Granted Patent B1

US 8,504,622 · App. 11/935,185 · Granted Aug 6, 2013

Abstract

Claims (21)

1. A method, comprising: identifying a source of at least two unsolicited electronic messages as compromised, wherein the source is identified as compromised based, at least, on a speed of a network connection associated with an Internet protocol (IP) address of the source, which communicated the at least two unsolicited electronic messages; determining whether the network connection being used by the source is associated with a cable network connection, a digital subscriber line (DSL) network connection, or a dial-up network connection; wherein a source is not identified as being compromised if the network connection is associated with a dial-up network connection; calculating a frequency in which the source communicated the unsolicited electronic messages; and reacting based on the calculated frequency, wherein the reacting includes displaying an image of a world map reflecting a location associated with the source.

2. The method as set forth in claim 1 , wherein the source includes a zombie computer.

3. The method as set forth in claim 1 , wherein the identifying includes determining a speed of a network connection used by the source.

4. The method as set forth in claim 1 , wherein the identifying includes comparing a speed of a network connection used by the source against a threshold.

5. The method as set forth in claim 4 , wherein the source is identified as compromised if the speed of the network connection exceeds the threshold.

6. The method as set forth in claim 1 , wherein the reacting includes alerting an internet service provider (ISP) that hosts the source.

7. The method as set forth in claim 1 , wherein the reacting includes displaying an amount of unsolicited electronic messages sent by the source.

8. The method as set forth in claim 1 , wherein the reacting includes displaying a name of the source.

9. The method as set forth in claim 1 , wherein the reacting includes displaying an internet service provider (ISP) for the source.

10. The method as set forth in claim 1 , wherein the reacting includes displaying the frequency in which the source communicated the unsolicited electronic messages.

11. The method as set forth in claim 1 , wherein the world map includes markings designating an amount of compromised sources at particular locations.

12. The method as set forth in claim 1 , further comprising retrieving the unsolicited electronic messages using one or more traps.

13. The method as set forth in claim 1 , further comprising storing the unsolicited electronic messages in a database.

14. The method as set forth in claim 13 , further comprising forwarding the unsolicited electronic messages from the database to a mail parser.

15. The method as set forth in claim 14 , further comprising parsing the unsolicited electronic messages utilizing the mail parser.

16. The method as set forth in claim 1 , wherein calculating the frequency includes determining a time difference between receipt of one of the unsolicited electronic messages and receipt of a subsequent one of the unsolicited electronic messages.

17. The method as set forth in claim 1 , further comprising recording a time that the unsolicited electronic messages are received.

18. A computer program product embodied on a tangible non-transitory computer readable medium, comprising: computer code for identifying a source of at least two unsolicited electronic messages as compromised, wherein the source is identified as compromised based, at least, on a speed of a network connection associated with an Internet protocol (IP) address of the source, which communicated the at least two unsolicited electronic messages; determining whether the network connection being used by the source is associated with a cable network connection, a digital subscriber line (DSL) network connection, or a dial-up network connection; wherein a source is not identified as being compromised if the network connection is associated with a dial-up network connection; computer code for calculating a frequency in which the source communicated the unsolicited electronic messages; and computer code for reacting based on the calculated frequency, wherein the reacting includes displaying an image of a world map reflecting a location associated with the source.

19. A system, comprising: a processor coupled to a memory and operable to cooperate such that the system can exchange information in a network, the system being configured for: identifying a source of at least two unsolicited electronic messages as compromised, wherein the source is identified as compromised based, at least, on a speed of a network connection associated with an Internet protocol (IP) address of the source, which communicated the at least two unsolicited electronic messages; determining whether the network connection being used by the source is associated with a cable network connection, a digital subscriber line (DSL) network connection, or a dial-up network connection; wherein a source is not identified as being compromised if the network connection is associated with a dial-up network connection; calculating a frequency in which the source communicated the unsolicited electronic messages, and reacting based on the calculated frequency, wherein the reacting includes displaying an image of a world map reflecting a location associated with the source.

20. The system as set forth in claim 19 , wherein the memory is coupled to the processor via a bus.

21. The method as set forth in claim 3 , wherein the speed of the network connection is determined using an internet protocol (IP) netspeed database.

Assignments (10)