Source: http://www.google.nl/patents/US20030041126?hl=nl
Timestamp: 2013-05-24 13:42:24
Document Index: 35520370

Matched Legal Cases: ['art 200315', 'art 20049', 'art 2009', 'art 200511', 'art 20039', 'art 2010', 'art 2011', 'art 2012', 'art 2012', 'art 20043', 'art 200312', 'art 2013']

Patent US20030041126 - Parsing of nested internet electronic mail documents - Google PatentenZoeken Afbeeldingen Maps Play YouTube Nieuws Gmail Drive Meer » Geavanceerd zoeken naar patenten | Webgeschiedenis | Inloggen Geavanceerd zoeken naar patenten PatentenA system and method for automatically processing and responding to large volumes of customer complaints regarding Unsolicited Commercial Email (UCE) and other service disruptions. The complaints include one or more electronic mail (email) documents, each email document including a header and body portion....http://www.google.nl/patents/US20030041126?utm_source=gb-gplus-sharePatent US20030041126 - Parsing of nested internet electronic mail documents PublicatienummerUS20030041126 A1PublicatietypeAanvraag Publicatiedatum27 feb 2003 Aanvraagdatum28 aug 2001 Prioriteitsdatum15 mei 2001Ook gepubliceerd alsUS7103599WO2002093428A1 PublicatienummerUS 2003/0041126 A1US2003/0041126A1 UitvindersJohn BufordXiaolan Huang Oorspronkelijke patenteigenaarVerizon Laboratories Inc. Classificatie in de VS709/220 Internationale classificatieG06Q10/00 Co�peratieve classificatieG06Q10/107 Europese classificatieG06Q 10/107Referenties Verwijzingen naar dit patent (52)Externe linksUSPTO USPTO-toewijzing EspacenetParsing of nested internet electronic mail documentsUS 20030041126 A1 Samenvatting A system and method for automatically processing and responding to large volumes of customer complaints regarding Unsolicited Commercial Email (UCE) and other service disruptions. The complaints include one or more electronic mail (email) documents, each email document including a header and body portion. The process parses the header and body portions from each email document, normalizes the header and body portion by stripping unwanted characters, and extracts specific information relating to the email document from the source of the complaint. The extracted information can be input to a database that can be accessed by the Customer Support Center (CSC) of the Internet Service Provider (ISP). Tekeningen(11) Claims
DESCRIPTION OF THE PREFERRED EMBODIMENT [0024] The parsing of a complaint email containing nested Internet mail documents according to the invention will now be described. Referring to FIG. 1, a standard simple email structure is illustrated. The standard email structure includes a header, H, and body, B. The header, H, includes one or more fields followed by a value, for example, field: value. The body, B, may include plain text, a Multi-Media Internet (MIME-type) object, a HyperText Markup Language (HTML) object, and the like. [0025] In general, a complaint is initiated when the source of the Unsolicited Commercial Email (UCE) or spam sends an email over a computer network, such as the Internet, to one or more Internet addresses. The complaint may be, for example, a UCE, a UseNet complaint, a security complaint, and the like. For brevity, the description herein discusses UCE, UBE (spam uttered by nonprofit and advocacy groups whose motives are not commercial) and other service disruptions on the Internet. However, it will be appreciated that the invention is not limited by the different types of complaints discussed herein, and that the invention can be applied to other similar types of complaints that may occur in a network environment. [0026] The Internet end-user that receives the UCE, commonly known as the complainant, reads the email sent from the spam source and receives one or more UCEs. If the complainant decides to complain about the UCE from the spam source, then the complainant can submit a complaint to the Internet Service Provider (ISP) that is the host of the spam sender through web pages. Alternatively, the complainant can send a form attaching the UCE or can send an email to the ISP attaching the UCE. [0027] The structure of the complaint received by the help desk of the ISP can vary for a variety of reasons, as shown in FIGS. 2(a)-(d). Referring now to FIG. 2(a), the structure of the email spam complaint may comprise, for example, a set of three concatenated email components or messages (H1,B1), (H2,B2) and (H3,B3). The header (H3) and body (B3) of the original spam message is the innermost or third email message (H3,B3). The innermost email message (H3,B3) is forwarded by the complainant by email to the help desk of the Customer Support Center (CSC) in the second email message (H2,B2). Usually, the body B2 concatenates or mime-encapsulates (in plain text and/or HTML formats) one or more copies of the original spam email (H3,B3). An