ORIGINATION/DESTINATION FEATURES AND LISTS FOR SPAM PREVENTION

• US 20070118904A1
• Filed: 01/09/2007
• Published: 05/24/2007
• Est. Priority Date: 06/04/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Rounthwaite, Robert, Gwozdz, Daniel, Mehr, John, Howell, Nathan, Starbuck, Bryan, Goodman, Joshua, Rupersburg, Micah
• Granted Patent: US 7,665,131 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

The present invention involves a system and method that facilitate extracting data from messages for spam filtering. The extracted data can be in the form of features, which can be employed in connection with machine learning systems to build improved filters. Data associated with origination information as well as other information embedded in the body of the message that allows a recipient of the message to contact and/or respond to the sender of the message can be extracted as features. The features, or a subset thereof, can be normalized and/or deobfuscated prior to being employed as features of the machine learning systems. The (deobfuscated) features can be employed to populate a plurality of feature lists that facilitate spam detection and prevention. Exemplary features include an email address, an IP address, a URL, an embedded image pointing to a URL, and/or portions thereof.

Claims

1. A system that facilitates extracting data in connection with spam processing, comprising:

a component that receives an item and extracts a set of features associated with an origination of a message or part thereof and/or information that enables an intended recipient to contact, respond or receive in connection with the message;

and a component that employs a subset of the extracted features in connection with building a filter, wherein the filter determines a probability that the message is spam.

2. The system of claim 1, further comprising a normalization component that deobfuscates a subset of the features.

3. The system of claim 1, further comprising a machine learning system component that employs the deobfuscated features to learn at least one of spam and non-spam.

4. The system of claim 1, the subset of features comprising at least one IP address, the at least one IP address being at least a portion of any one of a reply-to address, a carbon copy address, a mail-to address, a received-from address, and a URL located in the message.

5. The system of claim 4, the IP address comprising a block ID, wherein the block ID can be extracted as at least one feature.

6. The system of claim 5, wherein the block ID is determined at least in part by consulting a block directory.

7. The system of claim 5, wherein the block ID is determined at least in part by guessing, thereby extracting as features any one of at least a first 1 bit, at least a first 2 bits, at least a first 3 bits, and up to at least a first 31 bits of the IP address.

8. The system of claim 1, wherein the subset of features comprises each of a first 1 up to a first 31 bits of an IP address.

9. The system of claim 1, the subset of features comprising a URL.

10. The system of claim 1, further comprising a component that employs at least a subset of the extracted features to populate at least one feature list.

11. The system of claim 10, the at least one feature list is any one of a list of good users, a list of spammers, a list of positive features indicating legitimate sender, or a list of features indicating spam.

12. The system of claim 1, the subset of features comprising at least one of a host name or a domain name extracted from an email address.

13. The system of claim 1, the subset of features comprising at least a portion of an FQDN extracted from any one of an email address and a URL.

14. The system of claim 1, the subset of features comprising at least a portion of a domain name extracted from any one of an email address and a URL.

15. A method that facilitates extracting data in connection with spam processing, comprising:

receiving a message;

extracting a set of features associated with an origination of the message or part thereof and/or information that enables an intended recipient to contact, respond or receive in connection with the message; and

employing a subset of the extracted features in connection with building a filter, wherein the filter determines a probability of the message being spam.

16. The method of claim 15, wherein the set of features comprises website address.

17. The method of claim 16, further comprising extracting additional features from a website address comprises performing at least one of the following acts:

removing at least one suffix at a time thereby yielding respective additional features; and

removing at least one prefix at a time, thereby yielding respective additional features.

18. The method of claim 15, further comprising assigning a feature type to the respective extracted features to notify a user of message content based at least in part upon the respective extracted features and using the feature type as an additional feature.

19. The method of claim 18, further comprising determining that at least one of a feature type and a feature are any one of rare and common and using a rarity and a commonality of a feature as an additional feature.

20. A system that facilitates extracting data in connection with spam processing, comprising:

a means for receiving a message;

a means for extracting a set of features associated with an origination of the message or part thereof and/or information that enables an intended recipient to contact, respond or receive in connection with the message; and

a means for employing a subset of the extracted features in connection with building a filter, wherein the filter determines a probability of the message being spam.