Patent ID: 7610344

Claim:
A method, comprising: evaluating, by a mail transfer agent (MTA) independent of a mail recipient, a sender of an email, using multiple characteristics of an email delivery to establish a reputation for the sender of the email, wherein the sender of the email is connecting to the MTA, wherein evaluating comprises: monitoring, real-time, traffic patterns between the sender of the email and the MTA, collecting sender-specific information and heuristics from the email delivery, wherein the collecting occurs real-time at a conclusion of a Simple Mail Transfer Protocol (SMTP) session, and wherein the sender-specific information and heuristics include: whether a domain name provided includes one of .edu, .gov, or .mil; or whether the domain appears to point to a private computer, applying, in combination with the sender-specific information and heuristics, a machine learning process to generate an integer, the integer representative of a probabilistic reputation for the sender of the email, wherein the machine learning process classifies results of the evaluation of the delivery characteristics to establish the reputation, establishing a baseline reputation for the sender, comprising: evaluating a content of each email message from the sender; evaluating a ratio of emails that include favorable content to emails that include unfavorable content, per unit of time; and evaluating changes in the ratio over multiple units of time, comparing a first group of the evaluated delivery characteristics evaluated during a first time period with a second group of the evaluated delivery characteristics evaluated during a second time period to detect a change in a delivery behavior of the sender, wherein detecting a sudden change in the delivery behavior of the sender is an indication of malicious activity, malicious activity including a machine or a mail server being compromised, wherein the sudden change in the delivery behavior of the sender comprises: an abrupt onset or an abrupt abandonment of malicious spamming behavior; and using a trainable filter to perform the evaluating multiple characteristics of an email delivery to establish the reputation for the sender; training the trainable filter by analyzing email delivery used by multiple senders, the training occurring offline, outside of a system using the filter; and controlling a connection with the sender based on the reputation.