automated tracking system of the ISP may embed each of the incoming complaints in an outermost or third email message (H1,B1). The body B1 concatenates in plain text the complainant email (H2,B2) and may contain the fields: Sender, Tracking Number and Pool. The header H1 may contain a Subject field containing the complaint tracking code. [0028] It will be appreciated that the embedded messages (H1,B1), (H2,B2) and/or (H3,B3) preferably conform to Internet email standard (Internet Engineering Task Force) IETF RFC 822. However, the embedded email messages (H1,B1), (H2,B2) and/or (H3,B3) may or may not be encoded as (Multi-Media Internet) MIME-types (IETF RFC 2045). It has been shown that this type of spam email complaint with three concatenated email messages (H1,B1), (H2,B2) and (H3,B3) is forwarded to the help desk of the ISP by the complainant about 57% of the time. [0029] Alternatively, the complainant can find the source of the UCE by using well-known tools available on the Internet, such as SpamCop, that creates and sends an analysis email that includes portions of the original spam. In this case, the Internet tool will generate the second message (H2,B2) with B2 containing H3 (the header of the original spam), an exploded view of H3, and extracts from B3 (the body of the original spam), as shown in FIG. 2(b). It has been shown that this type of spam email complaint with three concatenated email messages (H1,B1), (H2,B2) and (H3,B3) is forwarded to the help desk of the ISP by SpamCop (or other third party) about 35% of the time. [0030] Another possibility for the structure of the email spam complaint is where two copies of the spam are forwarded in the second message (H2,B2), one in the HyperText Markup Language (HTML) (H3,B3), and the other as a MIME-type object (H4,B4), as shown in FIG. 2(c). It has been shown that this type of spam email complaint with both HTML and MIME objects is forwarded to the help desk of the ISP about 6% of the time. [0031] Yet another possibility is that the complainant may omit all or part of the spam complaint. Alternatively, the spam complaint may be included in a corrupted fashion when using the spam tool, or the second header for the spam complaint (H2) may have been hacked by the spammer, as shown in FIG. 2(d). In this case, the message (H1,B1) is the internal tracking labeling, and message (H2,B2) is the complainant. It has been shown that this type of spam email complaint in which the embedded email document does not include a header is forwarded to the help desk of the ISP by the complainant about 1% of the time. [0032] Still yet another possibility is where a spam is sourced from a non-ISP network computer, but because of a configuration problem on a ISP network computer, a third party spam can be forwarded through the ISP network computer. This type of complaint occurs less than 1% of the time. [0033] It will be appreciated that there are variations of the above-mentioned examples that complicate the parsing of nested email messages. For example, one or more blank lines between the header lines may have been unintentionally introduced by the forwarding of the embedded email messages, or may have been intentionally introduced by the spammer. Because a blank line is a separator between the body and header of an email conforming to the IETF RFC 822 standard, the blank line makes it difficult to isolate the body and the header of the email message. Further, some of the embedded email messages may be encapsulated as MIME-type objects that require MIME identification and extraction. Other complaints may be missing a header in the embedded email document or the complaint may only be a single layer email document with nothing embedded at all. [0034] After the help desk of the ISP receives the spam email complaint, the CSC of the ISP may categorize the complaint according to a set of rules adopted by the ISP. The complaint can be categorized as to whether the action for the complaint should either be routed or analyzed by the automated complaint processing system. It will be appreciated that the rules adopted by the ISP to categorize the complaint can be configured according to a particular ISP. An exemplary list of possible complaint categories is given in Table 1. [0035] As mentioned above, a majority of the complaints received by the help desk of the ISP contains either a concatenated or encapsulated three or more Internet emails. Once the complainant forwards the email to the help desk of the ISP, the next step of the process is to automatically parse the nested electronic mail (email) documents in accordance with the system and method the invention. [0036] The system and method of the invention can be summarized in a few basic steps as follows: 1) retrieving a complaint with one or more nested electronic mail documents from a