Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q10/00—Administration; Management
  • G06Q10/10—Office automation; Time management
  • G06Q10/107—Computer-aided management of electronic mailing [e-mailing]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
  • H04L51/21—Monitoring or handling of messages
  • H04L51/212—Monitoring or handling of messages using filtering or selective blocking
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/01—Protocols
  • H04L67/10—Protocols in which an application is distributed across nodes in the network
  • H04L67/104—Peer-to-peer [P2P] networks

Definitions

• the present invention relates generally to computing networks and relates more particularly to the propagation of spam (e.g., unsolicited or spoofed data) over peer-to-peer data transfer networks.
• spam e.g., unsolicited or spoofed data
• FIG. 1 is a schematic diagram of a network 100 of nodes (e.g., computing devices) interacting in a peer-to-peer (P2P) manner.
• a requesting node 101 sends a search message 105 (e.g., containing keywords relating to data that the requesting node 101 wishes to locate) to at least one intermediate node 111 in communication with the requesting node 101 via a peer connection.
• the intermediate node 111 receives the search message 105 and forwards the search message 105 to at least one additional node 111.
• the search message 105 reaches at least one responding node 103 having the requested data (in some cases, the first intermediate node 111 to which the search message 105 is forwarded will also be a responding node 103). At least one responding node 103 then sends a response message 107 back to the requesting node 101, e.g., via the intermediate nodes 111. The requesting node 101 then requests the relevant data from a responding node 103 by connecting directly to the responding node 103, e.g., via direct connection 109.
• a responding node 103 may even send spam content in response to substantially any search message that is received, regardless of the keywords included in the search message.
• a responding node 103 may indicate that it has a file labeled "Joes_poetry.mp3" or "JoesPoetry.wmv”.
• the file instead of containing content related to Joe's poetry, the file in fact contains an advertisement for a product completely unrelated to Joe or poetry. If the user at the requesting node does not immediately check the content of the transferred file, he or she may be unaware that the transferred file contains spam and may unknowingly share the spam content with other users on the P2P network.
• One embodiment of the present method and apparatus for reducing spam in peer-to-peer networks includes forming a search message including at least one decoy word and sending the search request message, including the decoy word(s), to one or more nodes in the network.
• Embodiments of the present invention make it possible to weed out nodes in the network that send spam in response to every search message (e.g., regardless of the search message's content).
• Figure 1 is a schematic diagram of a network of nodes interacting in a peer-to- peer manner
• Figure 2 is a flow diagram illustrating one embodiment of a method for reducing spam on a P2P network, according to the present invention
• Figure 3 is a flow diagram illustrating a second embodiment of a method for reducing spam on a P2P network, according to the present invention.
• Figure 4 is a high level block diagram of the spam reduction method that is implemented using a general purpose computing device.
• the present invention is a method and apparatus for reducing spam in P2P networks.
• Embodiments of the present invention make it possible for a user to identify disguised spam sent in response to search messages before downloading the associated data, so that the user does not download and subsequently potentially share the spam with other users.
• Embodiments of the present invention are especially effective in identifying nodes that send spam in response to substantially any search message that they receive, regardless of the content of the search message.
• node refers to a computing device such as a personal computing device (e.g., a desk top computer, a laptop computer, a cellular telephone, a personal digital assistant, etc.), a server, a router or the like that is connected to a P2P network.
• a personal computing device e.g., a desk top computer, a laptop computer, a cellular telephone, a personal digital assistant, etc.
• server e.g., a server, a router or the like that is connected to a P2P network.
• FIG. 2 is a flow diagram illustrating one embodiment of a method 200 for reducing spam on a P2P network, according to the present invention.
• the method 200 may be implemented at, for example, a node in a P2P network.
• the method 200 is initialized at step 202 and proceeds to step 204, where the method 200 receives a search message, e.g., from a user of the node that is the source of the search message.
• the search message comprises, for example, one or more search keywords relating to data that a user wishes to search for in the network.
• the search message might comprise the words "Joe Smith" and "Happy Birthday” to indicate that the user wishes to search for media files related to Joe Smith's "Happy Birthday” album or song.
• the method 200 adds at least one "decoy" word to the search message received in step 204.
• the decoy word is a natural word that is unrelated to the keywords in the search message.
• decoy words are selected arbitrarily from a dictionary for insertion in the search message.
• decoy words are fanciful or made up words. For instance, in the example above, the method 200 might add the words “elephant”, “giraffe” and “dinosaur” to the search message containing the words "Joe Smith" and "Happy Birthday”.
• the number of decoy words that are added to the search message is predefined. For example, a user may specify that a fixed number of decoy words automatically be added to each search message, or that added decoy words comprise a fixed percentage of the total number of words or characters in the original search message. In another embodiment, the number of decoy words added to the search message is based on the lengths of previous search messages sent by the user (e.g., a number of decoy words may be added so that the length of the search message, including the decoy words, substantially matches the average length of previous search messages).
• step 208 the method 200 sends the search message, including the decoy words, e.g., in accordance with typical P2P protocols.
• the method 200 then receives at least one response message responding to the search message in step 210.
• the method 200 may specify that response messages stop being accepted after a specified period of time has elapsed or after a specified number of response messages has been received, in order to prevent response messages from being received indefinitely.
