T 1028/06 (Spam detector/MICROSOFT) 05-12-2008

1. The appeal complies with the requirements referred to in Rule 65(1) EPC 1973 and is therefore admissible.

2. The application relates to filtering unsolicited e-mails or "spam". It is generally known to classify e-mails using a rule-based classifier, e.g. by looking for certain words in the subject line or the body of the text. However, this is not always accurate (see paragraphs [0007] to [0010] of the application).

3. The idea of the invention in the main and first auxiliary requests (embodiments of Figures 1 to 4) is that if an e-mail has a probability of being spam that is greater than a (first) threshold, a "challenge" is sent to the originator of the e-mail that must be answered ("automatically" in the first auxiliary request). In the second auxiliary request (embodiment of Figure 6), the challenge is only sent if the probability is in a "questionable" area between the first threshold and a second threshold. The response to the challenge is used to classify the e-mail as being or not being spam and for classifying the originator as being a spam sender or a legitimate sender, respectively.

Main request

4. The examining division considered that the subject-matter of claim 1 was not inventive over the combination of D1 and D2. The Board essentially agrees with the examining division's approach (see below in connection with the more limited second auxiliary request). However, the Board considers that because of the broad formulation of the claim, it is even not new over D2 alone.

5. D2 discloses a system that filters e-mails according to whether the originator is known to the recipient and according to various parts of the message (see Figure 7). It sends a challenge 450 if the validity of the originator cannot be determined. One of the tests for this is whether the originator is on the acceptance list of recipient (Figure 7: 425 and page 27, lines 1 to 10). In the Board's view this test can be considered to be a computation of the probability that the e-mail message is spam, in the sense of the first feature of the claim; if the sender is on the list, the probability is zero, otherwise it is non-zero. As a result, the challenge is sent to the sender of the e-mail if the probability is greater than a first threshold, in this case zero, according to the second feature of the claim.

6. The appellant argued that when D2 checks whether the originator is on the acceptance list, it does not compute a probability that the e-mail is spam in the sense of the claim, but simply makes a hard yes/no decision. However, the Board cannot agree with this distinction based on the wording of the claim because in its broadest English meaning, "compute" covers any type of information processing producing the probability, which is what happens in D2, albeit that the probability is zero or non-zero.

7. Accordingly, under this interpretation, the subject-matter of claim 1 is not new (Article 54(1) and (2) EPC 1973).

First auxiliary request

8. Claim 1 of the first auxiliary request adds to that of the main request the feature that the originator's computer automatically responds to the challenge.

9. There was some discussion before the examining division and before the Board as what the effect of this feature was and how it was achieved. The predominant idea at the oral proceedings before the examining division was that the sender of the e-mail had some secret that was used to reply to the challenge (see minutes of the oral proceedings at page 4). At the oral proceedings before the Board, the representative argued that no secret was necessary, but the level of computational difficulty of the challenge must be manageable for the sender of a single e-mail, but too demanding for a spammer sending millions of e-mails. The representative found support for this interpretation in the application at column, 13, lines 25 to 28.

10. Under the latter interpretation, the intended effect of automatically responding to the challenge is to make the response easier for a legitimate sender, but difficult for a spammer. However, the actual means for doing this are not claimed (and arguably not described). Even the appellant argues that it is not the implementation of this feature, but the idea itself that it not obvious. In the Board's view, the mere idea of automating a task to make it easier for the user is an obvious desideratum. If it turns out that this automatic response is a burden to a spammer, a bonus effect is achieved that cannot confer an inventive step to an otherwise obvious solution.

11. Accordingly, the subject-matter of claim 1 of the first auxiliary request does not involve an inventive step (Article 56 EPC 1973).

Second auxiliary request

12. The Board agrees with the appellant that claim 1 of the second auxiliary request has "a great number of details", at least compared to claim 1 of the main request. However, the Board does not agree that they are not known from either D1 or D2 since these documents together disclose most of them. In fact, the examining division's analysis at point 5 of the reasons appears to be correct, namely that the only features not anticipated by the combination of these documents are the automatic update of the blocking list and not sending a challenge if the probability is greater than a second threshold.

