Comprehensive anti-spam system, method, and computer program product for filtering unwanted e-mail messages

• US 6,732,157 B1
• Filed: 12/13/2002
• Issued: 05/04/2004
• Est. Priority Date: 12/13/2002
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Ekle, Thor Ivar, Gordon, Bryson P.
• Primary Examiner(s): Thompson, Marc D.
• Application Number:
  US10/318,619
• Time in Patent Office: 508 Days
• Field of Search: 709/206, 709/238, 345/748, 707/10, 707/3, 707/6, 707/7, 707/5
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: Y10S 707/99936 Pattern matching access

Abstract

A system, method and computer program product are provided for filtering unwanted electronic mail messages. After receiving electronic mail messages, the electronic mail messages that are unwanted are filtered utilizing a combination of techniques including: compound filters, paragraph hashing, and Bayes rules. The electronic mail messages that are filtered as being unwanted are then categorized.

Claims

1. A method for filtering unwanted electronic mail messages, comprising:

receiving electronic mail messages;

filtering the electronic mail messages that are unwanted utilizing;

compound filters,

paragraph hashing by hashing a plurality of paragraphs and utilizing a database of hashes of paragraphs, wherein the paragraph hashing excludes at least one of a first paragraph and a last paragraph of content of the electronic mail messages wherein a plurality of hashes each has a level associated therewith, and the hashes having a higher level associated therewith are applied to the electronic mail messages prior to the hashes having a lower level associated therewith, and

Bayes rules; and

categorizing the electronic mail messages that are filtered as being unwanted;

wherein the utilization of the Bayes rules includes identifying words of the electronic mail messages;

wherein the utilization of the Bayes rules further includes identifying a probability associated with each of the words;

wherein the probability associated with each of the words is identified using a Bayes rules database;

wherein the electronic mail messages are filtered as being unwanted based on a comparison involving the probability and a Bayes rules threshold;

wherein the threshold is user-defined.

2. The method as recited in claim 1, wherein the compound filters utilize Boolean logic.

3. The method as recited in claim 1, wherein the compound filters utilize conditional logic.

4. The method as recited in claim 1, wherein the compound filters each have a level associated therewith.

5. The method as recited in claim 4, wherein the compound filters having a higher level associated therewith are applied to the electronic mail messages prior to the compound filters having a lower level associated therewith.

6. The method as recited in claim 1, and further comprising normalizing content of the electronic mail messages prior to utilizing the paragraph hashing.

7. The method as recited in claim 6, wherein the normalizing includes at least one of removing punctuation of the content, normalizing a font of the content, and normalizing a case of the content.

8. The method as recited in claim 1, wherein the paragraph hashing utilizes an MD5 algorithm.

9. The method as recited in claim 1, wherein the electronic mail messages are filtered as being unwanted upon results of the paragraph hashing matching that of known unwanted electronic mail messages.

10. The method as recited in claim 1, wherein the utilization of the Bayes rules occurs after the utilization of the compound filters and the paragraph hashing.

11. The method as recited in claim 1, wherein the-electronic mail messages that are filtered as being unwanted are categorized in a plurality of categories.

12. The method as recited in claim 11, wherein the categories are selected from the group consisting of pornographic, violent, and language.

13. The method as recited in claim 1, wherein electronic mail messages that are not filtered are displayed via an electronic mail message manager.

14. A computer program product for filtering unwanted electronic mail messages, comprising:

computer code for receiving electronic mail messages;

computer code for filtering the electronic mail messages that are unwanted utilizing;

compound filters,

paragraph hashing by hashing a plurality of paragraphs and utilizing a database of hashes of paragraphs, wherein the paragraph hashing excludes at least one of a first paragraph and a last paragraph of content of the electronic mail messages, wherein a plurality of hashes each has a level associated therewith, and the hashes having a higher level associated therewith are applied to the electronic mail messages prior to the hashes having a lower level associated therewith, and

Bayes rules; and

computer code for categorizing the electronic mail messages that are filtered as being unwanted;

wherein the utilization of the Bayes rules includes identifying words of the electronic mail messages;

wherein the utilization of the Bayes rules further includes identifying a probability associated with each of the words;

wherein the probability associated with each of the words is identified using a Bayes rules database;

wherein the electronic mail messages are filtered as being unwanted based on a comparison involving the probability and a Bayes rules threshold;

wherein the threshold is user-defined.

15. A system for filtering unwanted electronic mail messages, comprising:

means for;

receiving electronic mail messages;

filtering the electronic mail messages that are unwanted utilizing;

compound filters,

paragraph hashing by hashing a plurality of paragraphs and utilizing a database of hashes of paragraphs, wherein the paragraph hashing excludes at least one of a first paragraph and a last paragraph of content of the electronic mail messages, wherein a plurality of hashes each has a level associated therewith, and the hashes having a higher level associated therewith are applied to the electronic mail messages prior to the hashes having a lower level associated therewith, and

Bayes rules; and

categorizing the electronic mail messages that are filtered as being unwanted;

wherein the utilization of the Bayes rules includes identifying words of the electronic mail messages;

wherein the utilization of the Bayes rules further includes identifying a probability associated with each of the words;

wherein the probability associated with each of the words is identified using a Bayes rules database;

wherein the electronic mail messages are filtered as being unwanted based on a comparison involving the probability and a Bayes rules threshold;

wherein the threshold is user-defined.

16. A system for filtering unwanted electronic mail messages, comprising:

an anti-spain application for receiving electronic mail messages and filtering the electronic mail messages that are unwanted utilizing;

compound filters,

paragraph hashing by hashing a plurality of paragraphs and utilizing a database of hashes of paragraphs, wherein the paragraph hashing excludes at least one of a first paragraph and a last paragraph of content of the electronic mail messages wherein a plurality of hashes each has a level associated therewith, and the hashes having a higher level associated therewith are applied to the electronic mail messages prior to the hashes having a lower level associated therewith, and

Bayes rules; and

wherein the electronic mail messages that are filtered as being unwanted are categorized;

wherein the utilization of the Bayes rules includes identifying words of the electronic mail messages;

wherein the utilization of the Bayes rules further includes identifying a probability associated with each of the words;

wherein the probability associated with each of the words is identified using a Bayes rules database;

wherein the electronic mail messages are filtered as being unwanted based on a comparison involving the probability and a Bayes rules threshold;

wherein the threshold is user-defined.

17. A method for filtering unwanted electronic mail messages, comprising:

(a) applying a first level of compound filters and paragraph hashing to an electronic mail message to filter the electronic mail message if it is unwanted, the paragraph hashing including hashing a plurality of paragraph and utilizing a database of hashes of paragraphs, wherein the paragraph hashing excludes at least one of a first paragraph and a last paragraph of content of the electronic mail messages, wherein a plurality of hashes each has a level associated therewith, and the hashes having a higher level associated therewith are applied to the electronic mail messages prior to the hashes having a lower level associated therewith;

(b) if the electronic mail message has not been filtered as being unwanted and all applicable levels of the compound filters and the paragraph hashing have not been applied, applying a lower level of compound filters and paragraph hashing to the electronic mail message;

(c) repeating (b);

(d) if the electronic mail message is not filtered as being unwanted based on (a)-(c), identifying a user-defined Bayes rule threshold;

(e) utilizing Bayes rules to filter the electronic mail message as being unwanted based on the user-defined Bayes rule threshold; and

(f) if the electronic mail message is filtered as being unwanted, categorizing the filtered electronic mail message.