complainant over a computer network; 2) parsing or separating of the nested electronic mail documents into a plurality of message components, such as a header and a body of the email using a separator; 3) normalizing the spam email for converting at least one of the message components into a common presentation format by stripping unwanted characters using a normalizer; and 4) using an analysis protocol on the spam email to analyze the message components by way of the common presentation format and extract specific information of the message, such as an IP address, a domain name, and an electronic mail address using an extractor. The system and method of the invention can be implemented by the use of a central processing unit (CPU) capable of executing software that is written in any well-known programming language. [0037] More specifically, after receiving an email complaint with nested electronic mail documents, the process loops through the headers (H1,H2,H3) to separate each header and body (H3,B3), (H2,B2), (H1,B1) to find the source of the spam email contained in header H3 and body B3, and records the email structure status for information purposes. Referring now to FIG. 3, the process determines whether the body B3 of the received email includes a mime-type object that requires MIME processing in Step 3.1. If so, then the process invokes MIME-type specific processing in Step 3.2 before proceeding to Step 3.3. If not, then the forwarded delimiters, for example, the symbol �>� at the beginning of the Received lines are stripped or removed in Step 3.3. In addition, the HTML tags are stripped or removed in Step 3.4. [0038] Because a typical email header contains a header keyword followed by an associated value, the process analyzes each line of the header H3 to determine whether any header keywords can be identified to detect the beginning of the header H3 in Step 3.5. An exemplary list of possible header keywords is given in Table II. [0039] It should be noted that some header keywords can have multiple values, for example, the �Received� header keyword can have multiple values. It will be appreciated that the invention is not limited by the list of header keywords, and that the invention can be practiced by recognizing or detecting any desirable header keys or keywords. [0040] If a header keyword is detected in Step 3.5, then the ambiguous characters in the header, one or more extra blank lines, spaces, header corruption and missing fields are detected in Step 3.6. Then, the corruption is fixed by removing extra spaces and blank lines within the header H3 in Step 3.7. The fix of the ambiguous characters that are corrupted depends on the particular header keyword. Next, the process searches for a blank line to detect the end of a header H3 and a beginning of a body B3 in Step 3.8. At this point, the process loops to Step 3.1 to begin the processing of another embedded body B2,B1 in the nested electronic mail documents. If in Step 3.5, a header keyword is not detected, the email structure status is recorded to provide information to the ISP regarding email documents that contain unacceptable header and/or body information for review by the ISP in Step 3.9. [0041] Next, the process loops through the embedded headers H3 to find the source of the spam email and validate the IP address of the spam source using an analysis protocol, as shown in FIG. 4. Then, the last validated header, as shown in FIG. 6(b), is obtained to identify the actual source of the embedded email from multiple Received lines the validated header H3 in Step 4.1. Next, the innermost Received line is located in Step 4.2. [0042] Then, the system determines whether the source IP address from the Received line in the header H3 is valid in Step 4.3. A process for validating the source IP address from the Received line is shown in FIG. 5. First, each character of the Received line is examined to locate one or more delimiters in which the source IP address may be located in Step 5.1. Typically, the source IP address conforming to the Internet Information Server protocol (IIS) Version 4.0 is contained within a set of delimiters and is composed of four numbers connected by three dots. The numbers are between 0-255. For example, the source IP address may be contained in the following set of delimiters: (. . .