System and method for managing e-mail message traffic

[0001] The present invention relates in general to electronic mail. More specifically, the present invention provides system and method for managing e-mail traffic originating from a specific IP address.

[0002] According to a study undertaken for the European Commission, Internet subscribers world-wide are unwittingly paying an estimated euro 10 billion a year in connection costs just to receive junk e-mails (also referred to as spam). Typically, a person who sends spam (the spammer) will do so via a dial-up or a broadband Internet Service Provider (ISP). The spammer sends e-mail message from an e-mail client and uses the ISP's e-mail server to deliver the e-mail message to the recipients or to other e-mail servers that will eventually forward the e-mail message to the intended recipient.

[0003] Today, there are few good solutions for preventing the transmission of spam. Typically, a spammer is stopped when the spammer's ISP receives a certain number of complaints about the spammer's activities, at which point the ISP may elect to deny the spammer access to the ISP's e-mail server (assuming that the ISP is able to determine which customer is the spammer). If the ISP from which the spam is originated does not, or cannot, take action against the spammer, other ISPs or network providers will simply blacklist all e-mail messages from the spammer's ISP, which means that the other ISPs or network providers will refuse to accept or forward any e-mail messages coming from the spammer's ISP. This has unfortunate consequences for other customers of the spammer's ISP as their legitimate e-mail messages will also be rejected from the other ISPs or network providers. Thus, while Internet subscribers pay the cost and inconvenience of receiving spam, ISPs that receive spam and pass it on to the Internet face more their own set of consequences.

[0004] Not only must ISPs deal with the consequence of spam, but so must a growing number of shared Internet access providers (SIAPs). A SIAP may be a stand-alone service provider or, more commonly, a brick-and-mortar establishment (for example, a coffee house, a pub, or a caf) that offers access to the Internet as an additional service, either through wired terminals or through a wireless network.

[0005] Wireless connectivity has recently become popular with SIAPs, especially those SIAPs that are also food establishments. A customer (a user) provides a laptop computer that either has a wireless 802.11x transmitter/receiver attached or built into the laptop. The SIAP provides a wireless 802.11x access point that shares an Internet connection with multiple users.

[0006] One problem with shared systems is that such systems can be used to send large volumes of unsolicited e-mail through the SIAP's ISP. The SIAP's ISP, in order to protect itself and its other customers from being blacklisted by other ISPs, may in turn block all e-mail message traffic from the SIAP.

[0007] There are several means by which a spammer can send e-mail message from an SIAP: (1) the spammer uses the SIAP's e-mail server; (2) the spammer uses the SIAP's network to transmit e-mail messages directly to another ISP's e-mail server (presumably the spammer is a customer of that other ISP and is actually paying for the other ISP's services); or (3) the spammer hosts an e-mail server on the spammer's laptop and transmits e-mail messages onto the Internet from the SIAP's network.

[0008] In the case of (2) above, the SIAP is not in jeopardy of being blacklisted as the other ISP's e-mail server is the source of the e-mail messages about which other ISPs will complain. However, the spammer may be affecting other customers of the SIAP if the spammer is consuming an excessive amount of bandwidth of the SIAP's shared network. In both (1) and (3), the SIAP is put in jeopardy of being blacklisted by other providers as it would appear as though all of the spam is originating from within the SIAP's network.

[0009] What ISPs, SIAPs, and other Internet access providers (collectively, IAPs) have in common is that e-mail abusers are a problem that may have serious consequences for the IAP and its customers.

[0010] What is needed is a system and method for determining whether e-mail messages originating from an IP address are spam and, if identified as spam, for limiting e-mail traffic originating from that IP address. Such a system and method should also provide means to determine if a particular IP address is using excess network resources to send e-mail over a network.

[0011] An embodiment of the present invention is a system for differentiating between legitimate e-mail and spam and for managing the bandwidth available for e-mail messaging to a particular IP address assigned by an IAP. In one embodiment, an e-mail governor is deployed by an IAP to monitor and regulate the number of e-mail messages originating from an IP address over a time interval. In another embodiment of the present invention, an e-mail governor is utilized by an IAP to monitor and regulate the bandwidth used for e-mail messaging from an IP address over a time interval.

[0012] It is therefore an aspect of the present invention to monitor e-mail message traffic originating from a specific IP address assigned by an IAP.