13. In detail, it is common ground that D1 discloses a method for detecting unsolicited e-mail comprising the steps of:

determining the probability that the e-mail message is spam (column 4, lines 62 to 67);

comparing the calculated probability with a first threshold and identifying the e-mail message as not being spam in case that the probability is smaller than that first threshold (column 5, lines 4 to 7 and the "non-spam" category mentioned at line 21);

identifying the e-mail message as spam in case the calculated probability is greater than a second threshold value (implicit from the classification into the categories corresponding to "different degrees" of spam, namely "certain spam", "questionable spam" and non-spam" at column 5, lines 18 to 21).

14. Claim 1 therefore differs from D1 by:

a) identifying the e-mail as not being spam if the sender of the e-mail is in a legitimate e-mail sender store;

b) identifying the e-mail message as spam if the sender of the e-mail message is in a spam sender store;

c) in case that the calculated probability is greater than the first threshold but smaller than the second threshold, sending a challenge to the sender of the e-mail message;

d) determining whether the sent challenge has been correctly answered;

e) in case that the challenge has been correctly answered identifying the e-mail message as not being spam and adding the sender to the legitimate e-mail sender store and in case the response has not been correctly answered, identifying the e-mail message as spam and adding the sender to the spam sender store.

15. It is also agreed that these features solve the problem of increasing the reliability provided by the spam classification of the probabilistic classifier.

16. The appellant argues that Dl does not suggest that there is any problem with the approach used to detect spam. However, the Board considers that, firstly, such problems would come to light in the normal operation of probabilistic spam filters. In particular, the "certain spam" in D1 might turn out not to be so and the "questionable spam" must be checked manually. Secondly, the general problem of misclassifying e-mails by spam filters was well known in the art. D2 gives an account of such problems at page 4, line 15 to column 5, line 26. In particular, D2 mentions the problem of the risk of automatically discarding e-mails and the problem of having to scan manually suspected spam, which would be problems facing the user of D1.

17. As a result, the Board is of the view that the skilled person would consider improving the reliability of the spam filtering in D1 with the solutions proposed in D2. Firstly, the idea of using acceptance/blocking lists is described in D2 at page 5, lines 2 to 10 as conventional. D2 also discloses automatically accepting or rejecting e-mails from senders on these respective lists ("acceptance list" - Figure 7: 425 and "blocking list" - Figure 7: 415). The Board considers that it would be obvious to incorporate this idea into D1 according to distinguishing features a) and b), the order having no effect on the system.

18. Furthermore, the Board considers that it would be obvious to increase the reliability by incorporating a challenge component (Figure 7: 450). The appellant argues that combining Dl and D2 would lead to a system where, irrespective of the probability, a challenge is sent to all originators of e-mails not known to the receiving system. However, the Board considers that the skilled person would consider only challenging some e-mails for various reasons. Firstly, challenging all e-mails would make the probabilistic classification redundant. Secondly, D2 does not challenge every e-mail anyway. Apart from distinguishing e-mails from senders on the acceptance and blocking lists, it also checks another situation, namely whether the originator's address is, or appears to be ("as best possible"), valid "before going through the trouble of composing and returning a Challenge" (Figure 7: 450 and page 27, line 26 to page 28, line 13). In the Board's view, the skilled person would derive from this the general idea that challenging a subset of e-mails is a trade-off between "trouble" or effort and additional certainty of classification. One obvious trade-off point would be to challenge the e-mails identified as "questionable spam" by the classifier of D1, i.e. where the calculated probability is greater than the first threshold but smaller than a second threshold, according to distinguishing feature c). After sending a challenge, it follows that the system must determine whether it has been correctly answered, according to feature d).

19. Finally, D2 discloses adding the sender to the legitimate e-mail sender store if the challenge is answered correctly (Figure 7: 470), according to part of feature e). The Board agrees with the examining division that it would be an obvious analogy to add the sender to the spam sender store if the response is not answered correctly, according to the remaining part of the feature.

20. Accordingly, the subject-matter of claim 1 of the second auxiliary request does not involve an inventive step (Article 56 EPC 1973).