Incremental anti-spam lookup and update service

• US 20060015561A1
• Filed: 06/29/2004
• Published: 01/19/2006
• Est. Priority Date: 06/29/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hulten, Geoffrey J., Rounthwaite, Robert L., Goodman, Joshua T., Murphy, Elissa E., Hazeur, Derek M.
• Granted Patent: US 7,664,819 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

The present invention provides a unique system and method that facilitates incrementally updating spam filters in near real time or real time. Incremental updates can be generated in part by difference learning. Difference learning involves training a new spam filter based on new data and then looking for the differences between the new spam filter and the existing spam filter. Differences can be determined at least in part by comparing the absolute values of parameter changes (weight changes of a feature between the two filters). Other factors such as frequency of parameters can be employed as well. In addition, available updates with respect to particular features or messages can be looked up using one or more lookup tables or databases. When incremental and/or feature-specific updates are available, they can be downloaded such as by a client for example. Incremental updates can be automatically provided or can be provided by request according to client or server preferences.

Claims

1. An anti-spam update system comprising:

a spam filter trained to distinguish between spam and good messages; and

an update component that incrementally augments or replaces at least a portion of the spam filter with updated information to facilitate spam prevention whereby the update component is built at least in part by using a machine learning component.

2. The system of claim 1, the update component updates at least a data portion of the spam filter.

3. The system of claim 1 runs on at least one of a client or a server.

4. The system of claim 1, the update component is trained using match- or hash-based data.

5. The system of claim 1, further comprising a payment verification component that determines whether a client or server has paid to receive updates before one or more updates are provided to the spam filter.

6. The system of claim 1, the update component provides the updated information to the spam filter via a plurality of IP addresses to mitigate denial-of-service attacks.

7. The system of claim 1, the update component augments or replaces at least a portion of the spam filter that has changed by an amount that satisfies a threshold value.

8. The system of claim 1, the updated information comprises one or more incremental update files corresponding to one or more parameter changes.

9. The system of claim 1, the at least a portion of the spam filter comprises data specific to at least one feature.

10. The system of claim 9, the at least one feature comprises at least one of an IP address and a URL.

11. The system of claim 1, further comprising a component that builds machine learning spam filters having a minimized a number of parameter changes between an existing spam filter and a new filter to facilitate minimizing incremental update sizes.

12. The system of claim 1, the update component sequentially applies a plurality of different updates to the spam filter.

13. The system of claim 1, the update component merges at least a subset of a plurality of updates to improve download efficiency of the updated information.

14. The system of claim 1, the update component selectively provides feature-specific updates in an independent manner such that at least one feature is updated independently of at least one other feature.

15. The system of claim 1, the spam filter comprises a plurality of sub-filters that are trained or updated independently of each other and is decomposable as a result.

16. The system of claim 1, further comprising a quarantining component that delays classification of at least a subset of messages until the spam filter receives the updated information from the update component.

17. An anti-spam query system comprising:

a machine learning spam filter trained to distinguish between spam and good messages; and

a lookup component that receives queries for feature-related information as a message arrives to facilitate updating the spam filter.

18. The system of claim 17, the feature-related information comprises positive and negative data for a plurality of features or messages.

19. The system of claim 17, the feature-related information comprises feature scores and reputation scores for a plurality of features including at least one of IP addresses, URLs, hostnames, character strings, and words.

20. The system of claim 17, the spam filter is discriminatively trained.

21. The system of claim 17, the spam filter is updated at least partially incrementally.

22. The system of claim 17, the spam filter is updated at least partially by the lookup component.

23. The system of claim 17, the lookup component writes incremental lookup queries to file or stores them on disk and combines them in memory.

24. The system of claim 17, the lookup component comprises:

a back-end database that comprises a set of features and associated weights and one or more models or filters that are generated during training;

a middle-ware layer that passes communication between the database and a spam filter; and

the spam filter which calls the middle-ware layer at predefined or automatic frequency to obtain the most recent updated model and merges an online model with a locally stored model file.

25. The system of claim 17, the queries comprise requests for incremental updates of information for the spam filter from at least one of a client or a server.

26. The system of claim 17, further comprising an updated spam filter that is propagated from a service provider to an end user in at least two stages, wherein at least one of the stages is automatic such that there is an option for human intervention between the two stages.

27. The system of claim 17, further comprising a component that propagates filter code automatically from the service provider to the end user.

28. The system of claim 17, queries are sent to the lookup component at specified intervals according to an end user or administrator preferences.

29. The system of claim 17, updates to the spam filter take effect without restarting a messaging program.

30. An anti-spam update service comprising:

providing an existing trained spam filter;

training a new spam filter using machine learning;

determining differences between the existing spam filter and the new spam filter; and

incrementally updating the existing spam filter with at least a portion of the differences.

31. The update service of claim 30, the existing spam filter is trained using machine learning.

32. The update service of claim 30, the existing spam filter is currently in use by a messaging program to classify messages as spam or good.

33. The update service of claim 30, the new spam filter is trained on more recent or new data.

34. The update service of claim 30, the differences comprise one or more parameter changes between the existing spam filter and the new spam filter.

35. The update service of claim 30, determining the differences comprises comparing an absolute value of a parameter change to a threshold or heuristic to ascertain whether the change is sufficient to warrant an incremental update of the existing spam filter.

36. The update service of claim 30 is a web-based service.

37. The update service of claim 30, further comprising employing the following operation to build filters which minimize a number of differences:

discriminatively training a first new spam filter using new data;

determining a first set of differences between the first new filter and the existing spam filter that satisfy a threshold or heuristic;

training a second new spam filter using the new data subject to the constraint that the parameter changes between the first new filter and the existing filter that did not satisfy the threshold or heuristic have the same value as they do in the existing filter;

determining a second set of differences between the second new spam filter and the existing spam filter; and

updating the existing spam filter with at least a subset of the second set of differences.

38. The update service of claim 30, further comprising requesting feature-specific updates to the existing spam filter at least in part by searching at least one of lookup tables and databases.

39. The update service of claim 30, wherein incrementally updating the existing spam filter is based at least in part by the distribution of messages that any one of a client, server, or user receives.

40. The update service of claim 30, wherein one or more incremental updates to the existing spam filter are feature-specific such that at least one feature is updated independently of another feature.

41. The update service of claim 38, the lookup tables and databases comprising a plurality of incremental updates corresponding to a plurality of features.

42. An anti-spam update system comprising:

means for providing an existing trained spam filter;

means for training a new spam filter using machine learning;

means for determining differences between the existing spam filter and the new spam filter; and

means for incrementally updating the existing spam filter with at least a portion of the differences.

43. The update system of claim 42, further comprising a means for requesting feature-specific updates to the existing spam filter at least in part by searching at least one of lookup tables and databases.

44. A data packet adapted to be transmitted between two or more computer processes facilitating incremental updates to spam filters, the data packet comprising:

information associated with comparing an existing spam filter to a newly train spam filter;

identifying a plurality of differences between the filters; and

propagating at least a subset of the differences to update the existing spam filter.