Suppressing spam using a machine learning based spam filter

• US 7,680,886 B1
• Filed: 04/09/2003
• Issued: 03/16/2010
• Est. Priority Date: 04/09/2003
• Status: Expired due to Fees

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Cooley, Shaun P.
• Primary Examiner(s): Srivastava; Vivek
• Assistant Examiner(s): Swearingen; Jeffrey R
• Application Number:
  US10/411,581
• Time in Patent Office: 2,533 Days
• Field of Search: None
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Computer implemented methods, apparati, and computer readable media for suppressing spam entering a computing device. A method embodiment comprises the steps of routing an electronic message leaving the computing device to a machine learning based spam filter defining the message to be clean; and training the filter, with the message being an input to the filter.

Claims

1. A computer implemented method for training a filter to suppress spam entering a computing device of an individual user, said method comprising the steps of:

routing an electronic message written by the individual user and outgoing from the computing device to a machine learning based spam filter, the spam filter used to filter messages entering the computing device;

defining the outgoing message to be clean;

training the filter using the outgoing message wherein the outgoing message is a forwarded message and the filter is trained based on content within the outgoing message written by the individual user;

instructing the filter to process an electronic message incoming to the computing device of the individual user; and

deciding by the filter whether the incoming message is clean or contains suspected spam based on the training of the filter with the outgoing message.

2. The method of claim 1 wherein the electronic message is a message from the group of messages consisting of:

e-mail, an instant message, a chat room message, a newsgroup message, a wireless message, an SMS message, an MMS message, an EMS message, and a two-way pager message.

3. The method of claim 1 wherein the computing device is a device from the group of devices consisting of:

an individual user computer, an enterprise computer, a two-way pager, and a messaging telephone.

4. The method of claim 3 wherein the computing device is an enterprise computer, and the enterprise computer is a computer from the group of computers consisting of a gateway and a proxy.

5. The method of claim 1 wherein:

the electronic message comprises e-mail;

the computing device comprises an e-mail client; and

the routing step is performed by a plug-in module associated with the e-mail client.

6. The method of claim 1 wherein:

a plurality of machine learning based spam filters are coupled to the computing device; and

more than one filter is trained in the training step.

7. The method of claim 1 wherein at least one non machine learning based spam filter is coupled to the computing device.

8. The method of claim 7 wherein an incoming message is first routed to at least one non machine learning based spam filter, and then is routed to the machine learning based spam filter.

9. The method of claim 1 wherein the machine learning based spam filter is a filter from the group of filters consisting of:

a neural network, a Bayesian classifier, and a support vector machine.

10. The method of claim 1 wherein instructing the filter to process the electronic message incoming to the computer takes place in a recall mode.

11. The method of claim 1 wherein, when the filter decides that the incoming electronic message contains suspected spam, the incoming message is subjected to a step from the group of steps consisting of:

deleting the incoming message; and

subjecting the incoming message to a verification process.

12. The method of claim 1 wherein the filter has been previously trained by a third party.

13. A computer-readable medium containing computer program instructions for training a filter to suppress spam entering a computing device of an individual user, said computer program instructions for performing the steps of:

routing an electronic message written by the individual user and outgoing from the computing device to a machine learning based spam filter, the spam filter used to filter messages entering the computing device;

defining the outgoing message to be clean;

training the filter using the outgoing message wherein the outgoing message is a forwarded message and the filter is trained based on content within the outgoing message written by the individual user;

instructing the filter to process an electronic message incoming to the computing device of the individual user; and

deciding by the filter whether the incoming message is clean or contains suspected spam based on the training of the filter with the outgoing message.

14. The computer-readable medium of claim 13 wherein the electronic message is a message from the group of messages consisting of:

e-mail, an instant message, a chat room message, a newsgroup message, a wireless message, an SMS message, an MMS message, an EMS message, and a two-way pager message.

15. The computer-readable medium of claim 13 wherein the computing device is a device from the group of devices consisting of:

an individual user computer, an enterprise computer, a two-way pager, and a messaging telephone.

16. The computer-readable medium of claim 15 wherein the computing device is an enterprise computer, and the enterprise computer is a computer from the group of computers consisting of a gateway and a proxy.

17. The computer-readable medium of claim 13 wherein:

the electronic message comprises e-mail;

the computing device comprises an e-mail client; and

the routing step is performed by a plug-in module associated with the e-mail client.

18. The computer-readable medium of claim 13 wherein:

a plurality of machine learning based spam filters are coupled to the computing device; and

more than one filter is trained in the training step.

19. The computer-readable medium of claim 13 wherein at least one non machine learning based spam filter is coupled to the computing device.

20. The computer-readable medium of claim 19 wherein an incoming message is first routed to at least one non machine learning based spam filter, and then is routed to the machine learning based spam filter.

21. The computer-readable medium of claim 13 wherein the machine learning based spam filter is a filter from the group of filters consisting of a neural network, a Bayesian classifier, and a support vector machine.

22. The computer-readable medium of claim 13 wherein the computer program instructions specify instructing the filter to process the electronic message incoming to the computer in a recall mode.

23. The computer-readable medium of claim 13 wherein, when the filter decides that the incoming electronic message contains suspected spam, the incoming message is subjected to a step from the group of steps consisting of:

deleting the incoming message; and

subjecting the incoming message to a verification process.

24. The computer-readable medium of claim 13 wherein the filter has been previously trained by a third party.

25. An apparatus for training a filter to suppress spam entering a computing device of an individual user, said apparatus comprising:

coupled to the computing device, a machine learning based spam filter, the spam filter used to filter messages entering the computing device;

coupled to the computing device and to the machine learning based spam filter, means for defining an electronic message written by the individual user and outgoing from the computing device to be clean;

coupled to the machine learning based spam filter and to the defining means, means for training the filter using the outgoing message wherein the outgoing message is a forwarded message and the filter is trained based on content within the outgoing message written by the individual user, instructing the filter to process an electronic message incoming to the computing device of the individual user, and

deciding by the filter whether the incoming message is clean or contains suspected spam based on the training of the filter with the outgoing message.

26. The apparatus of claim 25 wherein the electronic message is a message from the group of messages consisting of:

e-mail, an instant message, a chat room message, a newsgroup message, a wireless message, an SMS message, an MMS message, an EMS message, and a two-way pager message.

27. The apparatus of claim 25 wherein the computing device is a device from the group of devices consisting of:

an individual user computer, an enterprise computer, a two-way pager, and a messaging telephone.

28. The apparatus of claim 27 wherein the computing device is an enterprise computer, and the enterprise computer is a computer from the group of computers consisting of:

a gateway and a proxy.

29. The apparatus of claim 25 wherein:

the electronic message comprises e-mail;

the computing device comprises an e-mail client; and

the e-mail client comprises a plug-in module adapted to present the electronic message to an input of the filter.

30. The apparatus of claim 25 wherein:

a plurality of machine learning based spam filters are coupled to the computing device;

more than one of the filters has training means associated therewith; and

each of said training means is coupled to the defining means.

31. The apparatus of claim 25 wherein at least one non machine learning based spam filter is coupled to the computing device.

32. The apparatus of claim 31 further comprising means for first routing an incoming message to at least one non machine learning based spam filter, and then routing the incoming message to the machine learning based spam filter.

33. The apparatus of claim 25 wherein the machine learning based spam filter is a filter from the group of filters consisting of a neural network, a Bayesian classifier, and a support vector machine.

34. The apparatus of claim 25 further comprising:

means for deleting the incoming electronic message; and

means for subjecting the incoming electronic message to a verification process.

35. The apparatus of claim 25 wherein the filter has been previously trained by a third party.