SYSTEMS AND METHODS FOR RE-EVALUATNG DATA

• US 20090319629A1
• Filed: 06/23/2009
• Published: 12/24/2009
• Est. Priority Date: 06/23/2008
• Status: Abandoned Application

• Current Assignee: Cloudmark Incorporated (Proofpoint Incorporated)
• Original Assignee: Cloudmark Incorporated (Proofpoint Incorporated)
• Inventors: Kaufman, Lev Samuel, Bujak, Michal Adam, Rohellec, Philippe Le, de Guerre, James Allan
• Application Number:
  US12/489,806
• Publication Number:
  US 20090319629A1
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A method and a system re-classify a delivered message to permit an action to be taken on the delivered message, based on the re-classification. In an example embodiment, a mail transfer agent may receive a message directed to a mail store and a message classifier may generate a representation of at least a portion of the message and classify the message using a representation of the message and a characteristic associated with the representation. In some example embodiments, the mail transfer agent may deliver the message to a message store, based on the classification of the message. Subsequent to the mail transfer agent delivering the message to the message store, a message re-classifier may access a further characteristic associated with the representation and re-classify the message based on the representation and the second characteristic. In an example embodiment, the mail transfer agent may initiate performance of an operation on the message in the message store, based on the re-classifying of the message.

Claims

1. A method comprising:

generating a representation of at least a portion of a message;

accessing a first characteristic associated with the representation;

classifying the message using the representation and the first characteristic;

initiating application of a policy rule to the message based on the classifying of the message;

accessing a second characteristic associated with the representation subsequent to the application of the first policy to the message;

re-classifying the message based on the representation and the second characteristic; and

initiating application of a further policy rule to the message, based on the re-classifying of the message.

2. The method of claim 1, further comprising:

causing the representation of at least the portion of the message to be stored; and

removing the stored representation from storage based on a removal parameter, wherein the re-classifying of the message includes re-classifying the message prior to the removing of the stored representation from the storage.

3. The method of claim 2, wherein the removal parameter comprises an interval of time and the removing of the stored representation includes removing the stored representation after the interval of time has expired.

4. The method of claim 1, wherein the re-classifying of the message based on the representation and the second characteristic comprises:

replacing the first characteristic with the second characteristic; and

determining that the replacing of the first characteristic changes the classification of the message.

5. The method of claim 1, wherein the re-classifying of the message includes determining that the second characteristic is associated with the representation.

6. The method of claim 5, wherein the generating of the representation of at least the portion of the message includes generating a hash value that represents the portion of the message, the portion of the message being an attribute of the message;

the second characteristic is received with the hash value; and

the determining that the second characteristic is associated with the representation includes accessing a data structure to determine that the hash value received with the second characteristic corresponds to the hash value that represents the portion of the message.

7. The method of claim 1, wherein the initiating of the application of the further policy rule to the message includes receiving a notification indicating a classification of the re-classified message, and selecting an operation associated with the policy rule to initiate, based on the reclassifying of the message.

8. The method of claim 1, wherein the initiating of the application of the further policy rule includes initiating storage of the message in a message store.

9. The method of claim 8, wherein the initiating of the application of the further policy rule includes initiating performance of an operation on the message in the message store.

10. The method of claim 1, wherein the initiating of the application of the further policy rule to the message includes transmitting, via a network, a signal to a networked machine coupled to a message store to initiate performance of an operation on the message in a message store.

11. The method of claim 10, wherein the signal to the networked machine comprises an interface call and the transmitting of the signal is to trigger the networked machine to at least one of move the message to a storage location in the message store and delete the message from the storage location in the message store.

12. The method of claim 1, wherein the initiating of the application of the further policy rule to the message includes issuing a signal to a local machine to initiate performance of an operation on a message in a message store.

13. The method of claim 12, wherein the issuing of the signal to the local machine is to trigger an application operating on the local machine to at least one of move the message to a storage location in the message store and delete the message from the storage location in the message store.