[0013] It is yet another aspect of the present invention to measure the rate at which e-mail messages originate from a specific IP address assigned by an IAP.

[0014] It is still another aspect of the present invention to take remedial action when the rate of e-mail traffic originating from a specific IP address assigned by an IAP exceeds a pre-determined limit (an email message rate threshold).

[0015] It is another aspect of the present invention to measure the bandwidth used over a time interval to originate e-mail messages from a particular IP address assigned by an IAP.

[0016] It is still another aspect of the present invention to take remedial action if the bandwidth consumption rate exceeds a predetermined limit.

[0017] These and other aspects of the present invention will become apparent from a review of the general and detailed descriptions that follow. The present invention provides a system and method for differentiating between customers who use e-mail and those who abuse e-mail in a shared network environment by measuring the number of e-mail messages sent per unit of time (the e-mail message rate). In an embodiment of the present invention, an e-mail governor measures the number of e-mail messages sent per unit of time and takes remedial action if the e-mail message rate exceeds an email message rate threshold indicative of spamming activity. In another embodiment, the e-mail governor measures bandwidth used for e-mail messaging from an IP address over a time interval (the e-mail byte rate). In one embodiment, the e-mail governor is a device. In an alternative embodiment, the e-mail governor is a software application.

[0018] In an embodiment of the present invention, an IAP network comprises an e-mail server. A router is used to redirect all network traffic destined to the well-defined e-mail message relay port of the e-mail server to the e-mail governor. For every e-mail message that is seen by the e-mail governor, the source IP address associated with that e-mail message is tracked by the e-mail governor. The e-mail governor keeps statistics for each originating IP address that transmits the mail message and the number of e-mail messages transmitted from the originating IP address over a time interval. As each e-mail message is received, the e-mail governor calculates the rate at which e-mail messages are being transmitted by the originating IP address (the e-mail message rate). If the e-mail message rate does not exceed an email message rate threshold, the e-mail governor sends the e-mail message over the IAP's network toward its destination.

[0019] If the e-mail message rate exceeds an email message rate threshold, remedial action is taken. In one embodiment of the present invention, the e-mail message is discarded or rejected and the appropriate notification is made to the IAP's administrator indicating that abuse is occurring. In another embodiment of the present invention, if the e-mail governor rejects an e-mail message (but does not discard it), the e-mail governor generates an appropriately formatted e-mail message response to the e-mail message sender indicating that e-mail messages are being rejected.

[0020] The email message rate threshold is established by the IAP such that message rate threshold is high enough not to be exceeded by any legitimate user, yet low enough to remove the incentive for a spammer to attempt to use the resources of the IAP for spamming.

[0021] In another embodiment, the e-mail governor monitors the cumulative bytes of e-mail messages sent over a time interval from an IP address on a shared network (the e-mail byte rate). As each e-mail message is received, the e-mail governor calculates the e-mail byte rate. If the e-mail byte rate does not exceed an e-mail byte rate threshold, the e-mail governor sends the e-mail message over the IAP's network toward its destination. If the e-mail byte rate exceeds an e-mail byte rate threshold, remedial action is taken.

[0022] In still another embodiment of the present invention, the e-mail governor monitors the e-mail message traffic originating from all of the IP addresses assigned by an IAP. If a combined e-mail message rate exceeds a combined e-mail message rate threshold, or if a combined e-mail byte rate exceeds a combined e-mail byte rate threshold, the e-mail governor sorts the IP addresses from which e-mail messages are originating by e-mail byte rate and determines if one or more IP addresses are utilizing excessive network resources relative to other IP addresses. If excess network resource consumption by a particular IP address is detected, remedial action is taken. In an embodiment of the present invention, remedial action comprises refusing, delaying or discarding e-mail from that IP address. In an alternate embodiment, outbound e-mail messages from the particular originating IP address are placed in a message queue for delayed delivery. If the number of messages in the message queue associated with the originating IP address exceeds a queue threshold value, remedial action is taken. In an embodiment of the present invention, remedial action comprises refusing, delaying or discarding e-mail from that IP address.

[0023] A better understanding of the present invention will be realized from the detailed description that follows, taken in conjunction with the accompanying drawings, in which:

[0024] FIG. 1 illustrates an e-mail governor in an IAP network comprising an e-mail server according to an embodiment of the present invention.

