System and method for identifying and filtering junk e-mail messages or spam based on URL content

• US 20050015626A1
• Filed: 07/09/2004
• Published: 01/20/2005
• Est. Priority Date: 07/15/2003
• Status: Abandoned Application

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Chasin, C. Scott
• Application Number:
  US10/888,370
• Publication Number:
  US 20050015626A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload

Abstract

A method for identifying e-mail messages as being unwanted junk or spam. The method includes receiving an e-mail message and then identifying contact and link data, such as URL information, within the content of the received e-mail message. A blacklist including contact information and/or link information previously associated with spam is accessed, and the e-mail message is determined to be spam or to likely be spam based on the contents of the blacklist. The contact or link data from the received e-mail is compared to similar information in the blacklist to find a match, such as by comparing URL information from e-mail content with URLs found previously in spam. If a match is not identified, the URL information from the e-mail message is processed to classify the URL as spam or “bad.” The content indicated by the URL information is accessed and spam classifiers or statistical tools are applied.

Claims

1. A method for identifying e-mail messages received over a digital communications network as unwanted junk e-mail or spam, comprising:

receiving an e-mail message;

identifying at least one of contact data and link data within content of the received e-mail message;

accessing a blacklist comprising at least one of contact information and link information associated with previously-identified spam; and

determining whether the received e-mail message is spam based on the accessing.

2. The method of claim 1, wherein the link data comprises Uniform Resource Locator (URL) information and the link information in the blacklist comprises URL information retrieved from the previously-identified spam.

3. The method of claim 2, wherein the accessing comprises comparing at least a portion of the URL information from the received e-mail message with the URL information in the blacklist to identify a match and wherein the received e-mail message is identified as spam in the determining based on the identified match.

4. The method of claim 2, further comprising determining in the accessing that the URL information in the received message is not in the URL information in the blacklist and then, processing the URL information in the received message to determine whether the received message is spam.

5. The method of claim 4, further comprising processing content in the received message by applying a spam classifier or spam statistical tool to create a confidence level associated with spam for the content of the received message.

6. The method of claim 2, further comprising accessing content linked by the URL information in the received message, processing the linked content to determine whether the linked content is spam, and reporting the results of the processing of the linked content for use in the spam determining.

7. The method of claim 1, wherein contact data comprises a telephone number, an e-mail address, a physical mailing address, or a name.

8. A computer-based method for identifying e-mail messages as spam based on Uniform Resource Locators (URLs) within the content of the messages, comprising:

providing a list of URLs determined to be related to unwanted e-mail messages or spam sponsored content;

receiving a query associated with an e-mail message, the query comprising URL information;

comparing at least a portion of the URL information in the query to the list of URLs; and

reporting a result of the comparing for use in identifying the e-mail message as spam.

9. The method of claim 8, wherein the result comprises a URL score or a content confidence level.

10. The method of claim 8, wherein the comparing determines the URL information is not in the list of URLs and further comprising performing additional spam processing comprising analyzing the URL information to classify the URL information in the e-mail message based on a likelihood that the URL information is linked to spam content.

11. The method of claim 8, wherein the comparing determines the URL information is not in the list of URLs, and further comprising processing content accessible with the URL information to determine whether the URL-linked content is spam, the reporting including the determination of the processing in the reported result.

12. A method for providing a set of Uniform Resource Locators (URLs) for use in determining whether a received e-mail message is unwanted junk or spam, comprising:

accessing a plurality of e-mail messages identified as spam;

processing content of the e-mail messages to identify one or more URLs;

determining whether the identified URLs are spam-related; and

in memory, storing a bad URL file comprising the URLs determined to be spam-related.

13. The method of claim 12, further comprising providing access to the bad URL file to a system receiving e-mail messages.

14. The method of claim 12, wherein the determining comprises accessing content linked by the identified URLs and performing a spam classification of the linked content.

15. The method of claim 14, wherein the spam classification performing comprises applying one or more spam classifiers or statistical tools to the linked content to generate a spam confidence level.

16. The method of claim 15, wherein the determining comprises comparing the spam confidence level with a preset minimum confidence level and the storing comprises storing the spam confidence level.

17. The method of claim 12, wherein the determining comprises processing the URLs to generate a score and comparing the score to a preset minimum URL score and wherein the storing comprises storing the URL scores.