2005Daniell W. ToddConsolidated email filtering user interfaceUS20050080860 *Oct 14, 2003Apr 14, 2005Daniell W. ToddPhonetic filtering of undesired email messagesUS20050080889 *Oct 14, 2003Apr 14, 2005Malik Dale W.Child protection from harmful emailUS20050091321 *Oct 14, 2003Apr 28, 2005Daniell W. T.Identifying undesired email messages having attachmentsUS20050097174 *Oct 14, 2003May 5, 2005Daniell W. T.Filtered email differentiationUS20050108339 *May 13, 2004May 19, 2005Matt GleesonMethod and apparatus for filtering email spam using email noise reductionUS20050154601 *Jan 9, 2004Jul 14, 2005Halpern Joshua I.Information security threat identification, analysis, and managementUS20050188032 *Jan 12, 2005Aug 25, 2005Katsuyuki YamazakiMass mail detection system and mail serverUS20050193073 *Mar 1, 2004Sep 1, 2005Mehr John D.(More) advanced spam detection featuresUS20050198289 *Mar 12, 2004Sep 8, 2005Prakash Vipul V.Method and an apparatus to screen electronic communicationsUS20050204005 *Mar 12, 2004Sep 15, 2005Purcell Sean E.Selective treatment of messages based on junk ratingUS20050204006 *Mar 12, 2004Sep 15, 2005Purcell Sean E.Message junk rating interfaceUS20050223221 *Mar 25, 2005Oct 6, 2005Proudler Graeme JApparatus and method for creating a trusted environmentUS20050229254 *Apr 8, 2004Oct 13, 2005Sumeet SinghDetecting public network attacks using signatures and fast content analysisUS20050240910 *Apr 26, 2004Oct 27, 2005Radatti Peter VApparatus, methods and articles of manufacture for intercepting, examining and controlling code, data, files and their transferUS20050265319 *May 26, 2005Dec 1, 2005Clegg Paul JMethod and apparatus for destination domain-based bounce profilesUS20050283837 *Dec 6, 2004Dec 22, 2005Michael OlivierMethod and apparatus for managing computer virus outbreaksUS20060010215 *May 27, 2005Jan 12, 2006Clegg Paul JManaging connections and messages at a server by associating different actions for both different senders and different recipientsUS20060010217 *Jun 3, 2005Jan 12, 2006Business Instruments Corp.System and method for dynamic adaptive user-based prioritization and display of electronic messagesUS20060026236 *Feb 7, 2003Feb 2, 2006Research In Motion LimitedMethod, system and computer software product for pre-selecting a folder for a messageUS20060031314 *May 28, 2004Feb 9, 2006Robert BrahmsTechniques for determining the reputation of a message senderUS20060031338 *Aug 9, 2004Feb 9, 2006Microsoft CorporationChallenge response systemsUS20060031359 *May 27, 2005Feb 9, 2006Clegg Paul JManaging connections, messages, and directory harvest attacks at a serverUS20060036693 *Aug 12, 2004Feb 16, 2006Microsoft CorporationSpam filtering with probabilistic secure hashesUS20060036695 *Aug 12, 2004Feb 16, 2006Rolnik Robert CTimed delivery of alert notifications based on user set criteriaUS20060059238 *May 27, 2005Mar 16, 2006Slater Charles SMonitoring the flow of messages received at a serverUS20060095523 *Jun 17, 2005May 4, 2006Bruno DecarpignySystem and method for sending messages into a communications network by electronic mail, based on the use of a send filterUS20060098585 *Nov 9, 2005May 11, 2006Cisco Technology, Inc.Detecting malicious attacks using network behavior and header analysisUS20060101680 *May 27, 2005May 18, 2006Smith Michael JContainer contents identifierUS20060123476 *Feb 11, 2005Jun 8, 2006Karim YaghmourSystem and method for warranting electronic mail using a hybrid public key encryption schemeUS20060161986 *Nov 9, 2005Jul 20, 2006Sumeet SinghMethod and apparatus for content classificationUS20060161989 *Dec 12, 2005Jul 20, 2006Eran ReshefSystem and method for deterring rogue users from attacking protected legitimate usersUS20060168059 *Oct 20, 2005Jul 27, 2006Affini, Inc.System and method for providing filtering email messagesUS20060168202 *Dec 12, 2005Jul 27, 2006Eran ReshefSystem and method for deterring rogue users from attacking protected legitimate usersUS20060212523 *Mar 21, 2005Sep 21, 2006International Business Machines CorporationPolicy based control of multiple message forwardsUS20060262867 *May 16, 2006Nov 23, 2006Ntt Docomo, Inc.Data communications system and data communications methodUS20070038705 *Jul 29, 2005Feb 15, 2007Microsoft CorporationTrees of classifiers for detecting email spamUS20070083606 *Dec 11, 2006Apr 12, 2007Bellsouth Intellectual Property CorporationForeign Network Spam BlockerUS20070118759 *Oct 7, 2005May 24, 2007Sheppard Scott KUndesirable email determinationUS20070118874 *Nov 18, 2005May 24, 2007Research In Motion LimitedSystem and method for handling electronic messagesUS20070118904 *Jan 9, 2007May 24, 2007Microsoft CorporationOrigination/destination features and lists for spam preventionUS20070143847 *May 1, 2006Jun 21, 2007Kraemer Jeffrey AMethods and apparatus providing automatic signature generation and enforcementUS20070143848 *May 1, 2006Jun 21, 2007Kraemer Jeffrey AMethods and apparatus providing computer and network security for polymorphic attacksUS20070150933 *Dec 28, 2005Jun 28, 2007Microsoft CorporationCombining communication policies into common rules storeUS20070198642 *Aug 24, 2006Aug 23, 2007Bellsouth Intellectual Property CorporationFiltering Email Messages Corresponding to Undesirable DomainsUS20070214220 *Mar 9, 2006Sep 13, 2007John AlsopMethod and system for recognizing desired emailUS20070256127 *Aug 4, 2006Nov 1, 2007Kraemer Jeffrey AMethods and apparatus providing computer and network security utilizing probabilistic signature generationUS20070282953 *May 31, 2006Dec 6, 2007Microsoft CorporationPerimeter message filtering with extracted user-specific preferencesUS20080033905 *Aug 5, 2007Feb 7, 2008Terry Lee StokesSystem and Method for the Capture and Archival of Electronic CommunicationsUS20080059588 *Sep 1, 2006Mar 6, 2008Ratliff Emily JMethod and System for Providing Notification of Nefarious Remote Control of a Data Processing SystemUS20080059590 *Sep 5, 2006Mar 6, 2008Ecole Polytechnique Federale De Lausanne (Epfl)Method to filter electronic messages in a message processing systemUS20080109448 *Jan 18, 2008May 8, 2008Messageone, Inc.System and Method for Managing Data Across Multiple EnvironmentsUS20080126951 *Nov 13, 2007May 29, 2008C-Mail Corp.System and method of dynamically prioritized electronic mail graphical user interface, and measuring email productivity and collaboration trendsUS20080134336 *Oct 29, 2007Jun 5, 2008Mailfrontier, Inc.Analyzing traffic patterns to detect infectious messagesUS20080147861 *Feb 16, 2007Jun 19, 2008Takumi OishiData distribution network and an apparatus of index holdingUS20080162135 *Dec 30, 2006Jul 3, 2008Emc CorporationAnalyzing network trafficUS20080275957 *May 3, 2007Nov 6, 2008Microsoft CorporationIdentifying and correlating electronic mail messagesUS20080307524 *Dec 1, 2004Dec 11, 2008The Regents Of The University Of CaliforniaDetecting Public Network Attacks Using Signatures and Fast Content AnalysisUS20080313708 *Jun 12, 2007Dec 18, 2008Alcatel LucentData content matchingUS20090055895 *Oct 28, 2008Feb 26, 2009Prince Matthew BMethod and Apparatus for a Non-Revealing Do-Not-Contact List SystemUS20090077182 *Sep 