• step 212 examines a received response message. Specifically, the method 200 examines the content of the response message. In step 214, the method 200 determines whether the response message contains any of the decoy words that were added to the search message in step 206.
• a response message contains "enough" decoy words to be categorized as spam if the response message includes at least a predefined threshold number of decoy words or if decoy words comprise at least a predefined threshold percentage of the total number of words or characters in the response message. In one embodiment, responses that are categorized as spam are discarded.
• the method 200 may present the categorization results (e.g., from steps 216 and 218) to the user as a visual display, where the visual display represents an initial filtering of received response messages by the method 200, and the user may review the initial filtering results in order to verify the proper categorization of the received response messages (e.g., in a manner similar to the filtering of electronic mail by many commercial electronic mail providers).
• the method 200 may present "spam" and "non-spam" response messages in separate windows or panes on the user's display, or may flag response messages as "spam” or “non-spam” (e.g., using one or more icons).
• step 220 determines whether any unexamined response messages remain. If the method 200 determines that there is at least one unexamined response message, the method 200 returns to step 212 and proceeds as described above to examine and categorize the next response message. Alternatively, if the method 200 determines that no unexamined response messages remain, the method 200 terminates in step
• the method 200 thereby enables a user on a P2P network to quickly identify spammers within the network.
• the method 200 is able to weed out response messages from nodes that respond to substantially any search message they receive, which is a typical approach that spammers take.
• a user can avoid not only downloading spam, but sharing the spam with other users who subsequently download data from the user.
• the user can choose, based on the information gleaned via application of the method 200, to sever the connection to the spammer, thereby potentially isolating the spammer and preventing him or her from distributing any more spam.
• the user may decide simply to ignore all messages sent from the spammer for a predefined period of time.
• the method 200 may add a network identifier (e.g., an IP address) of the spammer to a list of known spammer nodes, where all messages received from nodes on the list are to be ignored for a predefined period of time.
• a network identifier e.g., an IP address
• FIG. 3 is a flow diagram illustrating a second embodiment of a method 300 for reducing spam on a P2P network, according to the present invention.
• the method 300 is tailored to data transfer networks in which search messages are considered to be the logical AND (e.g., only data matching all keywords in the search message will generate a search response).
• the method 300 may be implemented at, for example, a node in a P2P network.
• the method 300 is initialized at step 302 and proceeds to step 304, where the method 300 constructs a search message using only decoy words. Similar to the decoy words used in the method 200, the decoy words used to construct the search message in step 304 comprise arbitrary, individually un-related natural words, for example selected from a dictionary. Thus, for example, a search message constructed in step 304 might contain the words "elephant", "orange” and "hockey".
• step 306 the method 300 sends the search message e.g., in accordance with typical P2P protocols.
• the method 300 then receives at least one response message responding to the search message in step 308.
• the method 300 may specify that response messages stop being accepted after a specified period of time has elapsed or after a specified number of response messages has been received, in order to prevent response messages from being received indefinitely.
• the method 300 proceeds to step 310 and examines a received response message. Specifically, the method 300 examines the response message to determine the sender of the response message ⁇ e.g., as identified by an IP address associated with the response message).
• the method 300 categorizes the sender of the response message as a spammer (e.g., a node that is known to send spam). The method 300 may then decide to ignore all messages sent from the sender for a predefined period of time. In one embodiment, the method 300 adds a network identifier (e.g., an IP address) of the sender to a list of known spammer nodes, where all messages received from nodes on the list are to be ignored for a predefined period of time.
• a network identifier e.g., an IP address
• step 314 determines whether any unexamined response messages remain. If the method 300 determines that there is at least one unexamined response message, the method 300 returns to step 310 and proceeds as described above to examine and categorize the sender of the next response message. Alternatively, if the method 300 determines that no unexamined response messages remain, the method 300 terminates in step 316.
• FIG. 4 is a high level block diagram of the spam reduction method that is implemented using a general purpose computing device 400.
• a general purpose computing device 400 comprises a processor 402, a memory 404, a spam reduction module 405 and various input/output (I/O) devices 406 such as a display, a keyboard, a mouse, a modem, and the like.
• I/O devices 406 such as a display, a keyboard, a mouse, a modem, and the like.
• at least one I/O device is a storage device (e.g., a disk drive, an optical disk drive, a floppy disk drive).
• the spam reduction module 405 can be implemented as a physical device or subsystem that is coupled to a processor through a communication channel.
• the spam reduction module 405 can be represented by one or more software applications (or even a combination of software and hardware, e.g., using Application Specific Integrated Circuits (ASIC)), where the software is loaded from a storage medium (e.g., I/O devices 406) and operated by the processor 402 in the memory 404 of the general purpose computing device 400.
• ASIC Application Specific Integrated Circuits
• the spam reduction module 405 for reducing spam in a P2P network described herein with reference to the preceding Figures can be stored on a computer readable medium or carrier (e.g., RAM, magnetic or optical drive or diskette, and the like).
• the present invention represents a significant advancement in the field of data transfer networks.
• a method and apparatus are provided that make it possible for a user to identify disguised spam sent in response to search messages before downloading the associated data, so that the user does not download and subsequently potentially share the spam with other users.
• the spreading of spam through a network is substantially reduced.

