T 0283/12 (Mail filtering/STRATO) 15-02-2018

1. The application

1.1 The application relates to the filtering of electronic mail. It proposes a technique for detecting potential abusive electronic mail in an electronic mail system. The main example of "abusive" electronic mail given in the application is electronic spam mail.

1.2 The detailed description on page 7, line 32, to page 9, line 9, describes an embodiment of the invention with reference to the components of an electronic mail system as illustrated in Figure 2. In this system, a parsing component of a mail transfer agent extracts sender and receiver addresses from emails. From these pairs of addresses a weighted directed graph is constructed: nodes correspond to addresses, directed edges between nodes correspond to emails sent in the past from a sender address to a receiver address, and weights of edges correspond to the number of such emails.

The "relationship" between a sender address S and a receiver address R can now be determined by calculating various "arbitrary complex measures" on the basis of the graphs (e.g. whether R and S are directly connected by an edge, or whether there are paths between R and S, the number of such paths, their weights, etc.).

The "total score" of a particular email is "an arbitrary combination of all scores of its sender/recipient pairs". This total score is used as an indicator of the spam status of the email. A high total score suggests that recipient(s) and sender are tightly related, meaning that the email is not spam.

Hence, the invention's spam filter works by determining the total score of (outgoing) emails as a measure of the "tightness" of the relationships between sender and recipients and filtering/blocking the email if the total score suggests that the email is spam.

2. Exclusion from patentability - both requests

2.1 The examining division in its decision considered the subject-matter of the independent claims to lack technical character and thus to be excluded from patentability under Article 52(2) and (3) EPC, even though those claims evidently recited technical features such as "electronic mail", "electronic mail system" and "electronic graph representation".

2.2 Those technical features are still present in the independent claims of the main request and of the auxiliary request. Since it is established jurisprudence that the use of technical means suffices to ensure that subject-matter is not excluded under Article 52(2) and (3) EPC (see, for example, decision T 258/03, OJ EPO 2004, 575), the examining division's objection cannot be upheld.

3. Main request - basis in the application and wording of claim 1

3.1 Claim 1 of the main request is based on a combination of original claims 1 to 3, 5 and 7 and the additional features of original dependent claim 12.

3.2 One of the features of claim 1 reads "generating the electronic graph representation a plurality of graphical vertices assigned the sender and recipient information and a plurality of directed graphical edges assigned to the pairs of sender and recipient information".

3.3 At the oral proceedings, the appellant acknowledged that the wording of this feature contained mistakes and proposed that it should be read as "generating the electronic graph representation with a plurality of graphical vertices assigned to the sender and recipient information and a plurality of directed graphical edges assigned to the pairs of sender and recipient information" (underlining added by the board).

3.4 For the purpose of assessing inventive step, the board will read this feature in accordance with the appellant's proposal.

4. Main request - inventive step

4.1 The examining division considered that the subject-matter of the independent apparatus claim, if it had technical character at all, lacked "technical novelty" over a known email system. However, since no prior art under Article 54(3) and (4) EPC 1973 (applicable here) has been cited, the board prefers to consider the question whether the claimed invention makes a technical contribution to the state of the art under the heading of inventive step.

4.2 At the oral proceedings, the appellant attempted to distinguish the subject-matter of claim 1 from the technique of "auto-white-listing" described in paragraph [0011] of the published application. According to this technique, "an electronic mail is considered non-spam if the recipient has sent an electronic mail to the sender in the past". The technique is said to have the weakness that spam senders can forge electronic mails with flipped sender/recipient pairs to trigger the automatic white-listing. It is therefore said to be insufficient to consider only pairs of addresses.

Paragraph [0011] states that this technique is known, and at the oral proceedings the appellant did not dispute this.

4.3 The board considers the known method of detecting and filtering emails as spam in an email system by means of "auto-white-listing" to be a suitable starting point for assessing inventive step for the subject-matter of claim 1. An email system implementing this technique necessarily keeps track of a "history of electronic mail exchange" in the form of a list of pairs of sender/recipient email addresses. If a "present electronic mail" is provided to the system for transmission to the recipient, the system parses the email to extract the sender and recipient email addresses and checks whether this pair of addresses is present in the list. If it is not, the email is considered to be spam and filtered.

4.4 According to claim 1, an "electronic graph representation of non-content electronic mail related characteristics" is derived from the "history of electronic mail exchange". The graph includes vertices corresponding to sender and recipient information, for example in the form of email addresses, and directed edges between vertices corresponding to emails sent in the past from a sender to a recipient. The board notes that email addresses are indeed "non-content related".

