Bulk electronic message detection by header similarity analysis

• US 7,555,524 B1
• Filed: 09/16/2004
• Issued: 06/30/2009
• Est. Priority Date: 09/16/2004
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Hartman, Al, Nachenberg, Carey
• Primary Examiner(s): Jacobs; Lashonda T
• Application Number:
  US10/942,395
• Time in Patent Office: 1,748 Days
• Field of Search: 709/206, 709/207, 709/224, 709/225, 709/229, 709/219, 709/203, 709/217
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Methods, apparatuses, and computer-readable media for detecting bulk electronic messages using header similarity analysis. Bulk electronic messages can be detected by parsing (115) header fields of an electronic message; associating (120) at least one constituent unit with each header field defining a set of constituent units for each header field; ascertaining (230) a feature vector for each set of constituent units; forming (240) a collection of feature vectors; and computing (250) an inner product from a set of constituent units from an additional electronic message and the collection of feature vectors from the initial electronic message resulting in a measure of similarity between the initial electronic message and the additional electronic message.

Claims

1. A method for detecting bulk electronic messages, comprising:

parsing, by a computer, header fields of at least one electronic message;

associating, by the computer, at least one constituent unit with each header field to define a set of constituent units for each header field;

ascertaining, by the computer, a feature vector for each set of constituent units;

forming, by the computer, a collection of feature vectors; and

computing, by the computer, an inner product of an additional feature vector from an additional electronic message and the collection of feature vectors to determine similarity of the additional electronic message to the at least one electronic message.

2. The method of claim 1 further comprising the step of concluding bulk electronic messages exist when the inner product reaches a predetermined level.

3. The method of claim 1 further comprising the step of comparing message content of the at least one electronic message with message content of the additional electronic message to determine message content similarity.

4. The method of claim 3 further comprising the step of classifying the at least one electronic message and the additional electronic message as bulk electronic messages when then the inner product and the message content similarity reach a predetermined level.

5. The method of claim 3 wherein the step of comparing comprises examining message payload length.

6. The method of claim 3 wherein the step of comparing comprises examining message content type.

7. A method for detecting bulk electronic messages, comprising:

determining, by a computer, a measure of similarity between headers of at least two electronic messages, wherein determining the measure of similarity between headers comprises;

parsing, by the computer, header fields of the least two electronic messages;

associating, by the computer, at least one constituent unit with each header field to define a set of constituent units for each header field;

ascertaining, by the computer, a feature vector for each set of constituent units;

forming, by the computer, a collection of feature vectors for each electronic message; and

computing, by the computer, an inner product of the collections of feature vectors to determine the measure of similarity between headers;

calculating, by the computer, a measure of similarity between message content of the at least two electronic messages; and

classifying, by the computer, the at least two messages as bulk electronic messages when the measure of similarity between the headers and the measure of similarity between the message content exceed a predetermined level.

8. The method of claim 7, wherein the step of calculating further comprises examining message payload length of the at least two electronic messages.

9. The method of claim 7, wherein the headers of the at least two electronic messages are different, the message content of the at least two electronic messages are different, the measure of similarity between headers indicates an amount of similarity between the headers of the at least two electronic messages and the measure of similarity between message content indicates an amount of similarity between the message content of the at least two electronic messages.

10. At least one computer-readable medium containing computer program instructions for detecting bulk electronic messages, the computer program instructions performing steps comprising:

parsing header fields of at least one electronic message;

associating at least one constituent unit with each header field to define a set of constituent units for each header field;

ascertaining a feature vector for each set of constituent units;

forming a collection of feature vectors; and

computing an inner product of an additional feature vector from an additional electronic message and the collection of feature vectors to determine similarity of the additional electronic message to the at least one electronic message.

11. The at least one computer-readable medium of claim 10 wherein the computer program instructions further perform the step of comparing message content of the at least one electronic message with message content of the additional electronic message to determine message content similarity.

12. An apparatus interposed between a client computer and an electronic message server for detecting bulk electronic messages, the apparatus comprising:

a computer processor;

a computer-readable storage medium storing instructions that when executed by the computer processor configure the processor to;

parse header fields of at least one electronic message;

associate at least one constituent unit with each header field, defining a set of constituent units for each header field;

ascertain a feature vector for each set of constituent units;

form a collection of feature vectors; and

compute an inner product of an additional feature vector from an additional electronic message and the collection of feature vectors to determine similarity of the additional electronic message to the at least one electronic message.

13. The apparatus of claim 12 further comprising instructions that configure the processor to compare message content of the at least one electronic message with message content of the additional electronic message to determine message content similarity.

14. The apparatus of claim 12, further comprising instructions that configure the processor to classify the at least one electronic message and the additional electronic message as bulk electronic messages when then the inner product and message content similarity reach a predetermined level.