At&t Intellectual Property I, LP

Stephen K Wood

David Hoeflin

Danielle Liu

Chaim Spielman

Willa Kay Ehrlich

Emails and other electronic messages are passed through a spam filter and classified as not spam. Thereafter, the electronic messages are sent and received at user computers. Reports may then be received specifying or informing that the electronic messages are missed spam by the spam filter. The electronic messages may then be reclassified as spam and the spam filter modified.

Methods, systems, and products for spam messages

The present disclosure relates to mitigating email spam attacks. A gateway is configured to receive mail from one or more mail systems. If mail is intended for delivery to an invalid address, the gateway can generate status messages for delivery to the mail systems or determine if a threshold for delivery attempts to the invalid address has been met. If the threshold has been met, the gateway can request creation of a honeypot email address, and future mail intended for delivery to the invalid address are delivered to a mailbox associated with the honeypot email address. Various actions can be taken with respect to the mail delivered to the honeypot email address including analysis, blacklisting of senders, and/or other actions.

Mitigating email SPAM attacks

A method is disclosed including passing a plurality of e-mails through a spam filter and classifying at least of the plurality of e-mails as not spam. Thereafter, the plurality of e-mails are received at each of a plurality of user computers. The method may further include receiving a plurality of reports, the plurality of reports including one report from each of the plurality of user computers that one or more of the plurality of e-mails are spam that was not classified as spam by the spam filter. Based on the plurality of reports, one or more of the plurality of e-mails is reclassified as spam and/or the spam filter is modified.

Method and apparatus for reclassifying E-mail or modifying a spam filter based on users' input

A method and system for determining whether an IP address is part of a bot-network are provided. The IP-address-aggregate associated with the IP address of an e-mail sender is determined. The IP-address-aggregate is associated with an IP-address-aggregate-category based on the current SMTP traffic characteristics of the IP-address-aggregate and the known SMTP traffic characteristics of an IP-address-aggregate-category. A bot-likelihood score of the IP-address-aggregate-category is then associated with IP-address-aggregate. IP-address-aggregate-categories can be established based on historical SMTP traffic characteristics of the IP-address-aggregates. The IP-address-aggregates are grouped based on SMTP characteristics, and the IP-address-aggregate-categories are defined based on a selection of IP-address-aggregates with similar SMTP traffic characteristics that are diagnostic of spam bots vs. non-botnet-controllers spammers. Bot likelihood scores are determined for the resulting IP-address-aggregate-categories based on historically known bot IP addresses.

Bot-network detection based on simple mail transfer protocol (SMTP) characteristics of e-mail senders within IP address aggregates

A method of detecting and responding to an email address harvest attack at an Internet Service Provider (ISP) email system includes counting a number of failed email address look-ups during a single Simple Mail Transfer Protocol (SMTP) session associated with an originating Internet Protocol (IP) address and responding to the originating IP address with a positive acknowledgement that an otherwise invalid email address exists when the count of the number of failed email address look-ups exceeds a threshold.

Methods, systems, and computer program products for mitigating email address harvest attacks by positively acknowledging email to invalid email addresses

Method and apparatus for reclassifying e-mail or modifying a spam filter based on users' input

The invention provides a method and device for limiting unwanted network traffic, including unwanted emails. The method proceeds by assigning at least one network address to a category of network addresses based on a level of trust of the network address. Connection resources are allocated to the category. When a connection is received from a network address to which the category has been assigned, a portion of the allocated resources in the category are provided to the network address.

Growing community of inventors

Whitehouse St., NJ, United States of America

Stephen K Wood