GB2415062A

GB2415062A - Junk mail filter for emails based on subject field text

Info

Publication number: GB2415062A
Application number: GB0412691A
Authority: GB
Inventors: Malcolm Ripley
Original assignee: Individual
Current assignee: Individual
Priority date: 2004-06-08
Filing date: 2004-06-08
Publication date: 2005-12-14
Also published as: GB0412691D0

Abstract

A method for eliminating spam from the internet. It employs a public non encrypted frequently changed keyword or phrase in the subject line that is interpreted as being from a new sender by the recipient, recipient software or server filtering software. As the spammers ability to reach a users inbox is eliminated the cost effectiveness of spamming will be significantly reduced and thus the spam circulating around the internet will ultimately decrease. This method will work for one user or many users. It does not depend on any server to server cooperation, no databases are required, no additional confirmation or validation emails, no significant changes to software, no encoded keys, no secret passwords and is fully compatible with existing filtering methods.

Description

24 1 5062

2.0 Description

2.1 Background

There already exists anti-spam filters which can employ many methods to try and identify spam. In most cases there are three basic [risers: the accept List, the delete List and the interpretation o; content. The accept list usually consists of the email addresses o] letdown contacts and/or subjects of interest. The delete list is similar in that it is a list of unwanted sender addresses and subjects o) no interest. However, the problem here is that the addresses used by spammers can be filmed and/or loole genuine and the subject line for spam is becoming increasingly sophisticated with purposely misspelt keywords e.g. vi@gra, malting the keyword search neJective. Thirdly there is the filtering based on an analysis of content but again the spammer is becoming ever more sophisticated such that even these filters are becoming ineffective.

2.2 Method The basic approach for this method is to assume that we can never identify spam using software and that a human interface is required. The human interface will world perfectly well it they only have to malice decisions for a very small number of emails i.e. a volume similar to their genuine email. Genuine emarl and email requiring a decision must be kept entirely separate for the human decision malting process to be elective.

The following terms are used in the subsequent description: "new sender" keyword The word or phrase included in the email subject line that is used to identify to the recipient that the sender of the Emil is previously unknown but is a potentially genuine sender o] emaiL anti-spam filter Software used to Triter emails according to defined rules which could be a specific ant-spam application run on the server, and/or on the users computer and/or embedded within an email reader. These already exist but would require modification to automate the method described here The user has antc-spam filters, either on the server or the client computer or both, that specifically detect the "new sender" keyword. The anti-spam filters and email reader will then do 3 things to incoming email.

1 Accept all emarl from known senders identified as such by their emarl address.

This is one of the accept criteria already employed by anti-spam filtering Ad.

software.

2 Email identified by the use o] the "new sender" keyword in the subject line is added to a new sender list.

3 Delete all other email.

The above functionality is the overall basic behaviour from email received by the server to delivery to the user see figure 1. Iffilters are applied on both the server and client then the functionality may be split as show in figure 2. Split functionality will occur depending on the users email access i.e. dialup or broadband and/or if the users email reader and filtering software are separate applications.

All smalls in the new sender list are not readable as normal emails but are listed to allow the user to select which they wish to accept and which to reject. All accepted smalls are then passed through to the inbox as normal. The email addresses of accepted emails are automatically added to the accept criteria in the anti-spam [alters. If any smalls in the new sender list are rejected the software will prompt the user to change the "new sender" keyword. Ideally this would be mandatory if at least one message was rejected in a session.

However, it may be practical to apply the change after a defined number o] rejections or after a specified time since the Rest rejection. For example, changing several times a day is clearly impractical but every 2 or 3 days at worst is more manageable. The basic decision pow for the handling of new sender messages is shown in [pure 3.

For maximum security, especially against attached viruses, the list of new senders should be presented to the user as simple text. If additional identification of the email is required such as the subject line and/or the first line(s) of the main email message then these should also only be presented in simple text format. It is recommended that any list handlers do not have an "accept all" option. This then forces the user to specifically accept or reject each email which is far more likely to stimulate the correct response.

Since the auto-changing o] the "new sender" keyword occurs within the email reader software which is also used to compose emails then it can automatically modify the keyword in the users email signature. Smart methods would allow users to compose signatures in a free format of their choice but use tokens to identify where the "new sender" keyword should be inserted.

2.2.1 Existing or Additional Email Senders of email do not need to use the keyword once the recipient has their address in their accept list. The assumption for the sender is that they only need to put the keyword into their first sent email. However, no harm will be done by keeping the keyword in all correspondence, it will simply become redundant.

