Statistical message classifier

• US 10,044,656 B2
• Filed: 06/03/2016
• Issued: 08/07/2018
• Est. Priority Date: 07/22/2003
• Status: Expired due to Fees

• Current Assignee: SonicWALL US Holdings, Inc. (SonicWall Holdings Ltd.)
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan J., Roy, Scott, Eikenberry, Scott D., Kim, Bryan, Koblas, David A., Wilson, Brian K.
• Primary Examiner(s): Rahman, Shawnchoy
• Application Number:
  US15/173,236
• Publication Number:
  US 20160285805A1
• Time in Patent Office: 795 Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system and method are disclosed for improving a statistical message classifier. A message may be tested with a machine classifier, wherein the machine classifier is capable of making a classification on the message. In the event the message is classifiable by the machine classifier, the statistical message classifier is updated according to the reliable classification made by the machine classifier. The message may also be tested with a first classifier. In the event that the message is not classifiable by the first classifier, it is tested with a second classifier, wherein the second classifier is capable of making a second classification. In the event that the message is classifiable by the second classifier, the statistical message classifier is updated according to the second classification.

Claims

1. A method for filtering messages, the method comprising:

receiving a message over a network communication interface;

executing instructions stored in memory, the instructions being executed by a processor to;

process the received message using one or more reliable classifiers that are associated with a higher level of accuracy than at least one trained classifier from a plurality of available classifiers, wherein the one or more reliable classifiers are associated with a feature count,

classify the received message using the one or more reliable classifiers and the feature count,

track a feature of the classified message based on the classification, wherein the tracked feature and one or more other tracked features are stored in a table and the feature count accounts for a number of times the tracked feature appeared in the classified message, and

process the received message based on the classification, wherein processing of the received message includes blocking the received message when the received message is classified as spam or allowing the received message to be forwarded to a recipient when the message is classified as a good message;

receiving a new indication that the message is spam or good, the new indication regarding a different feature count associated with a different feature;

updating the trained classifier by updating the feature count in accordance with the different feature count in the new indication;

identifying that a subsequently received message is spam based on the updated feature count and a whitelist count, wherein the whitelist count is associated with a number of times that at least one of the feature or the different feature appears in one or more whitelisted messages; and

blocking the subsequently received message based on the subsequently received message being classified as spam in accordance with the updated feature count.

2. The method of claim 1, wherein the one or more reliable classifiers include an adaptive whitelist for classifying non-spam messages.

3. The method of claim 2, wherein the adaptive whitelist for classifying non-spam messages includes known allowable sender addresses.

4. The method of claim 1, wherein the one or more reliable classifiers include a fingerprinting filter that classifies spam messages.

5. The method of claim 1, wherein the one or more reliable classifiers include an image analyzer that classifies pornographic spam messages.

6. The method of claim 1, wherein the one or more reliable classifiers include a probe account that classifies messages with no legitimate user.

7. The method of claim 1, wherein the one or more reliable classifiers include a challenge-response.

8. The method of claim 1, wherein the received message is classified as being good or spam/junk.

9. The method of claim 1, wherein the processing of the received message includes at least one of quarantining the spam message or deleting the spam message when the message has been blocked.

10. The method of claim 1, wherein the one or more features tracked from the classified message includes words, tokens, message identifier, message protocol, address, hypertext, or markup language document (HTML) properties of the classified message.

11. The method of claim 1 further comprising receiving user input regarding the classified message.

12. The method of claim 11, wherein the tracking performed associated with the user input overrides a classification by the one or more reliable classifiers.

13. The method of claim 1, wherein the at least one other classifier from the plurality of available classifiers are also used to further classify the received message when the one or more reliable classifiers are unable to classify the received message.

14. The method of claim 1, wherein information associated with the tracked features of classified messages is used, via a classifier, to classify a received message when the one or more reliable classifiers are unable to classify the received message.

15. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for performing a method for filtering messages, the method comprising:

receiving a message over a network communication interface;

processing the received message using one or more reliable classifiers that are associated with a higher level of accuracy than at least one other classifier from a plurality of available classifiers, wherein the one or more reliable classifiers are associated with a feature count;

classifying the received message using the one or more reliable classifiers and the feature count;

tracking a feature of the classified message based on the classification, wherein the tracked feature and one or more other tracked features are stored in a table and the feature count accounts for a number of times the tracked feature appeared in the classified message;

processing the received message based on the classification, wherein processing of the received message includes blocking the received message when the received message is classified as spam or allowing the received message to be forwarded to a recipient when the message is classified as a good message;

receiving a new indication that the message is spam or good, the new indication regarding a different feature count associated with a different feature;

updating the trained classifier by updating the feature count in accordance with the different feature count in the new indication;

identifying that a subsequently received message is spam based on the updated feature count and a whitelist count, wherein the whitelist count is associated with a number of times that at least one of the feature or the different feature appears in one or more whitelisted messages; and

blocking the subsequently received message based on the subsequently received message being classified as spam in accordance with the updated feature count.

16. The non-transitory computer-readable storage medium of claim 15, wherein the one or more reliable classifiers include an adaptive whitelist for classifying non-spam messages.

17. The non-transitory computer-readable storage medium of claim 16, wherein the adaptive whitelist for classifying non-spam messages includes known allowable sender addresses.

18. The non-transitory computer-readable storage medium of claim 15, wherein the one or more reliable classifiers include a fingerprinting filter that classifies spam messages.

19. The non-transitory computer-readable storage medium of claim 15, wherein the one or more reliable classifiers include an image analyze that classifies pornographic spam messages.

20. An apparatus for filtering received message, the apparatus comprising:

a processor that executes instructions out of the memory to;

process the received message using one or more reliable classifiers that are associated with a higher level of accuracy than at least one trained classifier from a plurality of available classifiers, wherein the one or more reliable classifiers are associated with a feature count,

classify the received message using the one or more reliable classifiers and the feature count,

track a feature of the classified message based on the classification, wherein the tracked feature and one or more other tracked features are stored in a table and the feature count accounts for a number of times the tracked feature appeared in the classified message, and

process the received message based on the classification, wherein processing of the received message includes blocking the received message when the received message is classified as spam or allowing the received message to be forwarded to a recipient when the message is classified as a good message;

a network interface that receives a new indication that the message is spam or good, the new indication regarding a different feature count associated with a different feature; and

memory that stores an update to the trained classifier, wherein the feature count is updated in accordance with the different feature count in the new indication, and

wherein the processor identifies that a subsequently received message is spam based on the updated feature count and on a whitelist count, the whitelist count is associated with a number of times that at least one of the feature or the different feature appears in one or more whitelisted messages, and the processor blocks the subsequently received message based on the subsequently received message being classified as spam in accordance with the updated feature count.