Anti-spam profile clustering based on user behavior

[0001] The present invention relates to filtering received electronic mail messages to determine which messages are spam and which messages are not spam. In particular, embodiments of the present invention relate to assigning a user to an anti-spam filtering profile based on the user's tracked behavior, and monitoring the performance of different filtering profiles.

[0002] The approaches described in this section are approaches that could be pursued, but are not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated, it should not be assumed that any of the approaches described in this section qualify as prior art merely by virtue of their inclusion in this section.

[0003] The problem of unwanted emails, commonly referred to as spam, in email-based communication technologies is well-recognized. Spam may include unsolicited messages sent by a computer user over a network to a large number of recipients, sometimes including attached files or hyperlinks. For typical users, spam mostly includes unsolicited commercial messages, but it also includes unsolicited messages sent for malicious, disruptive, or abusive purposes. For example, spammers sometimes send messages in bulk to a particular domain to exhaust the resources of the domain or to spread a virus. These unwanted emails waste the time, money, and resources of end users and service providers.

[0004] To combat the problem of spam, numerous anti-spam systems have been developed. Many of the systems currently in use apply a set of rules to incoming email messages to determine how to handle an incoming message. Based on the application of the rules to the message, the anti-spam system determines whether to deliver the message to a user's inbox, to a specially designated spam folder, or in the case of potentially malicious emails such as those that might be carrying a virus, to quarantine the message on an alternate server and not deliver the message at all. The determination might be made by applying a combination of categorical rules, such as quarantining all emails with attached executable files, and a set of aggregating rules that assign a score to an incoming email based on characteristics such as content, origin, file size, and/or the presence of attachments. Emails with a score over a threshold value might be designated as spam and delivered to the user's spam folder.

[0005] Most anti-spam systems apply the same global filtering rules to all users. In a system with a large and diverse group of users, using the same global filtering rules for all users limits the system's ability to be tailored to the behavior of any particular user. Specifically, rules that correctly identify spam for one user cause false positives for other users.

[0006] Some systems allow users to supplement the global filtering rules by adding their own unique set of categorical rules. Such a system, however, typically does not allow the user to modify the global rules, which in many cases are the ones that detect the majority of spam. Additionally, such a system puts the burden of customizing the system on the user, which is both ineffective and inefficient.

[0013] In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, that the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to avoid unnecessarily obscuring the present invention.

[0014] A system is described hereafter that offers improvements over the anti-spam systems currently used in the art by assigning a filtering profile to a user based on the user's behavior, instead of applying the same global filtering rules to all users. By tracking the user's behavior, it is possible to determine which filtering profile most effectively filters the user's incoming emails. If the filtering profile that would most effectively filter the user's incoming emails is not the profile to which the user is currently assigned, the system can automatically reassign the user to the profile that would most effectively filter the user's incoming mail.

[0015] The flowchart of FIG. 1 illustrates a method for filtering email messages according to one embodiment of the present invention. A system administrator defines a set of filtering profiles (block 110). Each filtering profile within the set can have its own unique combination of categorical and aggregating rules, as well its own unique application of the rules.

[0016] Email addresses of users of an anti-spam system are each assigned to one of the filtering profiles (block 120). The initial assignment may be done manually by a system administrator or automatically based on known information associated with a user profile corresponding to an email address. Alternatively, all email addresses might initially be assigned to a filtering profile designated as a default profile.

[0017] When an email message is sent to an email address that is assigned to a particular profile (the “currently-assigned profile”), the system evaluates the email based on the rules of both the currently-assigned profile and one or more other filtering profiles (the “alternative profiles”), and records the results of each (block 130). The message can then be delivered to the user in accordance with how the currently-assigned filtering profile categorized the email (block 140). If the currently-assigned filtering profile identifies the message as spam, then the email might be quarantined or delivered to a spam folder. On the other hand, if the currently-assigned filtering profile identifies the message as not spam, then the email might be delivered to the user's inbox, forwarded to the user's handheld personal digital assistant (PDA), or handled in accordance with however the user's email account is configured.

[0018] Once delivered, the user might perform one or more actions on the email (block 150). Typical actions include replying to or forwarding the message, deleting the message, or moving the message to a folder. Actions might also include identifying an email as either spam or not spam by labeling the message through a button or link.

[0019] According to one embodiment, a mechanism is provided for tracking the user's actions on the email. The actions tracked by the mechanism are referred to as “tracked actions.” If the action performed by the user is not a tracked action (block 160, path 162), then no feedback will be supplied to the anti-spam system for that particular action of the user. If the action is a tracked action (block 160, path 161), then feedback detailing the action is delivered to the anti-spam system (block 170).

