Adaptive threshold based spam classification

• US 7,617,285 B1
• Filed: 09/29/2005
• Issued: 11/10/2009
• Est. Priority Date: 09/29/2005
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Hartmann, Al
• Primary Examiner(s): Avellino; Joseph E
• Assistant Examiner(s): SHAW, PETER C
• Application Number:
  US11/238,806
• Time in Patent Office: 1,503 Days
• Field of Search: 709205-207, 709/200, 707/1, 707/10
• US Class Current: 709/206
• CPC Class Codes: G06F 16/353 into predefined classes
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: Y10S 707/99937 Sorting

Abstract

A spam classification manager uses a dynamically adaptive decision threshold for detecting spam email messages. For each of a plurality of time periods, the spam classification manager calculates an adaptive decision threshold to use to adjudicate whether or not received email messages comprise spam. The threshold is based on ratios between clean and spam emails received in previous time periods, as well as a misclassification cost ratio. The spam classification manager determines a likelihood of each incoming email message received during the time period being spam, and adjudicates whether each message in fact comprises spam by comparing the determined likelihood to the threshold. The spam classification manager keeps track of incoming email messages received during the time period adjudicated to be spam and adjudicated to be clean, and uses that information in the calculation of adaptive thresholds for future time periods.

Claims

1. A computer implemented method for using a dynamically adaptive decision threshold for detecting spam during a current time period, the method comprising:

using a computer to perform steps comprising;

calculating an estimated spam email occurrence probability for the current time period according to a statistical time series prediction methodology taking into account a previous ratio between a number of emails received in at least one previous time period adjudicated to be clean using a fixed decision threshold and a number of emails received in at least one previous time period adjudicated to be spam using the fixed decision threshold;

calculating an adaptive decision threshold to use for the current time period to adjudicate whether emails received during the current time period are spam, the adaptive decision threshold being based on a misclassification cost ratio and the estimated spam email occurrence probability;

determining, for each email received during the current time period, a likelihood of the email being spam;

adjudicating whether each email received during the current time period is spam by comparing the determined likelihood of the email received being spam to the adaptive decision threshold;

comparing, for each email received during the current time period, the determined likelihood of the email being spam to the fixed decision threshold to determine a number of emails received in the current time period adjudicated as spam and a number of emails received in the current time period adjudicated as clean; and

calculating a current ratio between the number of emails received in the current time period adjudicated as spam using the fixed decision threshold and the number of emails received in the current time period adjudicated as clean using the fixed decision threshold, the current ratio used to calculate an adaptive decision threshold for a future time period.

2. The method of claim 1 wherein the statistical time series prediction methodology comprises one from a group of statistical time series prediction methodologies consisting of:

calculating an arithmetic moving average based on the previous ratio;

calculating an exponential moving average based on the previous ratio; and

utilizing an auto-regression technique taking into account the previous ratio.

3. The method of claim 1 further comprising:

calculating each time period as a specific duration of time, regardless of how many emails are received therein.

4. The method of claim 1 further comprising:

calculating each time period as an interval in which a specific number of emails are received, regardless of elapsed time.

5. The method of claim 1 wherein determining a likelihood of an email received being spam further comprises:

extracting feature vectors from the email received; and

quantifying a likelihood of whether the email received is spam based on the extracted feature vectors.

6. The method of claim 1 further comprising:

using a dynamic misclassification cost ratio to calculate the adaptive decision threshold for the current time period.

7. The method of claim 6 further comprising:

adjusting the dynamic misclassification cost ratio based upon at least one factor from a group of factors consisting of;

current time;

current day;

current date;

proximity to an event;

a running estimation of importance of prior received email messages;

a level of expectation of important email message traffic; and

user input.

8. A computer readable storage medium containing a computer program product for using a dynamically adaptive decision threshold for detecting spam during a current time period, the computer program product comprising:

program code for performing the following steps;

calculating an estimated spam email occurrence probability for the current time period according to a statistical time series prediction methodology taking into account a previous ratio between a number of emails received in at least one previous time period adjudicated to be clean using a fixed decision threshold and a number of emails received in at least one previous time period adjudicated to be spam using the fixed decision threshold;

calculating an adaptive decision threshold to use for the current time period to adjudicate whether emails received during the current time period are spam, the adaptive decision threshold being based on a misclassification cost ratio and the estimated spam email occurrence probability

determining, for each email received during the current time period, a likelihood of the email being spam;

adjudicating whether each email received during the current time period is spam by comparing the determined likelihood of the email received being spam to the adaptive decision threshold;

comparing, for each email received during the current time period, the determined likelihood of the email being spam to the fixed decision threshold to determine a number of emails received in the current time period adjudicated as spam and a number of emails received in the current time period adjudicated as clean; and

calculating a current ratio between the number of emails received in the current time period adjudicated as spam using the fixed decision threshold and the number of emails received in the current time period adjudicated as clean using the fixed decision threshold, the current ratio used to calculate an adaptive decision threshold for a future time period.

9. The computer program product of claim 8 wherein the statistical time series prediction methodology comprises one from a group of statistical time series prediction methodologies consisting of:

calculating an arithmetic moving average based on the previous ratio;

calculating an exponential moving average based on the previous ratio; and

utilizing an auto-regression technique taking into account the previous ratio.

10. A computer system having a computer readable storage medium having computer program instructions embodied therein for using a dynamically adaptive decision threshold for detecting spam during a current time period, the computer program instructions comprising:

a plurality of software portions configured to perform the following steps;

calculating an estimated spam email occurrence probability for the current time period according to a statistical time series prediction methodology taking into account a previous ratio between a number of emails received in at least one previous time period adjudicated to be clean using a fixed decision threshold and a number of emails received in at least one previous time period adjudicated to be spam using the fixed decision threshold;

calculating an adaptive decision threshold to use for the current time period to adjudicate whether emails received during the current time period are spam, the adaptive decision threshold being based on a misclassification cost ratio and the estimated spam email occurrence probability;

determining, for each email received during the current time period, a likelihood of the email being spam;

adjudicating whether each email received during the current time period is spam by comparing the determined likelihood of the email received being spam to the adaptive decision threshold;

comparing, for each email received during the current time period, the determined likelihood of the email being spam to the fixed decision threshold to determine a number of emails received in the current time period adjudicated as spam and a number of emails received in the current time period adjudicated as clean; and

calculating a current ratio between the number of emails received in the current time period adjudicated as spam using the fixed decision threshold and the number of emails received in the current time period adjudicated as clean using the fixed decision threshold, the current ratio used to calculate an adaptive decision threshold for a future time period.

11. The computer system of claim 10 wherein the statistical time series prediction methodology comprises one from a group of statistical time series prediction methodologies consisting of:

calculating an arithmetic moving average based on the previous ratio;

calculating an exponential moving average based on the previous ratio; and

utilizing an auto-regression technique taking into account the previous ratio.