Claims: EP1968264  (A1) ― 2008-09-10


A method of filtering electronic mails and an electronic mail system  

Claims of EP1968264 (A1)
Tooltip
Claims tree   

The EPO does not accept any responsibility for the accuracy of data and information originating from other authorities than the EPO; in particular, the EPO does not guarantee that they are complete, up-to-date or fit for specific purposes.

1. A method of filtering an electronic mail in an electronic mail system (1), the method comprising steps of:
- providing an electronic graph representation of electronic mail related characteristics derived from the history of electronic mail exchange in the electronic mail system (1) in a data base (23), and
- assigning to a present electronic mail provided for transmission in the electronic mail system (1) an electronic indicator indicative of a potential abusive mail character of the present electronic mail by analyzing present electronic mail characteristics based on the graph representation in the data base (23).

2. The method according to claim 1, wherein the step of providing the electronic graph representation comprises a step of providing an electronic graph representation of non-content electronic mail related characteristics.

3. The method according to claim 2, wherein the step of providing the electronic graph representation comprises a step of using sender and recipient information for generating the electronic graph representation of non-content electronic mail related characteristics.

4. The method according to claim 3, wherein the step of using sender and recipient information comprises a step of using at least one of sender and recipient address information and sender and recipient name information.

5. The method according to claim 3 or 4, wherein the step of using sender and recipient information for generating the electronic graph representation of non-content electronic mail related characteristics comprises steps of:
- providing a plurality of electronic pairs of sender and recipient information both related to one electronic mail, and
- generating the electronic graph representation a plurality of graphical vertices assigned the sender and recipient information and a plurality of directed graphical edges assigned to the pairs of sender and recipient information.

6. The method according to claim 5, wherein the step of generating the electronic graph representation comprises a step of orienting the directed graphical edges as originating from a vertex assigned to the sender information and ending at a vertex assigned to the recipient information.

7. The method according to one of the preceding claims, wherein the step of deriving the electronic mail related characteristics from the electronic mail exchange history comprises a step of analyzing electronic mails handled by at least one node provided in the electronic mail system (1).

8. The method according to one of the preceding claims, further comprising the following steps of:
- providing the electronic indicator to a classification component, and
- classifying the present electronic mail by the classification component as at least one of a solicited electronic mail, an unsolicited electronic mail, and a potential security threat.

9. The method according to one of the preceding claims, further comprising a step of using the present electronic mail as a training mail for a statistical filter component if the electronic indicator indicates a non-abusive mail character.

10. An electronic mail system (1), comprising:
- a plurality of network stations (5, 6, 7), each having an ability to function as at least one of a sender of electronic mail and a recipient of electronic mail,
- a data base (23) comprising an electronic graph representation of electronic mail related characteristics derived from electronic mail exchange history between the plurality of network stations (5, 6, 7), and
- a filter component (21, 22) connected to the data base (23) and the plurality of network stations (5, 6, 7) and configured to assign to a present electronic mail provided for transmission an electronic indicator indicative of a potential abusive mail character of the present electronic mail by analyzing present electronic mail characteristics based on the graph representation in the data base (23).

11. The system according to claim 10, wherein the filter component (21, 22) is provided in an electronic mail transfer agent (20).

12. The system according to claim 10 or 11, wherein the filter component (21, 22) comprises parsing component (21) configured to parse the present electronic mail, and a processing component (22) configured to process parsed information derived from the parsing of the present electronic mail and to provide the electronic indicator indicative of the potential abusive mail character of the present electronic mail by analyzing present electronic mail characteristics derived from the parsed information based on the graph representation in the data base (23).

13. The system according to one of the claims 10 to 12, wherein the electronic graph representation comprises an electronic graph representation of non-content electronic mail related characteristics.

14. The system according to claim 13, wherein the electronic graph representation of non-content electronic mail related characteristics comprises sender and recipient information.

15. The system according to claim 14, wherein the sender and recipient information comprises at least one of sender and recipient address information and sender and recipient name information.

16. The system according to claim 14 or 15, wherein the electronic graph representation of non-content electronic mail related characteristics comprises a plurality of graphical vertices assigned the sender and recipient information and a plurality of directed graphical edges assigned to the pairs of sender and recipient information.

17. The system according to claim 16, wherein the electronic graph representation comprises of non-content electronic mail related characteristics comprises the directed graphical edges as originating from a vertex assigned to the sender information and ending at a vertex assigned to the recipient information.

18. The system according to one of the claims 10 to 17, further comprising a classification component configured to classify the present electronic mail as at least one of a solicited electronic mail, an unsolicited electronic mail, and a potential security threat based in the electronic indicator.