[IP]), ([IP]), [IP], (IP), and the like. Thus, a valid source IP address may be, for example, [216.214.23.204]. It will be appreciated that the invention is not limited by the set of delimiters and how many numbers are used for the source IP address. For example, the invention can be practiced to identify the source IP address for the IIS Version 5.0, the IIS Version 6.0 protocols, and the like. [0043] Next, the process verifies that the source IP address is contained within the set of delimiters in Step 5.2. When using the IIS Version 4.0 protocols, for example, the source IP address can be verified by determining whether each of the four numbers are between 0 and 255. If so, then the process determines whether the IP address is a public address in Step 5.3 by using any well known methods, such as a lookup table. If so, then the process stops and returns a value to indicate that a valid source IP address has been found at Step 5.4. If not, then the process determines whether another IP address is contained within the Received line in Step 5.5. If another IP address is contained in the Received line, then the process proceeds to Step 5.6 to obtain the next source IP address and returns to Step 5.2 to verify the new source IP address. The process loops through all the Received lines to locate a valid IP source address for the embedded header H3 (Steps 5.2, 5.5 and 5.6). If the process did not find a valid source IP address after looping through all the Received lines, then the process stops and returns a value to indicate that a valid source IP address has not been found at Step 5.7. [0044] It will be appreciated that the invention is not limited by validating the source IP address from the Received Line in the header H3 of the spam email and that the invention can be used to validate other information from the Received Line using other delimiting characters, such as dashes and dots, and the like. [0045] Referring now to FIG. 4, if the process described in FIG. 5 returns a value indicating a valid source IP address, then the process stops in Step 4.4. If the source IP address is invalid, then the process will attempt to locate a Received line in the header at the next higher level for the header H3 in Step 4.5. If a Received line exists in the next higher level for header H3, then the Received line for the higher level for header H3 is obtained in Step 4.6, and the IP address of the spam source from the Received line is validated in Step 4.3. If the process does not find a valid IP address for the spam source for the next higher level header H3 in Step 4.5, the process continues to loop through all the higher level headers H3 in an attempt to locate a Received line (Steps 4.3, 4.5 and 4.6). [0046] If in Step 4.5, a Received line in the header H3 could not be found, then the process determines whether a higher level header H2,H1 exists in Step 4.7. If no other headers exist, then the process stops at Step 4.8. If a header H2,H1 exists, then the header information is obtained from the lower most level within the header H2,H1 in Step 4.9 and the process returns to Step 4.2 to locate the innermost Received line for the higher level header H2,H1. In a manner similar to the manner for header H3 described above, the process continues to loop through all the Received lines for the higher level header H2,H1 to determine a valid IP address for the spam source as described above. [0047] It will be appreciated that the invention can be applied to parsing of electronic mail documents to obtain a variety of other useful information in addition to the IP address for the spam source. For example, the body B3 may be parsed to obtain the URL, email address, and telephone number of the spam source. The received from path, from, date, and subject may be parsed from the header H3. The email address of the complainant (�From:�) contained in the header H2 may be parsed using the method of the invention. In addition, the �Sender� and �Pool� may be parsed from the body B1. [0048] An example of a complaint email received by the help desk of the ISP is illustrated in FIG. 6. From the header H3, the method of the invention automatically parses, for example, the complaint tracking code 61 and the IP address 62 of the spam source from the innermost Received line 63, and the first line 64 of the subject and Universal Resource Locator (URL) 65 from the body B3. [0049] The information that is parsed may be automatically entered into a database 70 as a complaint record 71, as shown in FIG. 7. Each record 71 may contain, for example, the complaint tracking code 72, the Received line of the spam 73, the IP address of the spam source 74, the First Line of the spam 75, the URL of the spam source 76, the body of the spam 77, and any other useful information or comments, such a the Spam Number and the Tracking Number. The collection of the information into the database 70 allows the ISP to view reports or generate charts or graphs for a particular spam source. The database 70 may also enable the ISP to search the database 70 for a particular field, for example, the IP address of the spam source. [0050] As described above, one embodiment of the method of the invention has been presented as a set of process flow charts that involve information flow between the UCE source, the customer and the ISP help desk. The