Intelligent quarantining for spam prevention
First Claim
1. A computer implemented system that facilitates classifying messages in connection with spam prevention, comprising:
- memory operatively coupled to a processor;
a component that receives a set of the messages;
a first classification component that identifies a subset of the messages as SPAM or flagged for further analysis, and temporarily delays further classification of the subset of messages; and
a second classification component that after a delay period classifies the subset of messages by employing a filter that is updated during the delay period based at least in part on one or more learning techniques that are employed to receive additional data associated with the subset of messages during the determined delay period, the additional data includes data based on an analysis of the subset of messages, the delay period is dynamically determined based in part on at least one of a probability that the set of messages are spam, a time of next filter update, a time of next filter download and a level of uncertainty associated with the subset of messages, the determined delay period is reduced when determined that the subset of messages have been quarantined by one or more server filters,the memory retains at least a portion of at least one of the component, the first classification component or the second classification component.
2 Assignments
0 Petitions
Accused Products
Abstract
The subject invention provides for an intelligent quarantining system and method that facilitates a more robust classification system in connection with spam prevention. The invention involves holding back some messages that appear to be questionable, suspicious, or untrustworthy from classification (as spam or good). In particular, the filter lacks information about these messages and thus classification is temporarily delayed. This provides more time for a filter update to arrive with a more accurate classification. The suspicious messages can be quarantined for a determined time period to allow more data to be collected regarding these messages. A number of factors can be employed to determine whether messages are more likely to be flagged for further analysis. User feedback by way of a feedback loop system can also be utilized to facilitate classification of the messages. After some time period, classification of the messages can be resumed.
-
Citations
41 Claims
-
1. A computer implemented system that facilitates classifying messages in connection with spam prevention, comprising:
-
memory operatively coupled to a processor; a component that receives a set of the messages; a first classification component that identifies a subset of the messages as SPAM or flagged for further analysis, and temporarily delays further classification of the subset of messages; and a second classification component that after a delay period classifies the subset of messages by employing a filter that is updated during the delay period based at least in part on one or more learning techniques that are employed to receive additional data associated with the subset of messages during the determined delay period, the additional data includes data based on an analysis of the subset of messages, the delay period is dynamically determined based in part on at least one of a probability that the set of messages are spam, a time of next filter update, a time of next filter download and a level of uncertainty associated with the subset of messages, the determined delay period is reduced when determined that the subset of messages have been quarantined by one or more server filters, the memory retains at least a portion of at least one of the component, the first classification component or the second classification component. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24)
-
- 25. The system of 1, the first classification component determines length of delay before classification of the subset of messages is performed.
-
27. A server that facilitates classifying messages in connection with spam prevention, comprising:
-
memory operatively coupled to a processor; a component that receives a set of the messages; a first classification component that identifies a subset of the messages as SPAM or flagged for further analysis, and temporarily delays further classification of the subset of messages; and a second classification component that after a delay period classifies the subset of messages by employing a filter that is updated during the delay period based at least in part on one or more learning techniques that are employed to receive additional data associated with the subset of messages during the determined delay period, the additional data includes data based on an analysis of the subset of messages, the delay period is dynamically determined based in part on a time of next filter update, the determined delay period is reduced when determined that the subset of messages have been quarantined by one or more server filters, wherein the memory retains at least a portion of at least one of the component, the first classification component or the second classification component.
-
-
28. An e-mail architecture that facilitates classifying messages in connection with spam prevention, comprising:
-
memory operatively coupled to a processor; a component that receives a set of the messages; a first classification component that identifies a subset of the messages as SPAM or flagged for further analysis, and temporarily delays further classification of the subset of messages; and a second classification component that after a delay period classifies the subset of messages by employing a filter that is updated during the delay period based at least in part on one or more learning techniques that are employed to receive additional data associated with the subset of messages during the determined delay period, the additional data includes data based on an analysis of the subset of messages, the delay period is dynamically determined based in part on a level of uncertainty associated with the subset of messages, the determined delay period is reduced when determined that the subset of messages have been quarantined by one or more server filters, the memory retains at least a portion of at least one of the component, the first classification component or the second classification component.
-
-
29. A computer readable storage medium having stored thereon the components that facilitates classifying messages in connection with spam prevention, comprising:
-
a component that receives a set of the messages; a first classification component that identifies a subset of the messages as SPAM or flagged for further analysis, and temporarily delays further classification of the subset of messages; and a second classification component that after a delay period classifies the subset of messages by employing a filter that is updated during the delay period based at least in part on one or more learning techniques that are employed to receive additional data associated with the subset of messages during the determined delay period, the additional data includes data based on an analysis of the subset of messages, the delay period is dynamically determined based in part on a time of next filter download, the determined delay period is reduced when determined that the subset of messages have been quarantined by one or more server filters.
-
-
30. A method for classifying messages, comprising:
-
receiving a set of messages to classify;
based on lack of sufficient information, temporarily delaying classification on at least a subset of the messages as either spam or good or initially classifying the subset of messages as untrustworthy or suspicious;dynamically determining a delay time period based at least in part upon a probability that the subset of messages are spam; and classifying the untrustworthy or suspicious subset of messages as spam or good after the determined delay period by employing a client filter that is updated during the delay period based at least in part on one or more learning techniques that are employed during the determined delay period to receive additional data associated with the subset of messages, the one or more learning techniques include at least one of monitoring the subset of the messages with respect to at least one of volume per sender or similarities among quarantined messages, or analyzing the subset of the messages for at least one of their content or origination information; and reducing the delay time period associated with the client filter for a message when determined that one or more server filters have quarantined a message for a time period. - View Dependent Claims (31, 32, 33, 34, 35, 36, 37, 38)
-
-
39. A computer executable API stored on a computer readable storage medium that facilitates classifying messages by quarantining, comprising:
-
calculating a spam probability score for incoming messages; quarantining at least a subset of messages based at least in part upon their respective spam probability scores; dynamically recommending a quarantine time based in part on at least one of a probability that the set of messages are spam, a time of next filter update, a time of next filter download or a level of uncertainty associated with the subset of messages; updating one or more spam filters during the quarantine time based at least in part on one or more learning techniques that are employed during the quarantine time to receive additional data associated with the subset of messages; classifying the quarantined subset of messages as good or spam after the quarantine time by employing the one of more updated spam filters; and communicating between server and client that one or more server filters have quarantined a message for a time period so that the one or more client filters reduce quarantine time for the message. - View Dependent Claims (40)
-
-
41. A computer implemented system for classifying messages, comprising:
-
means for receiving a set of messages to classify; means for based on lack of sufficient information, temporarily delaying classification on the set of message as either spam or good or initially classifying the set of message as untrustworthy or suspicious; means for dynamically determining a delay period based in part on at least one of a probability that the set of messages are spam, a time of next filter update, a time of next filter download and a level of uncertainty associated with the set of messages; means for classifying the untrustworthy or suspicious subset of messages as spam or good after the determined delay period based at least in part on one or more learning techniques employed during the determined delay period to receive additional data associated with the subset of messages, the additional data includes message volume; means for creating a sub-filter by employing training data generated by user and system analysis, the sub-filter is trained on one or more features extracted from the untrustworthy or suspicious messages; means for applying the sub-filter to the untrustworthy or suspicious messages to classify the untrustworthy or suspicious messages as good or spam; means for communicating between server and client to determine messages that are quarantined by one or more server filters for a time period; means for reducing the determined delay period for the determined message; and memory operatively coupled to a processor retains at least one of the means.
-
Specification