Origination/destination features and lists for spam prevention

• US 7,272,853 B2
• Filed: 06/04/2003
• Issued: 09/18/2007
• Est. Priority Date: 06/04/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gwozdz, Daniel, Rounthwaite, Robert L., Goodman, Joshua T., Mehr, John D., Starbuck, Bryan T., Rupersburg, Micah C., Howell, Nathan D.
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US10/454,168
• Publication Number:
  US 20050022008A1
• Time in Patent Office: 1,567 Days
• Field of Search: 726/11, 726/13, 726/22, 726/26
• US Class Current: 726/13
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

The present invention involves a system and method that facilitate extracting data from messages for spam filtering. The extracted data can be in the form of features, which can be employed in connection with machine learning systems to build improved filters. Data associated with origination information as well as other information embedded in the body of the message that allows a recipient of the message to contact and/or respond to the sender of the message call be extracted as features. The features, or a subset thereof, can be normalized and/or deobfuscated prior to being employed as features of the machine learning systems. The (deobfuscated) features can be employed to populate a plurality of feature lists that facilitate spam detection and prevention. Exemplary features include an email address, an IP address, a URL, an embedded image pointing to a URL, and/or portions thereof.

Claims

1. A system implemented on one or more computers that facilitates extracting data in connection with spam processing, comprising:

a component implemented on one or more processors that receives an item and extracts a set of features associated with an origination of a message or part thereof and/or information that enables an intended recipient to contact, respond or receive in connection with the message, wherein the set of features comprises a host name and a domain name;

and a component that employs a subset of the extracted features in connection with building a filter, wherein the filter is at least one of stored on a computer readable storage medium, displayed on a display device, or employed by a component executing on one or more processors.

2. The system of claim 1, further comprising a normalization component that deobfuscates a subset of the features.

3. The system of claim 1, the filter being a spam filter.

4. The system of claim 1, the filter being a parental control filter.

5. The system of claim 1, further comprising a machine learning system component that employs the features to learn at least one of spam or non-spam.

6. The system of claim 1, the subset of features comprising at least one IP address, the at least one IP address being at least a portion of any one of a reply-to address, a carbon copy address, a mail-to address, a received-from address, or a URL located in the message.

7. The system of claim 6, the IP address comprising a block ID, wherein the block ID can be extracted as at least one feature.

8. The system of claim 7, wherein the block ID is determined at least in part by consulting a block directory.

9. The system of claim 8, wherein the block directory is arin.net.

10. The system of claim 7, wherein the block ID is determined at least in part by guessing, thereby extracting as features any one of at least a first 1 bit, at least a first 2 bits, at least a first 3 bits, and up to at least a first 31 bits of the IP address.

11. The system of claim 1, wherein the subset of features comprises each of a first 1 up to a first 31 bits of an IP address.

12. The system of claim 1, the subset of features comprising a URL.

13. The system of claim 12, wherein the URL address is located in at least one of a body of the message, embedded as text in the message, or embedded in an image in the message.

14. The system of claim 1, further comprising a component that employs at least a subset of the extracted features to populate at least one feature list.

15. The system of claim 14, the at least one feature list is any one of a list of good users, a list of spammers, a list of positive features indicating legitimate sender, or a list of features indicating spam.

16. The system of claim 1, wherein the subset of features comprises at least one URL.

17. The system of claim 16, wherein the URL is embedded as text in a body of the message.

18. The system of claim 16, wherein the URL is at least a portion of a link in a body of the message.

19. The system of claim 16, wherein the URL is at least a portion of a link embedded as an image in a message.

20. The system of claim 1, the subset of features comprising at least one of a host name or a domain name extracted from an email address.

21. The system of claim 1, the subset of features comprising at least a portion of an FQDN extracted from any one of an email address and a URL.

22. The system of claim 1, the subset of features comprising at least a portion of a domain name extracted from any one of an email address and a URL.

23. The system of claim 1, wherein at least a portion of the subset of the extracted features are normalized prior to be used in connection with a machine learning system.

