Method and system for handling unwanted email messages
View Patent ↗A method, system, and computer program product for scanning incoming emails reduces the server resources needed, which improves server throughput and reduces costs. A method for processing incoming email messages comprised the steps of scanning incoming email messages to obtain an address of a sender of each incoming email message and to determine whether the email message is spam, for each email message that is determined to be spam, incrementing a count of email messages that are spam for a sender of the email message, determining that a count of email messages that are spam for a sender of an email message has exceeded a threshold, and thereafter, discarding all incoming email messages from the sender for which the count of email messages that are spam for a sender of an email message has exceeded a threshold without scanning the email messages to determine whether they are spam.
1. A method, comprising:
scanning, in response to a determination that a first time period has ended, email messages from an email address of a sender previously identified as a source of spam;
placing the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender, the placing performed in response to a determination that a count of the email messages that are clean has exceeded a threshold over a second time period, the second time period similar or less than the first time period; and
placing the email address of the sender in a spammers list in response to a determination that a count of the email messages that are spam has exceeded a threshold over a third time period greater than the second time period, wherein the spammers list is replicated to another server.
2. The method of claim 1 , further comprising:
scanning the email messages to identify patterns in headers of the email messages.
3. The method of claim 1 , wherein the scanning further comprises:
scanning a first name and a last name of the sender.
4. The method of claim 1 , further comprising:
counting spam and clean characteristics of the email messages; and
storing results of the counting in a security database.
5. The method of claim 4 , wherein the security database includes a selected one or more of a group of columns, the group consisting of:
a) an email address column;
b) a count of email messages marked spam column;
c) a count of email messages quarantined column; and
d) a count of clean email messages column.
6. The method of claim 4 , wherein the security database is accessed by an email server using the email address of the sender.
7. The method of claim 5 , wherein the columns in the database are incremented based on results associated with scanning the email messages.
8. A method, comprising:
scanning email messages from an email address of a sender previously identified as a source of spam;
determining that a count of the email messages that are clean has exceeded a threshold over a predefined time period;
placing the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender;
obtaining respective email addresses for each of a plurality of email messages;
evaluating a spam list and the clean list of a database to determine whether the respective email addresses are present in either of the lists;
discarding a first group of the plurality of email messages based on the first group having corresponding email addresses that are present on the spam list; and
delivering a second group of the plurality of email messages based on the second group having corresponding email addresses that are present on the clean list.
9. One or more non-transitory, computer-readable storage media storing instructions that, when executed, cause a computing device to perform a method, the method comprising:
scanning, in response to a determination that a first time period has ended, email messages from an email address of a sender previously identified as a source of spam;
placing the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender, the placing performed in response to a determination that a count of the email messages that are clean has exceeded a threshold over a second time period, the second time period similar or less than the first time period; and
placing the email address of the sender in a spammers list in response to a determination that a count of the email messages that are spam has exceeded a threshold over a third time period greater than the second time period, wherein the spammers list is replicated to another server.
10. The one or more computer-readable storage media of claim 9 , the method further comprising:
scanning the email messages to identify patterns in headers of the email messages.
11. The one or more computer-readable storage media of claim 9 , the method further comprising:
scanning a first name and a last name of the sender.
12. The one or more computer-readable storage media of claim 9 , the method further comprising:
counting spam and clean characteristics of the email messages; and
storing results of the counting in a security database.
13. The one or more computer-readable storage media of claim 12 , wherein the security database includes a selected one or more of a group of columns, the group consisting of:
a) an email address column;
b) a count of email messages marked spam column;
c) a count of email messages quarantined column; and
d) a count of clean email messages column.
14. The one or more computer-readable storage media of claim 12 , wherein the security database is accessed by an email server using the email address of the sender.
15. The one or more computer-readable storage media of claim 13 , wherein the columns in the security database are incremented based on results associated with scanning the email messages.
16. One or more non-transitory, computer-readable storage media storing instructions that, when executed, cause a computing device to perform a method, the method comprising:
scanning email messages from an email address of a sender previously identified as a source of spam;
determining that a count of the email messages that are clean has exceeded a threshold over a predefined time period;
placing the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender;
obtaining respective email addresses for each of a plurality of email messages;
evaluating a spam list and the clean list of a database to determine whether the respective email addresses are present in either of the lists;
discarding a first group of the plurality of email messages based on the first group having corresponding email addresses that are present on the spam list; and
delivering a second group of the plurality of email messages based on the second group having corresponding email addresses that are present on the clean list.
17. A server, comprising:
a processor; and
a memory coupled to the processor, wherein the server is configured to
perform a scanning, in response to a determination that a first time period has ended, email messages from an email address of a sender previously identified as a source of spam;
place the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender, the email address placed in the clean list in response to a determination that a count of the email messages that are clean has exceeded a threshold over a second time period, the second time period similar or less than the first time period; and
place the email address of the sender in a spammers list in response to a determination that a count of the email messages that are spam has exceeded a threshold over a third time period greater than the second time period, wherein the spammers list is replicated to another server.
18. The server of claim 17 , wherein the server is further configured to scan the email messages to identify patterns in headers of the email messages.
19. The server of claim 17 , wherein the scanning further comprises:
scanning a first name and a last name of the sender.
20. The server of claim 17 , wherein the server is further configured to perform a counting of spam and clean characteristics of the email messages and to store results of the counting in a security database.
21. The server of claim 20 , wherein the security database includes a selected one or more of a group of columns, the group consisting of:
a) an email address column;
b) a count of email messages marked spam column;
c) a count of email messages quarantined column; and
d) a count of clean email messages column.
22. The server of claim 20 , wherein the security database is accessed by the server using the email address of the sender.
23. The server of claim 21 , wherein the columns in the security database are incremented based on results associated with scanning the email messages.
24. A server, comprising:
a processor; and
a memory coupled to the processor, wherein the server is configured to
scan email messages from an email address of a sender previously identified as a source of spam;
determine that a count of the email messages that are clean has exceeded a threshold over a predefined time period;
place the email address of the sender in a clean list such that scanning software is subsequently prevented from performing a full scan of additional messages from the email address of the sender;
obtain respective email addresses for each of a plurality of email messages;
evaluate a spam list and the clean list of a database to determine whether the respective email addresses are present in either of the lists;
discard a first group of the plurality of email messages based on the first group having corresponding email addresses that are present on the spam list; and
deliver a second group of the plurality of email messages based on the second group having corresponding email addresses that are present on the clean list.