Patent ID: 7617526

Claim:
A method of blocking spam at a firewall, comprising the steps of: receiving a spam e-mail message in a time interval during which no blocking measure is active; applying a blocking measure for a duration that is determined adaptively; and suspending the blocking measure in accordance with a state B(t) of the blocking measure at time t for discrete values of t which are integer multiples of a time interval Dt, said discrete values of t representing t=0, Dt, 2*Dt, . . . , J*Dt, wherein J is a positive integer equal to or greater than 2; wherein if B(t)=I then the blocking measure is applied and if B(t)=0 then the blocking measure is suspended; wherein A(t)=I if a spam e-mail message has arrived during a time interval Dt immediately preceding time t and A(t)=0 otherwise; wherein N(t)=A(t)*(I−B(t)); wherein S(t) is a time stamp indicating the absolute start time of a most recent sequence of time values with consecutive application of the blocking measure; wherein K(t) is a count of the number of times, within a present epoch of consecutive detections of spam e-mail message, that the blocking measure has been suspended and then re-applied in response to detection of a spam e-mail message; wherein P(t) is a duration of the blocking measure and is a non-decreasing function of K(t); wherein a specified positive integer L is a maximum permitted value of K(t); wherein t=0 is a time prior to execution of a loop of J iterations denoted as iterations 1, 2, . . . , J; wherein at t=0, B( 0 )=I, A( 0 )=I, S( 0 )=0, K( 0 )=0, and P( 0 )=P.sub.0=I*Dt, wherein I is a positive integer; wherein B(t), S(t), and K(t) are iteratively computed during execution of the loop such that in each iteration: B ( t+Dt )= N ( t )*( I−B ( t ))+( I−N ( t )*( I−B ( t ))) *if (t+Dt−S(t)i, else 0), S ( t+Dt )= B ( t+Dt )*( I−B ( t ))*( t+Dt−S ( t )+ S ( t ), K ( t+DT )=min{ L,N ( t )*( K ( t )+ I )+( I−N ( t ))* B ( t )* K ( t )}, t=t+DT after B(t+Dt), S(t+Dt), and K(t+Dt) have been determined.