Patent ID: 8312085

Claim:
A method of detecting unsolicited bulk email, comprising: creating one or more spamtrap addresses for receiving unsolicited bulk email; storing information that specifies an amount of unsolicited bulk email received at the one or more spamtrap addresses; storing query data that specifies a number of queries received regarding senders of email; and identifying at least one sender who transmits a disproportionate amount of unsolicited bulk email by (i) automatically setting a threshold value based on one or more ratios of the stored information and the stored query data, the one or more ratios characterized by a first numerator to denominator relationship, (ii) calculating, for each sender, a ratio of an amount of unsolicited bulk email received at a spamtrap address from that sender to a number of queries regarding that sender, the ratio characterized by a second numerator to denominator relationship, and (iii) comparing the ratio for each sender to the threshold value; wherein the first numerator to denominator relationship corresponds to the second numerator to denominator relationship such that the numerator or denominator position of the stored information in the first numerator to denominator relationship is the same as the numerator or denominator position of the amount of unsolicited bulk email at a spamtrap address in the second numerator to denominator relationship.