flow charts define a general process by which an ISP can streamline and organize the handling of incoming complaints received electronically. This process can not be duplicated by a voice response system because the complaints involve detailed textual information. However, other systems for spam filtering or spam detection can be complimentary to the method of the invention. [0051] It will be appreciated that a different structural embodiment of the method of the invention can occur for a small ISP as compared to a large ISP that would have corresponding different volumes of complaints to handle. For example, a relatively small ISP may coalesce the Level 1 and Level 2 Customer Support Center (CSC) functions for receiving telephone calls and technical support. It will also be appreciated that the invention can be practiced with other CSC level functions, such as Level 3 and Level 4 functions for operations security and network engineering, respectively. Further, different ISPs may have different business policies regarding specific actions to be taken when receiving a complaint. These actions may vary as to the severity and threshold of the complaint. [0052] It will also be appreciated that the invention is a reactive one with many possible variations. One variation of the illustrated embodiment of the invention may include a type of complainant self-service, for example, using a web site for the customer to process a complaint. Generally, customer self-service facilities are secured through login access to permit the customer to see his/her own information. However, the complainant self-service method may be limited to the use of non-proprietary information because some information for processing the complaint may involve information that is proprietary to the customer. [0053] As described above, the invention provides an explicit process that is needed to insure that all complaints are successfully handled, that processing of complaints is done correctly, that legal aspects of certain criminal or fraud relating incidents are handled, and that portions of the process that can be automated using data processing systems can be identified to the extent possible. Without such a system and process in place, an ISP help desk would have an ad hoc system that may not insure that all complaints are handled correctly, and it will be difficult to introduce automation into such an environment. [0054] While the invention has been specifically described in connection with certain specific embodiments thereof, it is to be understood that this is by way of illustration and not of limitation, and the scope of the appended claims should be construed as broadly as the prior art will permit. BRIEF DESCRIPTION OF THE DRAWINGS [0017]FIG. 1 shows a simple one header, one body electronic mail spam complaint. [0018] FIGS. 2(a)-(d) show an example of an embedded electronic mail spam complaint and possible format of layers. [0019]FIG. 3 shows a flowchart of parsing of nested electronic mail documents in which the type of processing (HTML or MIME) and location of the header with multiple lines are determined from the received email complaint according to the invention. [0020]FIG. 4 shows a flowchart of parsing of nested electronic mail documents in which the header with multiple lines of FIG. 3 is processed to locate and validate the embedded email source IP address. [0021]FIG. 5 shows a flowchart of parsing of nested electronic mail documents in which the embedded email source IP address of FIG. 4 is processed to locate the IP address. [0022]FIG. 6(a)-(d) show an example of a complaint email received at the help desk of the ISP. [0023]FIG. 7 shows an example of a database containing information extracted from the complaint email of FIG. 6. Verwijzingen naar dit patent Citerend patent Aanvraagdatum Publicatiedatum Aanvrager TitelUS72191483 maart 200315 mei 2007Microsoft CorporationFeedback loop for spam preventionUS724916225 feb 200324 juli 2007Microsoft CorporationAdaptive junk message filtering systemUS72728534 juni 200318 sept 2007Microsoft CorporationOrigination/destination features and lists for spam preventionUS74065029 juli 200329 juli 2008Sonicwall, Inc.Method and system for classifying a message based on canonical equivalent of acceptable items included in the messageUS740970828 mei 20045 aug 2008Microsoft CorporationAdvanced URL and IP featuresUS74339247 aug 20037 okt 2008International Business Machines CorporationInterceptor for non-subscribed bulk electronic messagesUS746426425 maart 20049 dec 2008Microsoft CorporationTraining filters for detecting spasm based on IP addresses and text-related featuresUS74839472 mei 200327 jan 2009Microsoft CorporationMessage rendering for identification of content featuresUS750245928 feb 200210 maart 2009Adaptec, Inc.Unified services entitlement