4.5 The appellant argued that the list of pairs of sender/recipient email addresses maintained by the "auto-white-listing" technique could not be equated with the electronic graph representation of the claim, as the list was not a "graph representation" including vertices and directed edges.

However, one way of electronically representing a graph consisting of vertices and directed edges is by listing the edges as ordered pairs of vertices. If the vertices correspond to email addresses identifying senders and receivers and the directed edges correspond to ordered pairs of sender and receiver addresses of emails sent in the past, such a listing corresponds precisely to the list of sender/recipient email addresses maintained by the "auto-white-listing" technique.

In this context, the board notes that paragraph [0036] of the published application discloses that the invention's graph data base contains "all past pairs of hashed addresses" and that "[f]iguratively, [these pairs] constitute an electronic graph representation, where each address is a node, and between nodes there are directed edges if and only if in the past a matching pair of addresses, i.e. an electronic mail from the address represented by the first node to the address represented by the second node, has been observed". The application hence acknowledges that the electronic graph representation may take the form of a list of pairs of sender/recipient email addresses.

The board therefore considers that the list of sender/recipient email addresses maintained by the "auto-white-listing" technique falls within the scope of the "electronic graph representation" of claim 1.

4.6 The subject-matter of claim 1 therefore differs from the known email filtering method in that:

- the electronic graph representation is provided "in a data base";

- an "electronic indicator" is assigned to an email identified as being potentially abusive; and

- the electronic mails constituting the "electronic mail exchange history" are "handled by at least one node provided in the electronic mail system".

4.7 In the board's judgment, these differences are obvious implementation details. The list of email addresses has to be kept in a data store, thus forming a "data base". The "electronic indicator" is essentially an internal flag for keeping track of whether an analysed email is to be filtered or not, and the use of flags for keeping track of properties of data objects is well known in the art. Finally, it is an obvious possibility that the emails from which the white list of sender/recipient email addresses is derived are emails that have been handled by a node of the email system.

The appellant did not offer any arguments with respect to these features.

4.8 Hence, the subject-matter of claim 1 of the main request lacks inventive step (Articles 52(1) and 56 EPC).

5. First auxiliary request - basis in the application

5.1 Compared with claim 1 of the main request, claim 1 of the first auxiliary request adds the following features:

- the sender and recipient information assigned to the vertices of the electronic graph representation comprises sender and recipient addresses,

- wherein the sender and recipient addresses are hashed;

- the directed edges of the electronic graph representation originate from a vertex assigned to the sender address and end at a vertex assigned to the recipient address; and

- the weight of an edge is the number of emails between the two nodes of the graph representation assigned to the sender and recipient address.

In addition, the wording discussed in points 3.2 and 3.3 above has been clarified.

5.2 The feature specifying that the email addresses in the graph database are hashed is disclosed in paragraph [0034] of the published application. The feature relating to the weight of an edge is based on paragraphs [0036] and [0044]. The remaining added features are based on original dependent claims 4 and 6.

5.3 Dependent claims 2 and 3 are based on original dependent claims 8 and 9.

5.4 Independent apparatus claim 4 is based on original independent apparatus claim 10 with amendments corresponding to those made to the independent method claim.

5.5 Dependent claims 5, 6 and 7 are based on original dependent claims 11, 15 and 18.

5.6 The board is therefore satisfied that the first auxiliary request complies with Article 123(2) EPC.

6. First auxiliary request - remittal

6.1 As the application explains in paragraph [0034], the email addresses in the graph database are hashed to make them anonymous while preserving the ability to uniquely identify matching addresses later.

The board is not prepared to accept this technical feature as being notorious knowledge, i.e. as knowledge the existence of which at the priority date cannot reasonably be disputed. Since no documentary search into the state of the art has been carried out so far, an additional search has therefore become necessary (cf. decisions T 1242/04, OJ EPO 2007, 241, reasons 9.2; and T 2467/09 of 17 December 2015, reasons 8 and 9).

6.2 The feature specifying that the electronic graph representation also includes, as the weight of a directed edge, the number of emails sent from a sender address to a recipient address now distinguishes the electronic graph representation from the list of pairs of addresses maintained by the "auto-white-listing" technique. At the oral proceedings, the appellant argued that the electronic graph representation as now claimed provided technical advantages not known from the prior art. Since this amendment was made only at the oral proceedings and the board does not have access to the results of a search into the relevant state of the art at the priority date of the application, the board considers it appropriate to leave the assessment of these arguments to the examining division.

6.3 Hence, the case is to be remitted to the examining division for further prosecution on the basis of the first auxiliary request and in particular for carrying out an additional search.