[0025] FIG. 2 illustrates a process according to an embodiment of the present invention by which an IP address is determined to be sending spam.

[0026] FIG. 3 illustrates another process according to an embodiment of the present invention by which an IP address is determined to be sending spam.

[0027] FIG. 4 illustrates a process according to an embodiment of the present invention by which an IP address is determined to be using excess network resources.

[0028] FIG. 5 illustrates a process according to an embodiment of the present invention by which an IP address is determined to be using excess network resources

[0029] FIG. 6 illustrates an e-mail governor in an IAP network according to an embodiment of the present invention wherein a computer connected to the IAP network comprises an e-mail server.

[0030] An embodiment of the present invention is a system for differentiating between legitimate e-mail and spam and for managing the bandwidth available to a particular IP address assigned by an Internet access provider (IAP). In one embodiment, an e-mail governor is deployed by an IAP to monitor and regulate the number of e-mail messages originating from an IP address.

[0031] Referring to FIG. 1, a computer 100 comprising an e-mail client 105 is connected to IAP interface 110 through a wired interface 106. As illustrated, computer 100 may also connect to IAP interface 110 through wireless interface 108. The connection between computer 100 and ISP interface 110 can be accomplished through means well known in the art. For example, the connection through wired interface 106 may be made over the public switched network, over a wideband cable system, or over a DSL connection. The connection over wireless interface 108 may be made through an 802.11x-compliant transmitter/receiver attached or built into computer 100, or using wireless devices complaint with other wireless communication standards such as BlueTooth. As will be apparent to those skilled in the art, any means for connecting the computer 100 and IAP interface 110 may be used without departing from the scope of the present invention.

[0032] All outbound traffic (traffic from the computer toward the IAP) is directed from the IAP interface 110 to router 115. Router 115 identifies outbound e-mail messages through means well known in the art and directs outbound e-mail messages to e-mail governor 120. Outbound traffic other than outbound e-mail messages are directed to the Internet gateway 135. The e-mail governor 120 parses the outbound e-mail message and obtains from the IP packet header the IP address of the computer from which the outbound e-mail message originated.

[0033] Datastore 125 receives the origination IP address and other e-mail metrics. As will be described below, the IP address and the e-mail metrics are used to compute an e-mail message rate and/or an e-mail byte rate for the origination IP address. The e-mail message rate is used to determine if whether e-mail sent from the origination IP address is spam. The e-mail byte rate is used to determine if the origination IP address is using excess network resources to send e-mail.

[0034] Outbound e-mail messages that are determined by the e-mail governor 120 not to be spam are sent to e-mail server 130 and onto the Internet 140 through Internet gateway 135.

[0035] FIG. 2 illustrates a process according to an embodiment of the present invention by which outbound e-mail messages are determined to be spam or to be legitimate e-mail messages. The outbound e-mail message is routed to the e-mail governor 200. The e-mail message is time-stamped and the time-stamp and the IP address of the computer from which the e-mail message originated (the originating IP address) are determined using methods well know in the art 205. The e-mail governor checks the datastore to determine if the originating IP address is new 210. If the originating IP address is new, an IP address record is created in the datastore and the time-stamp of the e-mail message is stored in the IP address record, and an e-mail message counter is set to one 215. The e-mail governor waits for the next e-mail 218.

[0036] If the originating IP address is not new, the e-mail message counter with the datastore is incremented 220. A determination 222 is made if a minimum number of e-mail messages have been sent from the originating IP address. This determination helps avoid mistakenly identifying of an e-mail message as spam. A small number of e-mail messages sent over a short period of time might result in a high e-mail message rate that is not indicative of the actual e-mail traffic originating from an IP address. If the minimum number of e-mail messages sent for an originating IP address is not exceeded, then the last e-mail outbound e-mail message is forwarded to the e-mail server for handling 224 and e-mail governor waits the next e-mail message 218.

[0037] If the minimum number of e-mail message sent is exceed for an originating IP address 222, the e-mail governor determines an e-mail message rate 225 for the originating IP address based on the time-stamp data of the e-mail message represented by e-mail message count 1 (the first e-mail message). The time represented by the time stamp of the first message is subtracted from the time represented by the timestamp of the newly arrived message (e-mail message n) to compute the time period over which the nth message arrived. The e-mail message rate is determined by dividing n by the computed time period.

