Apparatus and method for acceleration of electronic message processing through pre-filtering

• US 20060168329A1
• Filed: 11/30/2005
• Published: 07/27/2006
• Est. Priority Date: 11/30/2004
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Sensory Networks, Inc. (Intel Corporation)
• Inventors: Williams, Darren, Gould, Stephen, Cameron, Craig, Tan, Teewoon, Barrie, Robert Matthew
• Application Number:
  US11/291,512
• Publication Number:
  US 20060168329A1
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A classifier of electronic messages includes one or more pre-filters and a filter. Messages classified as spam or legitimate by one or more of the pre-filters bypass the filter. Messages classified as suspicious are further classified by the filter as either spam or legitimate. Messages classified as spam are routed to a spam quarantine storage area. Messages classified as legitimate are routed to a spam delivery area.

Claims

1. A message filtering system comprising:

a first filtering stage configured to receive and classify a message as one of at least first, second or third message types, wherein said message is routed to a first storage area if classified as being of the first type, and wherein said message is routed to a second storage area if classified as being of the second type; and

a second filtering stage configured to receive the message if the message is classified as being of the third type.

2. The message filtering system of claim 1 wherein said message is routed to said first storage area if the second filtering stage classifies said message as being of the first type, and wherein said message is routed to said second storage area if the second filtering stage classifies said message as being of the second type.

3. The message filtering system of claim 1 wherein the speed of first filtering stage is greater than the speed of second filtering stage.

4. The message filtering system of claim 1 wherein the first filtering stage classifies messages by matching rules.

5. The message filtering system of claim 4 wherein said rules comprise literals.

6. The message filtering system of claim 5 wherein a number of said literals is greater than 1,000.

7. The message filtering system of claim 4 wherein said rules comprise regular expressions.

8. The message filtering system of claim 1 wherein said first message type includes legitimate messages and said first storage area is a legitimate message delivery storage.

9. The message filtering system of claim 8 wherein said second message type includes spam messages and said second storage area is a spam message delivery storage.

10. The message filtering system of claim 9 wherein said third message type includes suspicious messages.

11. The message filtering system of claim 10 wherein said second filtering stage is further configured to classify the suspicious messages as either spam messages or legitimate messages.

12. The message filtering system of claim 10 wherein said second filtering stage is further configured to classify the suspicious messages as either spam messages, legitimate messages, or suspicious messages.

13. The message filtering system of claim 12 further comprising:

a third filtering stage configured to receive the suspicious messages from the second filtering stage and classify the received suspicious messages as either spam messages or legitimate messages.

14. A message filtering system comprising:

a first filtering stage configured to receive and classify a message as one of at least legitimate or suspicious message, wherein said received message is routed to a first storage area if classified as being a legitimate message, and

a second filtering stage configured to receive the message if the message is classified as being a suspicious message.

15. The message filtering system of claim 14 wherein said second filtering stage is further configured to classify the suspicious message it receives as either a spam or a legitimate message.

16. The message filtering system of claim 15 wherein said message is routed to said first storage area if the second filtering stage classifies said message as being a legitimate message, and wherein said message is routed to said second storage area if the second filtering stage classifies said message as being a spam message.

17. A message filtering system comprising:

a first filtering stage configured to receive and classify a message as one of at least legitimate or suspicious message, wherein said received message is routed to a first storage area if classified as being a legitimate message;

a second filtering stage configured to receive the suspicious message from the first filtering stage and classify the received suspicious message as a spam message or a suspicious message; and

a third filtering stage configured to receive the suspicious message from the second filtering stage and classify the received suspicious message as a spam message or a legitimate message.

18. A message filtering system comprising:

first and second filtering stages each adapted to receive a message, wherein said first filtering stage generates metadata in response to the received message and supplies the metadata to the second filtering stage, said second filtering stage is further configured to receive said metadata and said message and classify the received message as being one of spam message or legitimate message.

19. A message filtering system comprising:

a first filtering stage configured to receive and modify a message to supply a modified message; and

a second filtering stage configured to receive and classify the modified message as either a spam message or a legitimate message.