17, 2007Mar 19, 2009Iconix, IncSystem and method for identifying email campaignsUS20090084713 *Sep 29, 2007Apr 2, 2009Miller John PSystems and Methods for Segregating Undesired MailUS20090100079 *Sep 10, 2008Apr 16, 2009Fujitsu LimitedE-mail information management apparatus, and e-mail information management methodUS20090158429 *Jan 28, 2009Jun 18, 2009Marshall Van AlstyneMethods and systems for enabling analysis of communication content while preserving confidentialityUS20090164506 *Dec 8, 2008Jun 25, 2009Casdex, Inc.System and Method for Content-Based Email AuthenticationUS20090183257 *Jan 15, 2008Jul 16, 2009Microsoft CorporationPreventing secure data from leaving the network perimeterUS20090187629 *Jan 17, 2008Jul 23, 2009International Business Machines CorporationEmbedding a unque serial number into the content of an email for tracking information dispersionUS20090254992 *Dec 18, 2008Oct 8, 2009Schultz Matthew GSystems and methods for detection of new malicious executablesUS20090300761 *May 28, 2008Dec 3, 2009John ParkIntelligent Hashes for Centralized Malware DetectionUS20100049848 *Nov 2, 2009Feb 25, 2010Barracuda Networks, IncDistributed frequency data collection via indicator embedded with dns requestUS20100058023 *Aug 29, 2008Mar 4, 2010Microsoft CorporationEfficiently managing modular data storage systemsUS20100077051 *Nov 30, 2009Mar 25, 2010At&T Intellectual Property I, L.P.Phonetic Filtering of Undesired Email MessagesUS20100077052 *Dec 1, 2009Mar 25, 2010Watchguard Technologies, Inc.Method and system for recognizing desired emailUS20100077480 *Dec 8, 2006Mar 25, 2010Samsung Sds Co., Ltd.Method for Inferring Maliciousness of Email and Detecting a Virus PatternUS20100088380 *Jan 23, 2009Apr 8, 2010Microsoft CorporationMessage rendering for identification of content featuresUS20100106677 *Dec 30, 2009Apr 29, 2010Gozoom.Com, Inc.Email analysis using fuzzy matching of textUS20100242111 *May 27, 2010Sep 23, 2010Kraemer Jeffrey AMethods and apparatus providing computer and network security utilizing probabilistic policy reposturingUS20100306836 *Jan 22, 2010Dec 2, 2010Verisign, Inc.Control and Management of Electronic MessagingUS20100318612 *Jun 11, 2009Dec 16, 2010Vivek AgarwalApparatus and Method for Email StorageUS20110055343 *Nov 8, 2010Mar 3, 2011Symantec CorporationMethod and apparatus for filtering email spam using email noise reductionUS20110099291 *Oct 23, 2009Apr 28, 2011Comcast Cable Communications, LlcAddress Couplet Communication FilteringUS20110145267 *Jun 1, 2009Jun 16, 2011Jean-Pierre DavidFile presence detection and monitoringUS20110178962 *Mar 30, 2011Jul 21, 2011Messagemind, Inc.System and method for dynamic adaptive user-based prioritization and display of electronic messagesUS20110202620 *Apr 29, 2011Aug 18, 2011Tencent Technology (Shenzhen) Company LimitedMethod and device for intercepting junk mailUS20110238770 *Jun 7, 2011Sep 29, 2011Cloudmark, Inc.Method and apparatus to screen electronic communicationsUS20120158729 *Feb 23, 2012Jun 21, 2012Lsi CorporationConcurrent linked-list traversal for real-time hash processing in multi-core, multi-thread network processorsUS20130246378 *Apr 30, 2007Sep 19, 2013Stephen Owen HearndenPartial hash system, method, and computer program productUS20130246550 *May 14, 2013Sep 19, 2013Camcast Cable Communications, LLCAddress Couplet Communication FilteringUS20150256461 *Mar 10, 2014Sep 10, 2015Palo Alto Research Center IncorporatedConcurrent hashes and sub-hashes on data streamsUS20150347753 *Aug 10, 2015Dec 3, 2015Juniper Networks, Inc.Malware detection system