[0038] The e-mail governor determines whether the e-mail message rate exceeds an email message rate threshold 230. If the e-mail message rate does not exceed the email message rate threshold, the outbound e-mail message is forwarded to the e-mail server for handling 235. If the e-mail message rate exceeds the email message rate threshold, remedial action is taken 240. In one embodiment of the present invention, the remedial action is to discard the outbound e-mail message and to block all future e-mails from the originating IP address. In another embodiment, the remedial action is to send a warning to the originating IP address before blocking the e-mail messages from the originating IP address.

[0039] In still another embodiment, e-mail messages originating from the originating IP address will be forwarded to an e-mail server queue for transmission on a delayed basis so as to allocate the bandwidth available to all of the subscribers of the e-mail operator. In yet another embodiment, if the number of e-mail messages in the e-mail server queue from a particular originating IP address exceeds a queue threshold value, the e-mail messages are discarded. As will be apparent to those skilled in the art, other remedial actions may be taken in the event that the e-mail rate exceeds the email message rate threshold without departing from the scope of the present invention.

[0040] In still another embodiment of the present invention, an IP address record is deleted based on a set of management criteria. In one embodiment, the IP address record is deleted when the right of a particular computer to use the originating IP address is terminated. Alternatively, the IP address record is deleted when the right to use an originating IP address is reassigned or regranted. In yet another embodiment, the IP address record is deleted upon expiration of a set time period after its creation. As will be apparent to those skilled in the art, other criteria may be applied to the management of IP address records without departing from the scope of the present invention.

[0041] In another embodiment of the present invention, the e-mail message rate is computed using a clock that runs for an interval and then is reset. E-mail messages are counted during the interval and the e-mail message rate (e-mail messages per interval) is the e-mail message count. Referring to FIG. 3, a clock and all e-mail message counters are set to zero 300. The clock is started 305 and e-mail messages are routed to the e-mail governor 310. The e-mail governor determines the originating IP address of the e-mail message 315 and if the originating IP is new 320. If the originating IP address is new, the e-mail governor creates an originating IP address record for the originating IP address within a datastore 325. The e-mail message counter for the originating IP address is incremented 330 and a check is made to determine if the clock interval has been reached 335. If the clock interval has not been reached, the e-mail message is forwarded to the e-mail server for handling 340 and the e-mail governor waits the next e-mail message 342. If the clock interval has been reached, then e-mail message rate is computed 345 for each originating IP addresses stored in the datastore. The e-mail message rate for each IP address stored in the datastore is compared to the e-mail message rate threshold 350. For those originating IP address for which the e-mail message rate exceeds the email message rate threshold, remedial action is taken 360. In one embodiment of the present invention, the remedial action is to discard the outbound e-mail message and to block all future e-mails from the originating IP address. In another embodiment, the remedial action is to send a warning to the originating IP address before blocking the e-mail messages from the originating IP address. In still another embodiment, e-mail messages originating from the originating IP address will be forwarded to an e-mail server queue for transmission on a delayed basis so as to allocate the bandwidth available to all of the subscribers of the e-mail operator. In yet another embodiment, if the number of e-mail messages in the e-mail server queue from a particular originating IP address exceeds a threshold value, the e-mail messages are discarded. As will be apparent to those skilled in the art, other remedial actions may be taken in the event that the e-mail rate exceeds the email message rate threshold without departing from the scope of the present invention. Whether or not the e-mail message rate threshold has been exceeded, the clock and all e-mail message counters are reset to zero and the process begins again.

[0042] In another embodiment of the present invention, the e-mail message count is accumulated over a number of intervals and a second e-mail message rate is determined over the multiple intervals. The second e-mail message rate is measured against a second e-mail message rate threshold to determine if remedial action should be taken. In this way, the IAP can define spam in terms of both a short time interval and a long time interval.

[0043] In another embodiment, an IAP uses the e-mail governor to monitor the bandwidth usage of e-mail message traffic originating from an IP addresses assigned by the IAP.

[0044] Referring to FIG. 1, the e-mail governor 120 sends e-mail metrics to datastore 125 useful in determining whether an outbound e-mail byte rate exceeds an e-mail byte rate threshold. FIG. 4 illustrates a process according to an embodiment of the present invention by which an outbound e-mail byte rate is calculated and compared to an e-mail byte rate threshold.