14. The method of claim 13, wherein the application operating on the local machine is a desktop mail program.

15. A system comprising:

a transfer agent, communicatively coupled to a message store, to process a message directed to the message store;

a message classifier communicatively coupled to the transfer agent, the message classifier to,

generate a representation of at least a portion of the message,

access a first characteristic associated with the representation, and

classify the message using the representation and the first characteristic; and

a message re-classifier communicatively coupled to the transfer agent, the message re-classifier to,

access a second characteristic associated with the representation subsequent to the delivery of the message to the message store, and

re-classify the message based on the representation and the second characteristic,

wherein the transfer agent is to initiate application of a policy rule to the message, based on the classification of the message, and to initiate application of a further policy rule to the message, based on the re-classification of the message,

16. The system of claim 15, further comprising:

a message tracker to cause the representation of at least the portion of the message to be stored in message storage; and

a message removal module to remove the stored representation from message storage based on a removal parameter, wherein the message re-classifier is to re-classify the message prior to the message removal module removing the stored representation.

17. The system of claim 16, wherein the removal parameter is associated with an interval of time, and the message removal module is to remove the stored representation upon an expiration of the interval of time.

18. The system of claim 15, wherein the message re-classifier is to replace the first characteristic with the second characteristic, and determine that the replacement of the first characteristic changes the classification of the message, and re-classify the message further based on that determination.

19. The system of claim 15, wherein the message re-classifier is to determine that the accessed second characteristic is associated with the representation, prior to re-classification of the message.

20. The system of claim 19, wherein the portion of the message includes an attribute of the message and the message classifier is to generate a hash value that represents the attribute of the message, and the message re-classifier is to receive the second characteristic with the hash value, and access storage to determine that the hash value included with the received second characteristic is the hash value that represents the portion of the message.

21. The system of claim 15, wherein the message re-classifier is to provide, to the transfer agent, a notification indicating a new classification of the re-classified message, and the transfer agent is to select an operation to initiate associated with the application of the further policy rule, based on the new classification.

22. The system of claim 15, wherein the transfer agent is to transmit, via a network, a signal directed to a networked machine coupled to a message store to initiate performance of an operation that is associated with application of the further policy rule, on the message in the message store.

23. The system of claim 22, wherein the signal to the networked machine provides an interface call to trigger the networked machine to at least one of move the message to a storage location in the message store and delete the message from the storage location in the message store.

24. The system of claim 15, wherein the transfer agent is to issue a signal directed to a local machine to initiate performance of an operation associated with application of the further policy rule on the message in a message store.

25. The system of claim 24, wherein the signal to the local machine is to cause an application operating on the local machine to at least one of move the message to a storage location in the message store and delete the message from the storage location in the message store.

26. The system of claim 25, wherein the application operating on the local machine is a desktop mail program.

27. A machine-readable medium including instructions that when executed by a machine, cause the machine to perform operations, the operations comprising:

receiving a message;

generating a representation of an attribute of the message;

accessing a first score associated with the representation;

classifying the message using the representation and the first score;

delivering the message to a message store, based on the classifying of the message;

processing a second score associated with the representation subsequent to the delivering of the message to the message store;

re-classifying the message based on the representation and the second score; and

initiating performance of an operation on the message in the message store, based on the re-classifying of the message.

28. The machine-readable medium of claim 27, wherein the re-classifying of the message based on the representation and the second score comprises:

replacing the first score with the second score; and

determining that the replacing of the first score changes the classification of the message.

29. The machine-readable medium of claim 27, wherein the re-classifying of the message includes determining that the received second score is associated with the representation.

30. The machine-readable medium of claim 27, wherein initiating the performance of the operation on the message includes transmitting, via a network, a signal to a networked machine coupled to a message store to initiate the performance of the operation on the message in the message store.

31. The machine-readable medium of claim 27, wherein initiating the performance of the operation includes issuing a signal to a local machine to initiate the performance of the operation on the message in the message store.

32. A system comprising:

generating means for generating a representation of at least a portion of the message;

first accessing means for accessing a first characteristic associated with the representation;

classifying means for classifying the message using the representation and the first characteristic;

first initiating means for initiating application of a policy rule to the message based on the classifying of the message;

second accessing means for accessing a second characteristic associated with the representation subsequent to the classifying of the message;

re-classifying means for re-classifying the message based on the representation and the second characteristic; and

second initiating means for initiating application of a policy rule to the message, based on the re-classifying of the message.