Message classification using allowed items

• US 7,562,122 B2
• Filed: 10/29/2007
• Issued: 07/14/2009
• Est. Priority Date: 02/20/2003
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan J., Wilson, Brian K., Koblas, David A.
• Primary Examiner(s): DUONG, OANH L
• Application Number:
  US11/927,497
• Publication Number:
  US 20080104185A1
• Time in Patent Office: 624 Days
• Field of Search: 709203-207, 709217-219, 709/224, 709/229, 709/246, 726/2, 726/23, 726/4, 726 13- 14
• US Class Current: 709/206
• CPC Class Codes: G06F 16/24558 Binary matching operations
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying all items of a certain type in the message, determining whether each of the items meets a criterion, and in the event that all the items are determined to meet the criterion, determining a classification of the message. The system includes an interface configured to receive the message, a processor coupled to the interface, configured to identify all items of a certain type in the message; determine whether each of the items meets a criterion; and in the event that all the items are determined to meet the criterion, determine a classification of the message.

Claims

1. A method for classifying an e-mail message, the method comprising:

tracking one or more user designations concerning validity of the e-mail message;

determining a probability of validity based on the tracked user designations concerning the validity of the e-mail message;

determining that the e-mail message includes a valid certificate of authenticity;

identifying from the valid certificate a classification concerning a sender of the e-mail message;

generating one or more signatures based on contact information in the e-mail message;

providing the sender classification and the one or more signatures to a database used to classify a subsequently received e-mail message when the probability exceeds a predetermined threshold; and

removing the sender classification and the one or more signatures from the database when the probability falls below the predetermined threshold.

2. The method of claim 1, further comprising evaluating the e-mail message to determine whether the message is spam.

3. The method of claim 1, further comprising receiving information concerning the e-mail message by intercepting the e-mail message.

4. The method of claim 1, further comprising receiving information concerning the e-mail message by extracting the information from stored e-mail messages.

5. The method of claim 1, wherein determining that the e-mail message includes a valid certificate further comprises receiving a user designation concerning validity of the e-mail message.

6. The method of claim 1, wherein generating one or more signatures further comprises:

determining a canonical equivalent of the contact information; and

generating the one or more signatures based on the canonical equivalent.

7. The method of claim 1, further comprising classifying the subsequently received e-mail message based on a match between contact information in the subsequently received e-mail message and information in the database.

8. The method of claim 1, further comprising customizing the database to a user, wherein customizing the database comprises:

receiving a user designation concerning a subset of the database; and

classifying e-mail messages sent to the user based on information in the designated subset of the database.

9. The method of claim 8, wherein receiving the user designation comprises receiving a criterion from the user concerning e-mail messages in the database and further comprising determining the subset of the database based on the criterion received from the user.

10. The method of claim 1, further comprising filtering the subsequently received message based on the classification of the subsequently received message.

11. An apparatus for classifying an e-mail message, the apparatus comprising:

a memory configured to store a database for classifying e-mail messages;

an interface configured to receive one or more user designations concerning validity of the e-mail message; and

a processor configured to execute software to;

track the one or more user designations concerning validity of the e-mail Message;

determine a probability of validity based on the tracked user designations concerning the validity of the e-mail message;

determine that the e-mail message includes a valid certificate of authenticity;

identify from the valid certificate a classification concerning a sender of the e-mail message;

generate one or more signatures based on contact information in the e-mail message;

provide the sender classification and the one or more signatures to the database stored in the memory when the probability exceeds a predetermined threshold, and

remove the sender classification and the one or more signatures from the database when the probability falls below the predetermined threshold.

12. The apparatus of claim 11, wherein the processor is further configured to execute software to:

determine a canonical equivalent of the contact information; and

generate the one or more signatures based on the canonical equivalent.

13. The apparatus of claim 11, wherein the processor is further configured to customize the database to a user by:

receiving a user designation concerning a subset of the database; and

classifying e-mail messages sent to the user based on information in the designated subset of the database.

14. A computer-readable storage medium, having embodied thereon a program, the program being executable by a processor to perform a method for classifying an e-mail message, the method comprising:

tracking one or more user designations concern validity of the e-mail message;

determining a probability of validity based on the tracked user designations concerning the validity of the e-mail message;

determining that the e-mail message includes a valid certificate of authenticity;

identifying from the valid certificate a classification concerning a sender of the e-mail message;

generating one or more signatures based on contact information in the e-mail message;

providing the sender classification and the one or more signatures to a database used to classify a subsequently received e-mail message when the probability exceeds a predetermined threshold; and

removing the sender classification and the one or more signatures from the database when the probability falls below the predetermined threshold.