[0045] The outbound e-mail message is routed to the e-mail governor 400. The e-mail message is time-stamped and the time-stamp and the IP address of the computer from which the e-mail message originated (the originating IP address) are determined using methods well know in the art 405. The e-mail governor checks the datastore to determine if the originating IP address is new 410. If the originating IP address is new, an IP address record is created in the datastore, the time-stamp of the e-mail message and the size of the e-mail message in bytes is stored in a bytes register within the IP address record, and an e-mail message counter is set to one 415. The e-mail governor then waits for the next e-mail 418.

[0046] If the originating IP address is not new, the e-mail message counter with the datastore is incremented and the size of the e-mail message in bytes is added to the bytes register in the IP address record 420. A determination is made if a minimum number of e-mail messages have been sent from the originating IP address 422. This determination helps avoid mistakenly identifying of an e-mail message as spam. A small number of e-mail messages sent over a short period of time might result in a high e-mail byte rate that is not indicative of the actual e-mail traffic originating from an IP address. If the minimum number of e-mail messages sent for an originating IP address is not exceeded, then the size of the e-mail message is forwarded to the e-mail server for handling 424 and e-mail governor waits for the next e-mail message 418.

[0047] If the minimum number of e-mail message sent is exceeded for an originating IP address, the e-mail governor determines an e-mail byte rate 425 for the originating IP address based on the time-stamp data of the e-mail message represented by e-mail message count 1 (the first e-mail message). The time represented by the time stamp of the first message is subtracted from the time represented by the timestamp of the newly arrived message (e-mail message n) to compute the time period over which the nth e-mail message arrived. The size of the nth e-mail message in bytes is added to the bytes register within the IP address record. The e-mail byte rate is determined by dividing the value in the bytes register by the computed time period.

[0048] The e-mail governor determines whether the e-mail byte rate exceeds an e-mail byte rate threshold 430. If the e-mail byte rate does not exceed the e-mail byte rate threshold, the outbound e-mail message is forwarded to the e-mail server for handling 435. If the e-mail byte rate exceeds the e-mail byte rate threshold, remedial action is taken 440.

[0049] In one embodiment of the present invention, the remedial action is to discard the outbound e-mail message and to block all future e-mails from the originating IP address. In another embodiment, the remedial action is to send a warning to the originating IP address before blocking the e-mail messages from the originating IP address. In still another embodiment, e-mail messages originating from the originating IP address will be forwarded to an e-mail server queue for transmission on a delayed basis so as to allocate the bandwidth available to all of the subscribers of the e-mail operator. In yet another embodiment, if the number of e-mail messages in the e-mail server queue from a particular originating IP address exceeds a queue threshold value, the e-mail messages are discarded. As will be apparent to those skilled in the art, other remedial actions may be taken in the event that the e-mail rate exceeds the email message rate threshold without departing from the scope of the present invention.

[0050] In another embodiment of the present invention, the e-mail byte rate is computed using a clock that runs for an interval and then is reset. E-mail message size in bytes is cumulated in during the interval and the e-mail byte rate (bytes per interval) is the value in the bytes register within the originating IP address record.

[0051] Referring to FIG. 5, a clock and all e-mail message byte registers are set to zero 500. The clock is started 505 and e-mail messages are routed to the e-mail governor 510. The e-mail governor determines the originating IP address of the e-mail message 515 and if the originating IP is new 520. If the originating IP address is new, the e-mail governor creates an originating IP address record for the originating IP address within a datastore 525. The size of the e-mail message in bytes is added to the byte register within the originating IP address record 530, and a check is made to determine if the clock interval has been reached 535. If the clock interval has not been reached, the e-mail message is forwarded to the e-mail server for handling 540 and the e-mail governor awaits the next e-mail message 542. If the clock interval has been reached, then e-mail byte rate for the interval is computed for all originating IP addresses stored in the datastore. The e-mail byte rate for the interval equals the value in the bytes register within the originating IP address record.

