Blocking of spam e-mail at a firewall

1. A method of blocking spam at a firewall, comprising the steps of:

receiving a spam e-mail message in a time interval during which no blocking measure is active;

applying a blocking measure for a duration that is determined adaptively; and

suspending the blocking measure in accordance with a state B(t) of the blocking measure at time t for discrete values of t which are integer multiples of a time interval Dt, said discrete values of t representing t=0, Dt, 2*Dt, . . . , J*Dt, wherein J is a positive integer equal to or greater than 2;

wherein if B(t)=I then the blocking measure is applied and if B(t)=0 then the blocking measure is suspended;

wherein A(t)=I if a spam e-mail message has arrived during a time interval Dt immediately preceding time t and A(t)=0 otherwise;

wherein N(t)=A(t)*(I−B(t));

wherein S(t) is a time stamp indicating the absolute start time of a most recent sequence of time values with consecutive application of the blocking measure;

wherein K(t) is a count of the number of times, within a present epoch of consecutive detections of spam e-mail message, that the blocking measure has been suspended and then re-applied in response to detection of a spam e-mail message;

wherein P(t) is a duration of the blocking measure and is a non-decreasing function of K(t);

wherein a specified positive integer L is a maximum permitted value of K(t);

wherein t=0 is a time prior to execution of a loop of J iterations denoted as iterations 1, 2, . . . , J;

wherein at t=0, B( 0 )=I, A( 0 )=I, S( 0 )=0, K( 0 )=0, and P( 0 )=P.sub.0=I*Dt, wherein I is a positive integer;

wherein B(t), S(t), and K(t) are iteratively computed during execution of the loop such that in each iteration:

B ( t+Dt )= N ( t )*( I−B ( t ))+( I−N ( t )*( I−B ( t ))) *if (t+Dt−S(t)i, else 0),

S ( t+Dt )= B ( t+Dt )*( I−B ( t ))*( t+Dt−S ( t )+ S ( t ),

K ( t+DT )=min{ L,N ( t )*( K ( t )+ I )+( I−N ( t ))* B ( t )* K ( t )},

t=t+DT after B(t+Dt), S(t+Dt), and K(t+Dt) have been determined.

2. The method of claim 1 , wherein said determining detects identical text bodies in said e-mail message with a plurality of other e-mail messages.

3. The method of claim 2 , further comprising using a hash function to determine said identical text bodies.

4. The method of claim 1 , further comprising the step of providing a database to integrate said identical bodies and declare filter rules for said determining.

5. The method of claim 4 , further comprising the step of dynamically adding and deleting said filter rules to a database of filter rules to be enforced.

6. The method of claim 1 , wherein said duration is determined adaptively in response to a count of a number of times that the blocking measure has been applied.

7. The method of claim 6 , wherein said duration is adapted according to a monotone non-decreasing function of said count.

8. The method of claim 1 , wherein said duration is a count of e-mail messages.

9. The method of claim 1 , further comprising the step of selecting a level of certainty of said determining by selecting an appropriately corresponding length of an initial period of rules enforcement.