[0020] The feedback detailing the tracked actions can be received at an event aggregator and used to update a performance score for each of the filtering profiles (block 180). According to one embodiment, the performance scores indicate how consistent the filtering determinations of each filter are with a user's behavior. The performance score can be determined by using the feedback to identify both false positives (i.e. identifying non-spam as spam) and misses (i.e. not identifying spam as spam). Examples of user actions that might indicate a false positives include reading, replying to, forwarding, saving, moving, or flagging emails that are categorized as spam. Examples of feedback used to identify misses might include deleting a message without reading the message's body or reporting the message as spam. Additionally, an aspect of the present invention includes a mechanism such as a button or link on a user interface that allows a user to affirmatively identify an email as either spam or not spam.

[0021] In determining the performance scores of the profiles, different actions by a user might be weighted differently than other actions. For example, a user clicking a not-spam button to identify a false positive is an unambiguous indication of a false positive. In contrast, a user saving or forwarding a message delivered to the user's spam folder might create an inference of a false positive, but it is not as unambiguous as having a user affirmatively identify a false positive. Accordingly, when determining a performance score for a particular filtering profile, the two types of actions might be weighted differently, with affirmative identifications being weighted more heavily than actions that only create an inference. Feedback detailing a user's actions might also be weighted according to other criteria. For example, based on a timestamp of when the feedback was collected, newer feedback might be weighted more heavily than older feedback. In addition, feedback obtained more than a certain amount of time ago might be considered expired and no longer included when determining a filtering profile's performance score.

[0022] Once the performance score for each profile has been updated, the anti-spam system can compare the performance scores of the alternative profiles to the performance score of the currently-assigned profile to determine if one of the alternative profiles is categorizing the user's incoming emails in a way that is more consistent with the user's tracked behavior (block 190). If the currently-assigned profile is categorizing emails better than the alternative profiles (block 190, path 192), then the user might not have a different filtering profile assigned, but if an alternative profile is more accurately categorizing the incoming emails (block 190, path 191), then the user can be reassigned to one of the alternative filtering profiles (block 195).

[0023] The determination of which filter is more accurately categorizing incoming emails can be determined by comparing the performance scores of the different profiles, and assigning the user to the profile with the best performance score. In order to limit the frequency with which a user changes profiles, the system might be configured to only move the user to a different profile if the performance score of the different profile is better than the performance score of the currently-assigned profile by a specified amount, such as a fixed value or a percentage difference. The system might also be configured to prevent a user from being reassigned to a different profile if the user has been assigned to the current profile for less than a certain amount of time, or if the user has a high hop count, meaning the user has been frequently changing profiles. Other limitations on how or when a user changes profiles might be based on other parameters that are implemented dependent on design preferences.

[0024] The method described in relation to FIG. 1 is meant to be for purposes of example only, and not to be limiting. Many variations within the spirit of the present invention will be readily apparent to those skilled in the art. For example, some portions of the method may be performed in either real-time or performed periodically depending on design preferences.

[0025] FIG. 2 illustrates an anti-spam system 210 configured according to an embodiment of the invention. Anti-spam system 210 receives incoming emails from a remote email server and applies the different filtering profiles to each incoming email. Each email is then delivered to the user's email account 220 in accordance with the determination of the currently-assigned profile of the user to whom the email is directed. The email might be delivered to a user's inbox, spam folder, or remotely quarantined depending on the determination of user's currently-assigned profile (even though other profiles may have determined that the email should be handled in other ways). A user can then access an email account through various email interface devices 230a-c. Examples of email interface devices 230a-c include internet-based webmail applications such as Yahoo Mail®, mail clients such as Outlook® and Thunderbird®, or wireless devices such as PDAs and mobile phones.

[0026] The user's actions via the email interface devices 230a-c can be tracked and sent back to the mail system 220 as feedback. The mail system 220 can then send the feedback to the anti-spam system 210 which can process the feedback to determine if the user should be assigned to a different filtering profile. The feedback can be sent either serially or in batch depending on design preferences.

[0027] The users' actions can be monitored in a multitude of different ways, depending on the type of email interface device 230a-c being used. For example, if a user accesses the email system 220 via a webmail application, then the action monitoring mechanism can be hosted and customized on the server hosting the webmail application. If the user is using a mail client such as OUTLOOK®, then the users' actions might be monitored by a plug-in or a customized feature that supports tracking of user actions. The monitoring of user actions can also be implemented on the IMAP server by tracking the IMAP commands a user mail client requests or by monitoring logs of outgoing emails. User actions can also be tracked by having the anti-spam system embed a header in incoming emails that records actions performed on that email. The header might contain information such as a unique ID, and when the user performs an action on the email, the unique ID and info about the action might be sent back to the email system. The email system can then use the received ID to find the previously determined ways that each filtering profile would have handled that email and update the performance scores for each filtering profile.