[0052] For those originating IP address for which the e-mail byte rate exceeds the e-mail byte rate threshold, remedial action is taken 580. In one embodiment of the present invention, the remedial action is to discard the outbound e-mail message and to block all future e-mails from the originating IP address. In another embodiment, the remedial action is to send a warning to the originating IP address before blocking the e-mail messages from the originating IP address. In still another embodiment, e-mail messages originating from the originating IP address will be forwarded to an e-mail server queue for transmission on a delayed basis so as to allocate the bandwidth available to all of the subscribers of the e-mail operator. In yet another embodiment, if the number of e-mail messages in the e-mail server queue from a particular originating IP address exceeds a queue threshold value, the e-mail messages are discarded. As will be apparent to those skilled in the art, other remedial actions may be taken in the event that the e-mail byte rate exceeds the e-mail byte rate threshold without departing from the scope of the present invention. Whether or not the e-mail byte rate threshold has been exceeded, the clock and all e-mail message byte registers are reset to zero and the process begins again.

[0053] In another embodiment of the present invention, the e-mail message byte count is accumulated over a number of intervals and a second e-mail byte rate is determined over the multiple intervals. The second e-mail byte rate is measured against a second e-mail byte rate threshold to determine if remedial action should be taken. In this way, the IAP can define resource usage in terms of both a short time interval and a long time interval.

[0054] In still another embodiment of the present invention, the e-mail governor monitors the e-mail message traffic of all users connected to the IAP's network. If the combined e-mail message rate exceeds a combined e-mail message rate threshold, or if the combined e-mail byte rate exceeds a combined e-mail byte rate threshold, the e-mail governor sorts the IP addresses from which e-mail messages are originating by e-mail byte rate and determines if one or more users are utilizing excessive bandwidth relative to other users. If excess bandwidth consumption by an IP address is detected, remedial action is taken.

[0055] In an alternative embodiment, an IAP does not operate an e-mail server. Rather, the e-mail server resides on the computer connected to the IAP's shared network. Referring to FIG. 6, a computer 600 comprising an e-mail server 605 is connected to IAP interface 610 through a wired interface 606. As illustrated, computer 600 may also connect to IAP interface 610 through wireless interface 608. The connection between computer 600 and ISP interface 610 can be accomplished through means well known in the art. For example, the connection through wired interface 606 may be made over the public switched network, over a wideband cable system, or over a DSL connection. The connection over wireless interface 608 may be made through an 802.11x-compliant transmitter/receiver attached or built into computer 600, or using wireless devices complaint with other wireless communication standards such as BlueTooth. As will be apparent to those skilled in the art, any means for connecting the computer 600 and IAP interface 610 may be used without departing from the scope of the present invention.

[0056] All outbound traffic (traffic from the computer toward the IAP) is directed from the IAP interface 610 to router 615. Router 615 identifies outbound e-mail messages through means well known in the art and directs outbound e-mail messages to e-mail governor 620. Outbound traffic other than outbound e-mail messages are directed to the Internet gateway 635. The e-mail governor 620 parses the outbound e-mail message and obtains from the IP packet header the IP address of the computer from which the outbound e-mail message originated.

[0057] Datastore 625 receives the origination IP address and other e-mail metrics. As will be described below, the IP address and the e-mail metrics are used to compute an e-mail message rate and/or an e-mail byte rate for the origination IP address. The e-mail message rate is used to determine if whether e-mail sent from the origination IP address is spam. The e-mail byte rate is used to determine if the origination IP address is using excess network resources to send e-mail.

[0058] Outbound e-mail messages that are determined by the e-mail governor 620 not to be spam are sent onto the Internet 640 through Internet gateway 635.

[0059] In an embodiment of the present invention, computer 600 is a laptop computer and wireless interface 608 is an 802.11x-compliant device, either integrated into computer 600 or connected to computer 600 by known means. By way of example and not as a limitation, transceiver 608 is connected to computer 600 via a USB port.

[0060] The process by which an e-mail message originating from the e-mail server 605 is determined to be spam or a legitimate e-mail is the same at that describe in the context of FIG. 2 and FIG. 3. The process by which the network resources utilized by computer 600 are measured is the same as described in the context of FIG. 4 and FIG. 5.

[0061] A system and method for monitoring and managing e-mail message traffic has been described. It will be understood by those skilled in the art of the present invention may be embodied in other specific forms without departing from the scope of the invention disclosed and that the examples and embodiments described herein are in all respects illustrative and not restrictive. Those skilled in the art of the present invention will recognize that other embodiments using the concepts described herein are also possible.