Landscapes

• Engineering & Computer Science (AREA)
• Business, Economics & Management (AREA)
• Human Resources & Organizations (AREA)
• Strategic Management (AREA)
• Entrepreneurship & Innovation (AREA)
• Marketing (AREA)
• Quality & Reliability (AREA)
• Computer Hardware Design (AREA)
• Signal Processing (AREA)
• Economics (AREA)
• Computer Networks & Wireless Communication (AREA)
• Operations Research (AREA)
• Data Mining & Analysis (AREA)
• Tourism & Hospitality (AREA)
• Physics & Mathematics (AREA)
• General Business, Economics & Management (AREA)
• General Physics & Mathematics (AREA)
• Theoretical Computer Science (AREA)
• Information Transfer Between Computers (AREA)
• Computer And Data Communications (AREA)
• Data Exchanges In Wide-Area Networks (AREA)

Priority Applications (3)

Applications Claiming Priority (2)

Publications (2)

Family

ID=37571204

Family Applications (1)

Country Status (5)

Cited By (2)

Families Citing this family (10)

Family Cites Families (23)

• 2005
  • 2005-06-15 US US11/152,890 patent/US7552230B2/en not_active Expired - Fee Related
• 2006
  • 2006-06-15 CN CN2006800167997A patent/CN101341477B/zh not_active Expired - Fee Related
  • 2006-06-15 EP EP06773312.1A patent/EP1891540A4/en not_active Withdrawn
  • 2006-06-15 WO PCT/US2006/023425 patent/WO2006138526A2/en not_active Ceased
  • 2006-06-15 JP JP2008517125A patent/JP4791539B2/ja not_active Expired - Fee Related
• 2008
  • 2008-06-27 US US12/163,439 patent/US7962643B2/en not_active Expired - Fee Related

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events