[0028] FIG. 3 illustrates the components of a possible network architecture for implementing an anti-spam system embodying aspects of the present invention. The system 300 includes one or more master terminals 310, one or more user terminals 320, and one or more servers 340 connected through a network 330. One or more of the terminals 310, 320 may be personal computers, computer workstations, PDAs, or any other type of microprocessor-based device. The network 330 may be a local area network (LAN), wide area network (WAN), remote access network, an intranet, or the Internet, for example. Network links for the network 330 may include telephone lines, DSL, cable networks, T1 or T3 lines, wireless network connections, or any other arrangement that implements the transmission and reception of network signals. However, while FIG. 3 shows the terminals 310, 320 and servers 340 connected through a network 330, the terminals 310, 320 and servers 340 may alternatively be connected through other means, including directly hardwired or wirelessly connected. In addition, the terminals 310, 320 and servers 340 may be connected to other network devices not shown, such as wired or wireless routers.

[0029] It will be readily apparent to one skilled in the art that the components described in reference to FIG. 2 might be contained on one terminal 310, 320 or server 340, or distributed over multiple terminals 310, 320 and servers 340 spread out across the system. For example, the anti-spam system might be contained on a server 340 and the email interface device might be a user terminal 320 running a mail client. Alternatively, the anti-spam system might be located on the email interface device or distributed over both the server and the email interface device.

[0030] FIG. 4 illustrates a possible configuration of a master terminal 310 (the user terminal 320 and server 340 may also have similar configurations). The master terminal 410 may include a controller/processor 410, memory 420, display 430, database interface 440, input/output device interface 450, and network interface 460, connected through bus 470.

[0031] The controller/processor 410 may be any programmed processor known to one of skill in the art. However, the anti-spam application might also be implemented on a general-purpose or a special purpose computer, a programmed microprocessor or microcontroller, peripheral integrated circuit elements, an application-specific integrated circuit (ASIC) or other integrated circuits, hardware/electronic logic circuits, such as a discrete element circuit, a programmable logic device, such as a PLD, PLA, FPGA, or PAL, or the like. In general, any device or devices capable of implementing the decision support method as described herein can be used to implement the decision support system functions of this invention.

[0032] The Input/Output interface 450 may be connected to one or more input devices that may include a keyboard, mouse, pen-operated touch screen or monitor, voice-recognition device, or any other device that accepts input. The Input/Output interface 450 may also be connected to one or more output devices, such as a monitor, printer, disk drive, speakers, or any other device provided to output data.

[0033] The memory 420 may include volatile and nonvolatile computer-readable data storage mediums, including one or more electrical, magnetic or optical memories such as a RAM, cache, hard drive, CD-ROM drive, tape drive or removable storage disk.

[0034] The network interface 460 may be connected to a communication device, modem, network interface card, or any other device capable of transmitting and receiving signals over a network 330. The components of the terminals 310, 320 may be connected via an electrical bus 370, for example, or linked wirelessly.

[0035] Client software and databases may be accessed by the controller/processor 410 from memory 420 or through the database interface 440, and may include, for example, an email interface application or an anti-spam application, or any other components that embody the decision support functionality of the present invention. The terminals 310, 320 and servers 340 may implement any operating system. Client and server software may be written in any programming language.

[0036] A system administrator can define a set of filtering profiles where each filtering profile within the set has its own unique combination of categorical and aggregating rules as well its own unique application of the rules. For example, a system administrator overseeing a corporate email system might define filtering profiles for marketing, engineering, and sales. The engineering profile might have a set of aggregating rules that identify the presence of words and phrases such as “great deal,” “discount,” “bargain,” and so on as indicating a likelihood that the message is an unsolicited offer to sell something, and is therefore spam. For someone in sales or marketing, however, those words and phrases might be commonly used in the ordinary course of their business, meaning such a rule could lead to a large number of false positives. Therefore, the rule might only be included in the engineering filtering profile and not the marketing or sales filtering profiles.