and method for mobile platformsUS20150381539 *Sep 7, 2015Dec 31, 2015Bitdefender IPR Management Ltd.Systems and Methods for Spam Detection Using Frequency Spectra of Character StringsEP2315407A3 *Sep 24, 2010Jun 19, 2013Comcast Cable Communications, LLCAddress couplet communication filteringEP2715565A4 *May 25, 2012Jul 15, 2015Microsoft Technology Licensing LlcDynamic rule reordering for message classificationEP2811699A1 *Nov 26, 2013Dec 10, 2014Kaspersky Lab, ZAOSystem and method for spam filtering using shinglesWO2004088455A3 *Mar 24, 2004Dec 15, 2005Verisign IncControl and management of electronic messagingWO2005103899A1 *Dec 1, 2004Nov 3, 2005The Regents Of The University Of CaliforniaDetecting public network attacks using signatures and fast content analysisWO2005119482A1 *May 27, 2005Dec 15, 2005Ironport Systems, Inc.Method and apparatus for destination domain-based bounce profilesWO2005119485A1 *May 31, 2005Dec 15, 2005Ironport Systems, Inc.Method and apparatus for mail flow monitoringWO2006048529A1 *Oct 26, 2005May 11, 2006Bruno DecarpignySystem and method for transmitting messages in an electronic messaging communication network, using a transmission filterWO2009146536A1Jun 1, 2009Dec 10, 2009Corporation De L'ecole Polytechnique De MontrealFile presence detection and monitoringWO2012007202A1 *May 13, 2011Jan 19, 2012F-Secure CorporationIdentifying polymorphic malwareWO2012162676A2May 25, 2012Nov 29, 2012Microsoft CorporationDynamic rule reordering for message classification* Cited by examinerClassifications U.S. Classification709/206, 709/224International ClassificationH04L12/58, G06F21/00, H04L29/06Cooperative ClassificationH04L51/12, G06F21/562, H04L63/145, H04L12/585, G06F15/173European ClassificationH04L63/14D1, G06F21/56B, H04L12/58FLegal EventsDateCodeEventDescriptionSep 4, 2003ASAssignmentOwner name: BBNT SOLUTIONS LLC, MASSACHUSETTSFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MILLIKEN, WALTER CLARK;STRAYER, WILLIAM TIMOTHY;MILLIGAN, STEPHEN DOUGLAS;REEL/FRAME:014474/0767Effective date: 20030902May 12, 2004ASAssignmentOwner name: FLEET NATIONAL BANK, AS AGENT, MASSACHUSETTSFree format text: PATENT & TRADEMARK SECURITY AGREEMENT;ASSIGNOR:BBNT SOLUTIONS LLC;REEL/FRAME:014624/0196Effective date: 20040326Owner name: FLEET NATIONAL BANK, AS AGENT,MASSACHUSETTSFree format text: PATENT & TRADEMARK SECURITY AGREEMENT;ASSIGNOR:BBNT SOLUTIONS LLC;REEL/FRAME:014624/0196Effective date: 20040326Mar 2, 2006ASAssignmentOwner name: BBN TECHNOLOGIES CORP., MASSACHUSETTSFree format text: MERGER;ASSIGNOR:BBNT SOLUTIONS LLC;REEL/FRAME:017274/0318Effective date: 20060103Owner name: BBN TECHNOLOGIES CORP.,MASSACHUSETTSFree format text: MERGER;ASSIGNOR:BBNT SOLUTIONS LLC;REEL/FRAME:017274/0318Effective date: 20060103Sep 22, 2008ASAssignmentOwner name: STRAGENT, LLC, TEXASFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BBN TECHNOLOGIES CORP.;REEL/FRAME:021567/0572Effective date: 20080915Oct 27, 2009ASAssignmentOwner name: BBN TECHNOLOGIES CORP. (AS SUCCESSOR BY MERGER TOFree format text: RELEASE OF SECURITY INTEREST;ASSIGNOR:BANK OF AMERICA, N.A. (SUCCESSOR BY MERGER TO FLEET NATIONAL BANK);REEL/FRAME:023427/0436Effective date: 20091026Feb 8, 2010ASAssignmentOwner name: STRAGENT, LLC,TEXASFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:AZURE NETWORKS, LLC;REEL/FRAME:023905/0349Effective date: 20090820Owner name: AZURE NETWORKS, LLC,TEXASFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:STRAGENT, LLC;REEL/FRAME:023909/0810Effective date: 20081010RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services