USING DISTINGUISHING PROPERTIES TO CLASSIFY MESSAGES

• US 20130275463A1
• Filed: 06/06/2013
• Published: 10/17/2013
• Est. Priority Date: 02/20/2003
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Wilson, Brian K., Koblas, David A., Penzias, Arno A.
• Granted Patent: US 9,189,516 B2
• Time in Patent Office: Days
• US Class Current: 707/769
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying in the message a distinguishing property; generating a signature using the distinguishing property; and comparing the signature to a database of signatures generated by previously classified messages.

Claims

1. A method for classifying messages, the method comprising:

receiving an indication sent by a user over a communication network that an electronic message is spam;

executing instructions stored in memory, wherein execution of the instructions by a processor;

identifies one or more obscure distinguishing features, wherein numerical URLs are converted,

generates a plurality of signatures, each signature based on one or more distinguishing features of the electronic message,

compares the signatures to a list of known domains, wherein matching signatures are excluded, and

compares the remaining signatures for forbidden characters, wherein signature with forbidden characters are excluded; and

storing the remaining signatures in memory for comparison to subsequent electronic messages.

2. The method of claim 1, wherein the numerical URLs include a binary number.

3. The method of claim 1, wherein the numerical URLs include a single 32 bit number.

4. The method of claim 1, wherein the obscure distinguishing features include a numerical IP address.

5. The method of claim 1, further comprising detecting one or more e-mail addresses in the electronic message.

6. The method of claim 1, wherein the matching signatures are associated with decoy e-mail addresses.

7. The method of claim 6, wherein the list of known domains is a whitelist.

8. The method of claim 1, further comprising verifying that the distinguishing properties meet one or more conditions before being used to generate the signatures.

9. The method of claim 7, wherein the one or more conditions include a minimum byte requirement.

10. A system for classifying messages, the system comprising:

a database to store a list of known domains;

a processor to execute instructions; and

a spam blocking client stored in memory and executable by the processor to;

identifies one or more obscure distinguishing features of an electronic message sent over a communication network by a user that indicates that the electronic message is spam, wherein numerical URLs are converted,

generates a plurality of signatures, each signature based on one or more distinguishing features of the electronic message,

compares the signatures to a list of known domains, wherein matching signatures are excluded, and

compares the remaining signatures for forbidden characters, wherein signature with forbidden characters are excluded; and

storing the remaining signatures in memory for comparison to subsequent electronic messages.

11. The system of claim 10, wherein the numerical URLs include a binary number.

12. The system of claim 10, wherein the numerical URLs include a single 32 bit number.

13. The system of claim 10, wherein the obscure distinguishing features include a numerical IP address.

14. The system of claim 10, further comprising detecting one or more e-mail addresses in the electronic message.

15. The system of claim 10, wherein the matching signatures are associated with decoy e-mail addresses.

16. The system of claim 15, wherein the list of known domains is a whitelist.

17. The system of claim 10, further comprising verifying that the distinguishing properties meet one or more conditions before being used to generate the signatures.

18. The system of claim 17, wherein the one or more conditions include a minimum byte requirement.

19. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for classifying messages, the method comprising:

receiving an indication sent by a user that an electronic message is spam;

identifying one or more obscure distinguishing features, wherein numerical URLs are converted;

generating a plurality of signatures, each signature based on one or more distinguishing features of the electronic message;

comparing the signatures to a list of known domains, wherein matching signatures are excluded;

comparing the remaining signatures for forbidden characters, wherein signature with forbidden characters are excluded; and

storing the remaining signatures for comparison to subsequent electronic messages.