[0037] An anti-spam system embodying aspects of the present invention might also be implemented into a publicly available email system such as YAHOO!® MAIL. In such a system, a set of filtering profiles might be defined in much the same way as in a corporate email system, only instead of having filtering profiles based on departments or job descriptions, the filtering profiles might be based on whether a user is a an international user or a domestic user, a personal user or a business user, or any other such categorization of the user. Although for purposes of explaining aspects of the present invention it is convenient to associate a particular filtering profile with a certain characteristic of a user, it is worth noting that the present invention in no way needs or requires such an association.

[0038] Each filtering profile might simultaneously apply categorical rules and aggregating rules. A set of aggregating rules determine a score when applied to an incoming email, and based on that score, the incoming email is categorized as either spam or not spam. An example of an aggregating rule is a rule that detect certain words in the body or subject of an email and assigns points based on how many times a certain type of word is present. The point value for each word might be weighted differently depending on design preferences. For example, in a particular profile, words indicating sexual content might be worth more points than words indicating an unsolicited commercial offer, or words appearing in the subject line might worth more points than words in the body of the email. The points can be cumulated to determine the email's score.

[0039] A categorical rule can be thought of as a rule that single-handedly determines whether an email is classified as spam or non-spam. For example, a categorical rule might include maintaining lists of approved and blacklisted IP addresses and domain names, and designating incoming email as either spam or not-spam depending on which list its domain name or IP address appears. If a categorical rule deems an email to be either spam or not spam, then that categorization of the email can either supersede a determination based on the aggregating rules or can be used in conjunction with the score of the aggregating rules to determine how to categorize the email. Categorical rules can also be based on machine learning or be statistical based, in which case the categorical rules will change depending on the different data sets provided by the users of the different filtering profiles.

[0040] It will be readily apparent to one of skill in the art that the types of rules and ways in which to apply them are virtually infinite.

[0041] Another aspect of the present invention includes maintaining a performance index for each filtering profile. The performance index can be used to evaluate the overall performance of a filter as it relates to all users, and not just the performance of a filter as it relates to a specific user. The performance index can be determined by monitoring internal usage statistics and by collecting data through the feedback supplied by a plurality of users or all users. Examples of statistics and data used to determine the performance index include catch rate, miss rate, false positive rate, user retention rate, user retention time, number of hop-ins (i.e. number of users joining the filtering profile), number of hop-outs (i.e. users leaving the filtering profile), or any other applicable criteria that might be useful in determining the overall performance of a filtering profile. The different data can be weighted differently based on configuration preferences. For example, a system administrator might deem the false-positive rate to be the most important criteria in judging the performance, and therefore weight that factor more than others.

[0042] FIG. 5 shows an example of a method for tracking the overall performance of a filtering profile. The method includes a user handling an email that has been filtered by the anti-spam system (block 510). If the user's action is not a tracked action (block 520, path 522), then the method ends. If the user's action is a tracked action (block 520, path 524), then the feedback detailing the tracked action can be sent to the anti-spam system (block 530). Based of the feedback, the performance index for one or more of the filtering profiles can be updated (block 540). The performance indexes might also be updated based on users hopping in and out of the different filtering profiles. If the performance index of a filtering profile is above a threshold value (block 550, path 552), then no action need be taken on the filtering profile. If the performance index of a filtering profile goes below a threshold value (block 550, path 554), then a remedial action might be taken on the filtering profile (block 560). An example of a remedial action is sending an alert message to a system administrator informing the system administrator of the filtering profile's performance index, or automatically freezing the filtering profile (i.e. not allowing users to be assigned to be assigned to the profile).

[0043] In a separate embodiment, the system contains multiple performance indexes for each filtering profile. For example, the system might have a false-positive-rate performance index that tracks the frequency of false positives and a user-retention-rate performance index that tracks user retention rates. If either performance index falls below a threshold value, then the system might perform a remedial action depending on the performance index.

[0044] In this description certain process steps are set forth in a particular order, and alphabetic and alphanumeric labels may be used to identify certain steps. Unless specifically stated in the description, embodiments of the invention are not necessarily limited to any particular order of carrying out such steps. In particular, the labels are used merely for convenient identification of steps, and are not intended to specify or require a particular order of carrying out such steps.

[0045] In the foregoing specification, embodiments of the invention have been described with reference to numerous specific details that may vary from implementation to implementation. Thus, the sole and exclusive indicator of what is the invention, and is intended by the applicants to be the invention, is the set of claims that issue from this application, in the specific form in which such claims issue, including any subsequent correction. Any definitions expressly set forth herein for terms contained in such claims shall govern the meaning of such terms as used in the claims. Hence, no limitation, element, property, feature, advantage or attribute that is not expressly recited in a claim should limit the scope of such claim in any way. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.