20. The system of claim 19 wherein said first filtering stage further comprises:

a security device configured to perform security processing, the security device includes one or more hardware logic, wherein said hardware logic is configured to perform high speed data processing

21. The system of claim 20 wherein said hardware logic is reconfigurable

22. A method of filtering messages, the method comprising:

receiving and classifying a message as one of at least first, second or third message types;

routing said message to a first storage area if the message is classified as being of the first type;

routing said message to a second storage area if the message is classified as being of the second type; and

further classifying the message if the message is previously classified as being of the third type.

23. The method of claim 22 further comprising:

receiving a message previously classified as being of the third type;

classifying said message as one of at least first or second type;

routing said message to a first storage area if the message is classified as being of the first type; and

routing said message to a second storage area if the message is classified as being of the second type.

24. The method of claim 22 wherein the messages are classified by matching rules.

25. The method of claim 24 wherein said matching rules comprise literals.

26. The method of claim 25 wherein a number of said literals is greater than 1,000.

27. The method of claim 24 wherein said matching rules comprise regular expressions.

28. The method of claim 22 wherein said first message type includes legitimate messages and said first storage area is a legitimate message delivery storage.

29. The method of claim 22 wherein said second message type includes spam messages and said second storage area is a spam message delivery storage.

30. The method of claim 29 wherein said third message type includes suspicious messages.

31. The method of claim 30 wherein said suspicious messages are further classified as either spam messages or legitimate messages.

32. The method of claim 22 further comprising:

receiving a message previously classified as being of the third type;

classifying said message as one of at least first, second or third type;

routing said message to a first storage area if the message is classified as being of the first type;

routing said message to a second storage area if the message is classified as being of the second type; and

further classifying the message if the-message is previously classified as being of the third type.

33. A method of filtering messages, the method comprising:

receiving and classifying a message as one of at least first or third message types;

routing said message to a first storage area if the message is classified as being of the first type;

further classifying the message if the message is previously classified as being of the third type.

34. The method of claim 33 further comprising:

receiving a message previously classified as being of the third type;

classifying said message as one of at least first or second type;

routing said message to a first storage area if the message is classified as being of the first type; and

routing said message to a second storage area if the message is classified as being of the second type.

35. A method of filtering messages, the method comprising:

receiving and classifying a message as one of at least second or third message types;

routing said message to a second storage area if the message is classified as being of the second type; and

further classifying the message if the message is previously classified as being of the third type.

36. The method of claim 35 further comprising:

receiving a message previously classified as being of the third type;

classifying said message as one of at least first or second type;

routing said message to a first storage area if the message is classified as being of the first type; and

routing said message to a second storage area if the message is classified as being of the second type.

37. A method of filtering messages, the method comprising:

receiving and classifying a message as one of at least first or third message types;

routing said message to a first storage area if the message is classified as being of the first type; and

further classifying the message if the message is previously classified as being of the third type.

38. The method of claim 37 further comprising:

receiving a message previously classified as being of the third type;

classifying said message as one of at least second or third type;

routing said message to a second storage area if the message is classified as being of the second type; and

further classifying the message if the message is previously classified as being of the third type.

39. The method of claim 38 further comprising:

receiving a message previously classified as being of the third type;

classifying said message as one of at least first or second type;

routing said message to a first storage area if the message is classified as being of the first type; and

routing said message to a second storage area if the message is classified as being of the second type.

40. A method of filtering messages, the method comprising:

receiving a message; and

generating metadata in response to said received message.

41. The method of claim 40 further comprising:

receiving a message and metadata;

classifying said message using said metadata as one of at least first or second type;

routing said message to a first storage area if the message is classified as being of the first type; and

routing said message to a second storage area if the message is classified as being of the second type.

42. A method of filtering messages, the method comprising:

receiving a message; and

generating modified message in response to said received message.

43. The method of claim 42 further comprising:

receiving a modified message;

classifying said modified message as one of at least first or second type;

routing said message to a first storage area if the message is classified as being of the first type; and

routing said message to a second storage area if the message is classified as being of the second type.