Identification of Content

• US 20100299752A1
• Filed: 12/31/2009
• Published: 11/25/2010
• Est. Priority Date: 12/31/2008
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Yu, Sijie
• Granted Patent: US 8,578,484 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes

Abstract

Systems and methods for identifying content in electronic messages are provided. An electronic message may include certain content. The content is detected and analyzed to identify any metadata. The metadata may include a numerical signature characterizing the content. A thumbprint is generated based on the numerical signature. The thumbprint may then be compared to thumbprints of previously received messages. The comparison allows for classification of the electronic message as spam or not spam.

Claims

1. A method for identifying content in electronic messages, the method comprising:

receiving an electronic message having been classified as spam;

executing instructions stored in memory, wherein execution of the instructions by a processor;

detects content included in the received electronic message,

identifies metadata for the detected content, the metadata including a numerical signature characterizing the content,

identifies at least one variation for the numerical signature, and

generates a thumbprint based on the numerical signature and a thumbprint based on the at least one variation; and

storing the thumbprints in a database in memory, the thumbprints being accessible from the database for comparison to a thumbprint of a subsequently received message, wherein the subsequently received message is classified as spam or not spam based on the comparison.

2. The method of claim 1, wherein the content is an image.

3. The method of claim 2, wherein the numerical signature is a concatenation of a plurality of numbers, each number characterizing an aspect of the image.

4. The method of claim 3, wherein at least one of the numbers characterizes a color of a specified part of the image.

5. The method of claim 3, wherein one or more numbers characterize a size dimension of the image.

6. The method of claim 3, wherein the variation is selected from a predetermined range relative to one of the numbers.

7. The method of claim 6, further comprising rounding the number, wherein the predetermined range is relative to the rounded number.

8. The method of claim 1, wherein generating the thumbprint comprises fuzzy hashing of the signature being thumbprinted.

9. The method of claim 1, further comprising conducting a search for similar content based on one or more of the stored thumbprints.

10. A computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for identifying content in electronic messages, the method comprising:

receiving an electronic message classified as spam;

detecting content included in the received electronic message;

identifying metadata for the detected content, the metadata including a numerical signature characterizing the content;

determining at least one variation for the numerical signature;

generating a thumbprint based on the numerical signature and a thumbprint based on the at least one variation; and

storing the thumbprints in a database, the thumbprints being accessible from the database for comparison to a thumbprint of a subsequently received message, wherein the subsequently received message is classified as spam or not spam based on the comparison.

11. A method for identifying content in electronic messages, the method comprising:

receiving an electronic message; and

executing instructions stored in memory, wherein execution of the instructions by a processor;

detects content included in the received electronic message,

identifies metadata for the detected content, the metadata including a numerical signature characterizing the content,

generates a thumbprint based on the numerical signature of the metadata, and

compares the generated thumbprint to thumbprint information stored in a database storing thumbprint information associated with each of a plurality of content found in electronic messages previously received and classified as spam, wherein the electronic message is classified as spam or not spam based on the comparison.

12. The method of claim 11, wherein the content is an image.

13. The method of claim 12, wherein the numerical signature is a concatenation of a plurality of numbers, each number characterizing an aspect of the image.

14. The method of claim 13, wherein at least one of the numbers characterizes a color of a specified part of the image.

15. The method of claim 13, wherein one or more numbers characterize a size dimension of the image.

16. The method of claim 13, wherein the variation is selected from a predetermined range relative to one of the numbers.

17. The method of claim 16, further comprising rounding the number, wherein the predetermined range is relative to the rounded number.

18. The method of claim 11, wherein generating the thumbprint comprises fuzzy hashing of the signature being thumbprinted.

19. The method of claim 11, further comprising conducting a search for similar content based on one or more of the stored thumbprints.

20. A computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for identifying content in electronic messages, the method comprising:

receiving an electronic message;

detecting content included in the received electronic message;

identifying metadata for the detected content, the metadata including a numerical signature characterizing the content;

generating a thumbprint based on the numerical signature of the metadata; and

comparing the generated thumbprint to thumbprint information stored in a database storing thumbprint information associated with each of a plurality of content found in electronic messages previously received and classified as spam, wherein the electronic message is classified as spam or not spam based on the comparison.

21. A system for identifying content in electronic messages, the system comprising:

a memory configured to store a database of thumbprint information associated with each of a plurality of content found in electronic messages previously received and classified as spam;

an interface configured to receive an electronic message; and

a processor configured to execute instructions stored in memory, wherein execution of the instructions;

detects content included in the received electronic message,

identifies metadata for the detected content, the metadata including a numerical signature characterizing the content,

generates a thumbprint based on the numerical signature of the metadata, and

compares the thumbprint to the thumbprint information stored in the database, wherein the electronic message is classified as spam or not spam based on the comparison.

22. The system of claim 21, wherein storing thumbprint information from one of the previously received and classified electronic messages comprises:

identifying metadata for content detected in the previously received and classified message, the metadata including a numerical signature characterizing the content;

determining at least one variation for the numerical signature; and

generating a thumbprint based on the numerical signature and a thumbprint based on the at least one variation.