Method and system for classifying a message based on canonical equivalent of acceptable items included in the message

• US 7,406,502 B1
• Filed: 07/09/2003
• Issued: 07/29/2008
• Est. Priority Date: 02/20/2003
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan J., Wilson, Brian K., Koblas, David A.
• Primary Examiner(s): DUONG, OANH L
• Application Number:
  US10/616,703
• Time in Patent Office: 1,847 Days
• Field of Search: 709203-207, 709217-219, 709/224, 709/229, 709/246, 726/13, 726/14, 726/4, 726/23
• US Class Current: 709/206
• CPC Class Codes: G06F 16/24558 Binary matching operations
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying all items of a certain type in the message, determining whether each of the items meets a criterion, and in the event that all the items are determined to meet the criterion, determining a classification of the message. The system includes an interface configured to receive the message, a processor coupled to the interface, configured to identify all items of a certain type in the message; determine whether each of the items meets a criterion; and in the event that all the items are determined to meet the criterion, determine a classification of the message.

Claims

1. A method for classifying a message, comprising:

receiving a message, the message including a message body;

parsing the message body to determine whether the message body includes one or more items of a certain type, wherein the one or more items of a certain type may be used to classify the message;

identifying all instances of the items of a certain type for each of the one or more items of a certain type identified during parsing of the message body;

reducing each of the all instances of the items of a certain type for each of the one or more items of a certain type to a canonical equivalent that identifies a group of synonymous words, numbers, symbols, or phrases, and wherein the canonical equivalent represents each of the all instances of items of a certain type regardless of individual format of each of the all instances of items of the certain type;

determining whether the canonical equivalent of each of the all instances of the items of a certain type for each of the one or more items of a certain type meets a criterion, the criterion corresponding to an acceptable item;

classifying the message based on whether the canonical equivalent of each of the all instances of the items of a certain type for each of the one or more items of a certain type are determined to meet the criterion; and

processing the message in accordance with the classification of the message.

2. The method of claim 1, wherein the one or more items of a certain type include a distinguishing property.

3. The method of claim 1, wherein the one or more items of a certain type include a contact point.

4. The method of claim 3, wherein the contact point includes a universal resource locator (URL).

5. The method of claim 3, wherein the contact point includes a phone number.

6. The method of claim 3, wherein the contact point includes an address.

7. The method of claim 1, wherein determining whether the canonical equivalent of each of the all instances of the items of a certain type for each of the one or more items of a certain type meets a criterion further includes computing a signature based on the canonical equivalent.

8. The method of claim 7, wherein determining whether the canonical equivalent of each of the all instances of the items of a certain type for each of the one or more items meets the criterion further includes determining whether the signature exists in a database of acceptable signatures.

9. The method of claim 8, further comprising updating the database of acceptable signatures through a registration process.

10. The method of claim 1, further comprising updating a database of acceptable items through a registration process.

11. The method of claim 10, wherein the registration process includes:

receiving a registration message;

checking a certificate associated with the message, the certificate confirming that the registration message is from an acceptable source;

extracting an item from the message; and

adding an entry derived from the item to the database of acceptable items.

12. The method of claim 1, further comprising updating a database of acceptable items by aggregating user input.

13. The method of claim 12, wherein aggregating user input includes:

extracting an item from a user classified message; and

updating the state of the item based on the user classification.

14. The method of claim 1, further comprising updating a database of acceptable items by post-processing stored messages.

15. The method of claim 1, wherein processing the message in accordance with the classification of the message includes delivering the message to an intended recipient of the message if the message is classified as non-spam.

16. The method of claim 1, wherein processing the message in accordance with the classification of the message includes further analysis of the message if the classification of the message is indeterminate.

17. A system for classifying a message comprising:

an interface coupled to a mail sever, the interface configured to receive the message, the message including a message body;

a processor at the mail server, the processor configured to execute instructions stored in memory for performing the steps of;

parsing the message body to determine whether the message body includes one or more items of a certain type, wherein the one or more items of a certain type may be used to classify the message;

identifying all instances of the items of a certain type for each of the one or more items of a certain type identified during parsing of the message body;

reducing each of the all instances of the items of a certain type for each of the one or more items of a certain type to a canonical equivalent that identifies a group of synonymous words, numbers, symbols, or phrases, and wherein the canonical equivalent represents each of the all instances of items of a certain type regardless of individual format of each of the all instances of items of the certain type;

determining whether the canonical equivalent of each of the all instances of the items of a certain type for each of the one or more items of a certain type meets a criterion, the criterion corresponding to an acceptable item;

classifying the message based on whether the canonical equivalent of each of the all instances of the items of a certain type for each of the one or more items of a certain type are determined to meet the criterion; and

processing the message in accordance with the classification of the message.

18. A computer-readable storage medium having embodied thereon a program, the program being executable by a computer to perform a method for classifying a message, the method comprising:

receiving a message, the message including a message body;

parsing the message body to determine whether the message body includes one or more items of a certain type, wherein the one or more items of a certain type may be used to classify the message; and

identifying all instances of the items of a certain type for each of the one or more items of a certain type identified during parsing of the message body;

reducing each of the all instances of the items of a certain type for each of the one or more items of a certain type to a canonical equivalent that identifies a group of synonymous words, numbers, symbols, or phrases, and wherein the canonical equivalent represents each of the all instances of items of a certain type regardless of individual format of each of the all instances of items of the certain type;

determining whether the canonical equivalent of each of the all instances of the items of a certain type for each of the one or more items of a certain type meets a criterion, the criterion corresponding to an acceptable item;

classifying the message based on whether the canonical equivalent of each of the all instances of the items of a certain type for each of the one or more items of a certain type are determined to meet the criterion; and

processing the message in accordance with the classification of the message.