2.2.2 Spammers Using the keyword It is inevitable that spammers will Icicle up the keyword. Once this happens the recipient simply hns to change the keyword and all spam will immediately cease. There is very little danger LO valid email being deleted since the recipient would have already added them to their accept list. I] spam comes through at the same time as a new valid email, both using the keyword, then all of this email will be added to the new sender list and the user will only accept the genuine sender(s). In cases such as these the amount o] new spam tends to be very small and only increases over time if not tackled.

It is theoretically possiblefor a spammer to leep a database of all email addresses and auto detected "new sender" keywords. However, this greatly increases the cost o] sending spam and requires the spammer to constantly re-interpret email signatures and/or Illegally tap into internet correspondence. It will not be cost effective for the spammer, especially since the amount of spam getting through is considerably reduced and the amount o] returns needed, to cover the higher costs, will have increased.

2.2.3 Unrequested Genuine Email In order to receive email from unknown genuine senders they would still need to provide the "new sender" keyword. Therefore, the anew sender" keyword would have to be advertised and the best place for this would be as part o] the users email signature. The format o] the signature can be anything since it is interpreted by people who are genuine senders and not by software used by spammers. Since every user can format the signature any way they wish this makes it very difficult for software to interpret.

Some users already successfully employ a cryptic method of adding their email address to their signature. Unfortunately this does not allow for the automatic detection of new senders only the foiling of email grabbers for spam lists.

2.3 Effectiveness The electiveness in this approach is, ironically, the total openness. In orderfor shammers to send spam they would have to have software that can intelligently identify "new sender" keywords. But the method used by users to advertise their keyword is entirely up to them.

There will be no specific method employed. I] this system is accepted as a general principle of sending email then a new "new sender" keyword box would be added wherever an email is prompted for. In this case the keyword can only be "grabbed" once a user has requested something to be sent to themselves not only that but the validity o] this keyword is short- lived. Users themselves could change this keyword as often as they please even i] the spammers haven't picked up on the word. This way the user will always be ahead of even the most tenacious intrusive spammer who is illegally tapping into internet requests and forms.

2.4 Backwards Compatibility Since the method can be employed manually using existing unmodified anti-spam [mitering it allows senders and receivers o] email to communicate with one another using this method even if they do not have the relevant modified software. Although this would require a more knowledgeable computer user.

The method is fully compatible with existing filtering so that there can be an overlap whilst this method is adopted as a standard. In addition the user can still employ other accept criteria. For example, the user may wish to accept all smalls related to a specific subject of interest from a user/news group, in which case they would have the keyword e.g. "trainspotting" as a normal accept criteria and emails that match that criteria would go directly to their inbox. It is only smalls that match the new sender keyword that are treated differently from existing filters.

Even ii this method is adopted as an internet standard users of non new sender complaint software and methods can continue to receive their email exactly as they presently do.

However, such users would have to cooperate with the new sender methods to send new emails i.e. embed the recipients current new sender keyword in the subject line.

2.5 Viruses Viruses in emails are essentially spam and since this method deletes all unknown equals by default then the spread of injection will be considerably reduced. Since the recipients keyword changes then the virus spread stops right there. The faster a vitas attempts to spread the quicker peoples anti-spam filters detect unaccepted emarLs and so the quicker the keywords change and the spread o] the virus hatted. However, there is no protection against proliferation by a user who accepts aLL "new sender" emaiLs hence the recommendation to prompt for acceptance of messages one at a time. There will be protection against the automatic opening of attachments by the Less knowledgeable user since all virus emaiLs will be in the new sender text only List.

2.6 Variations For added security and flexibility additional "new senders keywords can be adopted: Unpublished new sender Only provided when prompted for in forms for example.

Old unpublished new sender The previous unpublished keyword kept for a short time (e.g. One or two days) to maintain an overlap in case the keyword changes between the sending of a genuine emaiL and when it is received.

Published new sender Published in emaiL signatures.

Old Published new sender No Longer published but inept for a short time (e.g. one or two days) to maintain an overlap in case the keyword changes between the sending of a genuine emarL and when it is received.

The ideal configuration of client, server, anti-spam filter and email reader will depend on the type of connection the user has to their emaiL and how the new sender functionality has been coded in the software. DcaLup/POP3 users would want to delete emaL on the server and thus the functionality would be split between the server and the client. Broadband/IMAP users can delete emaL wherever it is the most convenient. is

Claims

3.0 Claims 1. A method for filtering email using a public non encrypted

keyword or phrase in the subject line that identifies the sender to the recipient as a potential genuine "new sender".
2. Filtered email using the method described in claim 1 is downloaded to the normal inbox for genuine emails or a list of potential genuine email that that user approves, all other email and unapproved new sender email is deleted.
3. The keyword or phrase of claim 1 can be changed as and when deemed necessary by the user or automatically by software.
4. The single keyword or phrase of claim 1 is the simplest protection but more keywords can be employed to add greaser flexibility and protection.