Diminishing false positive classifications of unsolicited electronic-mail

• US 20060235934A1
• Filed: 06/16/2006
• Published: 10/19/2006
• Est. Priority Date: 02/20/2003
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: MailFrontier Incorporated (SonicWall Holdings Ltd.)
• Inventors: Wilson, Brian K., Koblas, David A., Penzias, Arno A.
• Granted Patent: US 8,271,603 B2
• Time in Patent Office: Days
• US Class Current: 709/207
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method for diminishing false positive classifications of unsolicited electronic-mail is disclosed. An electronic-mail message is received whereby a set of message classifiers are applied the message. One or more signatures indicative of unsolicited electronic-mail based on at least the application of the aforementioned classifiers is generated. The one or more signatures are applied to subsequently incoming electronic-mail messages whereby unsolicited electronic-mail may be more accurately identified and false positive identification of normal electronic-mail messages are reduced.

Claims

1. A method for diminishing false positive classifications of unsolicited electronic-mail, the method comprising:

receiving an electronic-mail message;

applying a set of message classifiers to the electronic-mail message, the set of message classifiers comprising;

at least one rule-based heuristic,

at least one content filter, and

user-generated feedback;

generating one or more signatures indicative of unsolicited electronic-mail based on at least the set of message classifiers applied to the electronic-mail message;

applying the one or more signatures to subsequent incoming electronic-mail messages, wherein unsolicited electronic-mail may be identified and false positive identifications of normal electronic-mail messages are reduced.

2. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1, wherein the rule-based heuristic includes identification of a uniform resource locator.

3. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1, wherein the rule-based heuristic includes identification of a domain name.

4. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1, wherein the rule-based heuristic includes identification of an electronic-mail address.

5. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1, wherein the rule-based heuristic includes identification of an Internet protocol address.

6. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1, wherein the rule-based heuristic includes a identification of a telephone number.

7. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1, wherein the rule-based heuristic includes identification of a physical address.

8. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1, wherein the rule-based heuristic includes identification of a name.

9. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1, wherein the rule-based heuristic includes identification of a stock ticker symbol.

10. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1, wherein the content filter preprocesses the electronic-mail message.

11. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 10, wherein preprocessing the electronic-mail message comprises identifying non-essential information.

12. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 11, wherein the non-essential information comprises spaces, carriage returns, tabs, blank lines, punctuation, hyper-text markup language tags for color, or hyper-text markup language tags for font.

13. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 11, wherein preprocessing the electronic-mail message comprises ignoring non-essential information.

14. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 11, wherein preprocessing the electronic-mail message comprises removing non-essential information.

15. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 11, wherein preprocessing comprises identifying decoy information.

16. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 15, wherein the decoy information comprises decoy electronic-mail addresses, decoy domain names, decoy uniform resource locators, or decoy Internet protocol addresses.

17. A system for diminishing false positive classifications of unsolicited electronic-mail, the system comprising:

a database of signatures, each of the signatures associated with unsolicited electronic-mail to be excluded from an end-user mail client;

an electronic-mail server coupled to a network appliance, the network appliance configured to intercept unsolicited electronic-mail as identified by a signature from the database of signatures prior to receipt of the electronic-mail by the mail server; and

an end-user mail client coupled to the electronic-mail server, the electronic-mail server configured to receive electronic-mail not identified as unsolicited electronic-mail by one or more of the signatures from the database of signatures.

18. The system for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 17, wherein at least one of the signatures from the database of signatures is generated through the application of a set of message classifiers, the set of message classifiers comprising at least one rule-based heuristic, at least one content filter, and user-generated feedback.

19. A computer-readable medium having embodied thereon at least one program, the at least one program being executable by a computer to perform a method for diminishing false positive message classification of unsolicited electronic-mail, the method comprising:

applying a set of message classifiers to an electronic-mail message, the set of message classifiers comprising;

at least one rule-based heuristic,

at least one content filter, and

user-generated feedback;

generating one or more signatures indicative of unsolicited electronic-mail based on at least the set of message classifiers applied to the electronic-mail message;

applying the one or more signatures to subsequent incoming electronic-mail messages, wherein unsolicited electronic-mail may be identified and false positive identifications of normal electronic-mail messages are reduced.