Using distinguishing properties to classify messages

• US 10,042,919 B2
• Filed: 12/20/2016
• Issued: 08/07/2018
• Est. Priority Date: 02/20/2003
• Status: Expired due to Fees

• Current Assignee: SonicWALL US Holdings, Inc. (SonicWall Holdings Ltd.)
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Wilson, Brian K., Koblas, David A., Penzias, Arno A.
• Primary Examiner(s): NGUYEN, THU HA T
• Application Number:
  US15/385,399
• Publication Number:
  US 20170103120A1
• Time in Patent Office: 595 Days
• Field of Search: 709203, 709206, 709207
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying in the message a distinguishing property; generating a signature using the distinguishing property; and comparing the signature to a database of signatures generated by previously classified messages.

Claims

1. A method for identifying spam messages, the method comprising:

receiving a message over a communication network interface;

receiving one or more indications from one or more user devices indicating that the message includes spam;

executing instructions stored in memory, wherein execution of the instructions by a processor;

scans the received electronic message to identify that the message includes one or more candidate distinguishing properties, wherein the scan further checks that required characters are present in at least one of the candidate distinguishing properties and that forbidden characters are not present in the at least one candidate distinguishing property,

identifies that the received message is a spam message based on the one or more indications received from the one or more user devices indicating that the received message includes the spam, and

generates a signature from the at least one candidate distinguishing property;

storing the generated signature in a database storing a plurality of signatures each associated with the spam;

receiving a subsequent message; and

identifying that the subsequent message includes the spam based on a signature of the subsequent message matching the generated signature stored in the database.

2. The method of claim 1, further comprising placing the subsequent message in a spam folder based on the identification that the subsequent message includes the spam.

3. The method of claim 1, further comprising quarantining the subsequent message based on the identification that the subsequent message includes the spam.

4. The method of claim 1, wherein the at least one candidate distinguishing property includes at least one of an email address, a universal resource locator (URL), a domain name, an address, contact information, a stock ticker symbol, a task instruction, and an (IP) internet protocol address.

5. The method of claim 1, wherein generating a signature from the at least one candidate distinguishing property comprises applying a hash function to the at least one candidate distinguishing property.

6. The method of claim 1, wherein the one or more received indications from the one or more user devices are based on user input indicating that the message includes the spam.

7. The method of claim 1, wherein the scan does not detect presence of other required characters or detects a presence of forbidden characters in at least one other of the candidate distinguishing properties, and wherein the at least one other candidate distinguishing property is excluded from the database of distinguishing properties.

8. The method of claim 1, wherein the indication is further associated with a spam count that is incremented each time another indication identifies a message including the signature.

9. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for performing a method for identifying spam messages, the method comprising:

receiving a message over a communication network interface;

receiving one or more indications from one or more user devices indicating that the message includes spam;

scanning the received electronic message to identify that the message includes one or more candidate distinguishing properties, wherein the scan checks that required characters are present in at least one of the candidate distinguishing properties and that forbidden characters are not present in the at least one candidate distinguishing property,

identifying that the received message is a spam message based on the one or more indications received from the one or more user devices indicating that the message includes the spam,

generating a signature from the at least one candidate distinguishing property;

storing the generated signature in a database storing a plurality of signatures each associated with the spam;

receiving a subsequent message; and

identifying that the subsequent message includes the spam based on a signature of the subsequent message matching the generated signature stored in the database.

10. The non-transitory computer-readable storage medium of claim 9, wherein the program further comprises instructions executable to place the subsequent message in a spam folder based on the identification that the subsequent message includes the spam.

11. The non-transitory computer-readable storage medium of claim 9, wherein the program further comprises instructions executable to quarantine the subsequent message based on the identification that the subsequent message includes the spam.

12. The non-transitory computer-readable storage medium of claim 9, wherein the at least one candidate distinguishing property includes at least one of an email address, a universal resource locator (URL), a domain name, an address, contact information, a stock ticker symbol, a task instruction, and an (IP) internet protocol address.

13. The non-transitory computer-readable storage medium of claim 9, wherein generating a signature from the at least one candidate distinguishing property comprises applying a hash function to the at least one candidate distinguishing property.

14. The non-transitory computer-readable storage medium of claim 9, wherein the one or more received indications from the one or more user devices are based on user input indicating that the message includes the spam.

15. The non-transitory computer-readable storage medium of claim 9, wherein the scan does not detect presence of other required characters or detects a presence of forbidden characters in at least one other of the candidate distinguishing properties, and wherein the at least one other candidate distinguishing property is excluded from the database of distinguishing properties.

16. The non-transitory computer-readable storage medium of claim 9, wherein the indication is further associated with a spam count that is incremented each time another indication identifies a message including the signature.

17. An apparatus for identifying spam messages, the apparatus comprising:

a network interface that receives a message and one or more indications from one or more user devices indicating that message includes spam;

a memory that stores a database of a plurality of signatures each associated with spam; and

a processor executing instructions stored in memory, wherein execution of the instructions by the processor;

scans the received electronic message to identify that the message includes one or more candidate distinguishing properties, wherein the scan checks that required characters are present in at least one of the candidate distinguishing properties and that forbidden characters are not present in the at least one of the candidate distinguishing property,

identifies that the received message is a spam message based on the one or more indications received from the one or more user devices indicating that the message includes the spam,

generates a signature from the at least one of the candidate distinguishing property, wherein the generated signature is stored in the database, and

identifies that a subsequent message includes the spam based on a signature of the subsequent message matching the generated signature stored in the database.

18. The apparatus of claim 17, wherein the processor executes further instructions to place the subsequent message in a spam folder based on the identification that the subsequent message includes the spam.

19. The apparatus of claim 17, wherein the processor executes further instructions to quarantine the subsequent message based on the identification that the subsequent message includes the spam.

20. The apparatus of claim 17, wherein the at least one candidate distinguishing property includes at least one of an email address, a universal resource locator (URL), a domain name, an address, contact information, a stock ticker symbol, a task instruction, and an (IP) internet protocol address.