TRACING DOMAINS TO AUTHORITATIVE SERVERS ASSOCIATED WITH SPAM
The invention provides a method and system for filtering email which may contain links to a large number of rapidly synthesized domains serving spam content by referencing a database of categorized authoritative servers, querying a domain name system server for an authoritative server associated with domain names embedded in email, and accessing the database of categorized authoritative servers for a match.
1 . A method for filtering an electronic document, comprising the following processes:
analyzing an electronic document for a pattern expression corresponding to a uniform resource identifier (URI) 210 ;
obtaining at least one domain from a URI embedded in the electronic document 220 ;
querying a domain name system (DNS) server for at least one first authoritative server for the domain 230 ,
receiving a reply from a DNS server wherein an authoritative server comprises one of an internet protocol (IP) address and a domain name 240 ;
referencing a database of categorized authoritative servers 250 ;
matching a first authoritative server received from a DNS server with any member of the database of categorized authoritative servers 260 ; and
if matching, operating on the electronic document 270 .
2 . The method of claim 1 wherein an electronic document comprises an electronic mail document.
3 . The method of claim 2 wherein operating on an electronic mail document comprises quarantining the electronic mail document.
4 . The method of claim 2 wherein operating on an electronic mail document comprises blocking the electronic mail document from transmission to the addressee.
5 . The method of claim 2 wherein querying a DNS server comprises querying a caching server.
6 . The method of claim 2 wherein querying a DNS server comprises querying a top level server.
7 . The method of claim 2 wherein querying a DNS server comprises querying a root server.
8 . A method comprising the following processes:
analyzing an electronic mail document for a pattern expression corresponding to a uniform resource identifier (URI) 210 ;
obtaining at least one domain from a URI embedded in the electronic document 220 ;
querying a domain name system (DNS) server for at least one first authoritative server for the domain 230 ,
receiving a reply from a DNS server wherein an authoritative server comprises one of an internet protocol (IP) address and a domain name 240 ;
referencing a database of categorized authoritative servers 250 ;
matching a first authoritative server received from a DNS server with any member of the database of categorized authoritative servers 260 ; and
if matching, adjusting a score of an electronic mail document in a spam filtering system.
9 . A method comprising the following processes:
analyzing an electronic mail document for a pattern expression corresponding to a uniform resource identifier (URI) 210 ;
obtaining at least one domain from a URI embedded in the electronic document 220 ;
querying a domain name system (DNS) server for a plurality of authoritative servers for the domain 230 ,
receiving a plurality of replies from a plurality of DNS servers wherein an authoritative server comprises one of an internet protocol (IP) address and a domain name 240 ;
referencing a database of categorized authoritative servers 250 ;
matching each authoritative server received from a plurality of DNS servers with any member of the database of categorized authoritative servers 260 ; and
if matching, operating on the electronic mail document 270 .
10 . The method of claim 9 wherein operating on the electronic mail document comprises categorizing an electronic mail document into a category by associating it with an authoritative server.
11 . The method of claim 9 wherein operating on the electronic mail document comprises quarantining the electronic mail document into a folder separate from electronic mail which is not matched in a category of categorized authoritative servers.
12 . The method of claim 9 wherein operating on the electronic mail document comprises blocking an electronic mail document from transmission to its addressee.
13 . The method of claim 9 wherein querying a domain name system (DNS) server for a plurality of authoritative servers for the domain 230 comprises querying for the start of authority; parsing a domain from right to left beginning with the base domain below a top level domain; and querying again for each child domain until an authoritative server is found.
14 . A computer program embodied on a computer-readable medium for . . . , comprising: a code segment that at least maintains a database of categorized authoritative servers 250 ;
a code segment which matches each authoritative server received from a plurality of DNS servers with any member of the database of categorized authoritative servers 260 ; a code segment which on the condition of a match, operates on an electronic mail document 270 containing a domain corresponding to said authoritative server.
15 . A component for use in a computer system, comprising:
an electronic document examination unit which analyzes an electronic mail document for a pattern expression corresponding to a uniform resource identifier (URI) 210 ;
obtains at least one domain from a URI embedded in the electronic document 220 ;
queries a domain name system (DNS) server for a plurality of authoritative servers for the domain 230 , and
receives at least one reply from a plurality of DNS servers wherein an authoritative server comprises one of an internet protocol (IP) address and a domain name 240 .
16 . A system for tracing domains to authoritative servers associated with spam, said system comprising: a database of categorized authoritative servers, an email examiner adapted to determine a domain from a uniform resource identifier embedded in an email, query a domain name system server for an authoritative server associated with domain names embedded in email, and access the database of categorized authoritative servers for a match.