architectureUS751966820 juni 200314 april 2009Microsoft CorporationObfuscation of spam filterUS753972623 april 200326 mei 2009Sonicwall, Inc.Message testingUS754305313 feb 20042 juni 2009Microsoft CorporationIntelligent quarantining for spam preventionUS75588322 mei 20077 juli 2009Microsoft CorporationFeedback loop for spam preventionUS756212229 okt 200714 juli 2009Sonicwall, Inc.Message classification using allowed itemsUS75744714 maart 200511 aug 2009Gryphon Networks Corp.System and method for exchanging information with a relationship management systemUS762069025 okt 200417 nov 2009Lashback, LLCPrivacy control system for electronic communicationUS763072729 juni 20068 dec 2009Alcatel-Lucent Usa Inc.MAP message processing for SMS spam filteringUS764031317 juli 200729 dec 2009Microsoft CorporationAdaptive junk message filtering systemUS766086512 aug 20049 feb 2010Microsoft CorporationSpam filtering with probabilistic secure hashesUS766481929 juni 200416 feb 2010Microsoft CorporationIncremental anti-spam lookup and update serviceUS76651319 jan 200716 feb 2010Microsoft CorporationOrigination/destination features and lists for spam preventionUS767654625 maart 20039 maart 2010Verisign, Inc.Control and management of electronic messagingUS772082829 juni 200518 mei 2010Bookstaff BlakeMethod and system for automated intelligent electronic advertisingUS77748456 nov 200210 aug 2010British Telecommunications Public Limited CompanyComputer security systemUS787020617 nov 200611 jan 2011International Business Machines CorporationMethod, computer program product, and user interface for making non-shared linked documents in electronic messages accessible to recipientsUS788218929 okt 20071 feb 2011Sonicwall, Inc.Using distinguishing properties to classify messagesUS79045179 aug 20048 maart 2011Microsoft CorporationChallenge response systemsUS792120429 okt 20075 april 2011Sonicwall, Inc.Message testing based on a determinate message classification and minimized resource consumptionUS794149011 mei 200510 mei 2011Symantec CorporationMethod and apparatus for detecting spam in email messages and email attachmentsUS794562728 sept 200617 mei 2011Bitdefender IPR Management Ltd.Layout-based electronic communication filtering systems and methodsUS800520023 dec 200423 aug 2011Gryphon Networks Corp.System and method for control of communications connections and notificationsUS80106141 nov 200730 aug 2011Bitdefender IPR Management Ltd.Systems and methods for generating signatures for electronic communication classificationUS80503943 okt 20051 nov 2011Gryphon Networks Corp.System and method for control of communications connections and notificationsUS810373222 jan 201024 jan 2012Verisign, Inc.Methods for control and management of electronic messaging based on sender informationUS810847713 juli 200931 jan 2012Sonicwall, Inc.Message classification using legitimate contact pointsUS811248620 sept 20077 feb 2012Sonicwall, Inc.Signature generation using message summariesUS81309288 dec 20066 maart 2012Bookstaff BlakeMethod and system for number indexing for advertisingUS813579014 nov 200913 maart 2012Lashback, LLCPrivacy control system for electronic communicationUS81709664 nov 20081 mei 2012Bitdefender IPR Management Ltd.Dynamic streaming message clustering for rapid spam-wave detectionUS82144381 maart 20043 juli 2012Microsoft Corporation(More) advanced spam detection featuresUS82492328 april 200421 aug 2012Gryphon Networks Corp.System and method for control of communications connectionsUS825015923 jan 200921 aug 2012Microsoft CorporationMessage rendering for identification of content featuresUS826621520 feb 200311 sept 2012Sonicwall, Inc.Using distinguishing properties to classify messagesUS827160316 juni 200618 sept 2012Sonicwall, Inc.Diminishing false positive classifications of unsolicited electronic-mailUS829102126 feb 200716 okt 2012Red Hat, Inc.Graphical spam detection and filteringUS82963825 april 201123 okt 2012Sonicwall, Inc.Efficient use of resources in message classificationUS838552421 juli 201126 feb 2013Gryphon Networks Corp.System and method for control of communications connections and notificationsUS839692611 maart 200312 maart 2013Sonicwall, Inc.Message challenge responseUS2008020898726 feb 200728 aug 2008Red Hat, Inc.Graphical spam detection and filteringUS2010022875418 juni 20099 sept 2010Canon Kabushiki KaishaSearch engine and search methodEP1484893A221 mei 20048 dec 2004Microsoft CorporationOrigination/destination features and lists for SPAM preventionWO2006005001A229 juni 200512 jan 2006Bookstaff, BlakeMethod and system for automated intelligent electronic advertisingDraaienOriginele afbeeldingGoogle Startpagina - Sitemap - USPTO-bulkdownloads - Privacybeleid - Servicevoorwaarden - Over Google Patenten - Feedback verzendenGegevens geleverd door IFI CLAIMS Patent Services© 2012 Google