24. The system of claim 1, wherein at least a portion of the subset of the extracted features are normalized prior to be used to populate at least one feature list.

25. The system of claim 1, further comprising a classification component that classifies at least a portion of at least one of a URL, an email address, and an IP address as any one of adult, adult-content, unsuitable, unsuitable for some ages, suitable for all ages, inappropriate, or appropriate.

26. The system of claim 25, wherein the classification component is a parental control system.

27. The system of claim 25, wherein the classification component assigns at least one feature type to the classified portion of at least one of the URL, the website address, or the IP address.

28. The system of claim 1, wherein the set of features comprises at least one non-toll free telephone number, the telephone number comprising an area code to facilitate mapping a geographic location of a sender or contact associated with the message.

29. A computer readable medium storing computer executable components of claim 1.

30. A method that facilitates extracting data in connection with spam processing, comprising:

receiving a message;

extracting a set of features associated with an origination of the message or part thereof and/or information that enables an intended recipient to contact, respond or receive in connection with the message, wherein the set of features comprises at least a portion of an IP address;

wherein extracting at least a portion of the IP address comprises performing at least one of consulting a block ID directory to determine at least one block ID corresponding to the IP address such that the block ID is extracted as an additional feature or extracting each of at least a first 1 bit up to a first 31 bits from the IP address; and

employing a subset of the extracted features in connection with building a filter.

31. The method of claim 30, wherein at least one extracted IP address corresponds to at least one server.

32. The method of claim 31, further comprising extracting the at least one server as an additional feature.

33. The method of claim 30, further comprising deobfuscating at least a subset of the features extracted from the message.

34. The method of claim 30, further comprising deobfuscating at least a portion of at least one feature extracted from the message.

35. The method of claim 34, wherein deobfuscating a received-from IP address extracted from the message comprises tracing back through a plurality of appended-to IP addresses to verify the appended-to IP addresses identity.

36. The method of claim 34, further comprising extracting additional features from a website address comprises performing at least one of the following acts:

removing at least one suffix at a time thereby yielding respective additional features;

or

removing at least one prefix at a time, thereby yielding respective additional features.

37. The method of claim 34, wherein the set of features comprise at least a portion of any one of a reply-to address, a carbon copy address, a mail-to address, a URL, a link, or a received-from address.

38. The method of claim 30, wherein at least a subset of the extracted features are embedded as one of text and images in a body of the message.

39. The method of claim 30, wherein the set of features comprises a host name and a domain name.

40. The method of claim 30, farther comprising classifying one or more extracted features and/or portions thereof to indicate any one of suitable and unsuitable content associated with the message and using such classification as an additional feature.

41. The method of claim 30, farther comprising assigning a feature type to the respective extracted features to notify a user of message content based at least in part upon the respective extracted features and using the feature type as an additional feature.

42. The method of claim 41, farther comprising determining that at least one of a feature type and a feature are any one of rare and common and using a rarity and a commonality of a feature as an additional feature.

43. The method of claim 30, wherein the subset of features are employed in connection with building a filter via a machine learning system.

44. The method of claim 30, wherein the filter is a spam filter.

45. The method of claim 30, wherein the filter is a parental control filter.

46. The method of claim 30, farther comprising employing at least a subset of features extracted from the message to populate one or more feature lists.

47. The method of claim 46, wherein feature lists comprise at least one of positive feature lists indicating non-spammers or bad feature lists indicating spammers.

48. The method of claim 30, wherein the extracted features are deobfuscated at least in part prior to being employed as features of a machine learning system.

49. The method of claim 30, wherein the extracted features are deobfuscated at least in part prior to being employed as features to populate feature lists.

50. A system that facilitates extracting data in connection with spam processing, comprising:

a means for receiving a message;

a means for extracting a set of features associated with an origination of the message or part thereof and/or information that enables an intended recipient to contact, respond or receive in connection with the message, wherein the set of features comprises a host name and a domain name; and

a means for employing a subset of the extracted features in connection with building a filter.