Message classification using classifiers

• US 7,814,545 B2
• Filed: 10/29/2007
• Issued: 10/12/2010
• Est. Priority Date: 07/22/2003
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Kim, Bryan, Oliver, Jonathan J., Wilson, Brian K., Eikenberry, Scott D., Koblas, David A., Roy, Scott
• Primary Examiner(s): NGUYEN, MINH DIEU T
• Application Number:
  US11/927,493
• Publication Number:
  US 20080097946A1
• Time in Patent Office: 1,079 Days
• Field of Search: 713/154, 726 13- 14, 726/22, 709/206, 709/224, 707 5- 6
• US Class Current: 726/22
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system and method are disclosed for improving a statistical message classifier. A message may be tested with a machine classifier, wherein the machine classifier is capable of making a classification on the message. In the event the message is classifiable by the machine classifier, the statistical message classifier is updated according to the reliable classification made by the machine classifier. The message may also be tested with a first classifier. In the event that the message is not classifiable by the first classifier, it is tested with a second classifier, wherein the second classifier is capable of making a second classification. In the event that the message is classifiable by the second classifier, the statistical message classifier is updated according to the second classification.

Claims

1. A method for classifying a message, the method comprising:

maintaining a table of message features in memory, wherein each message feature corresponds to a good count and a spam count, and wherein the good count is based on a number of times the message feature is associated with a previously received message determined not to be unsolicited and the spam count is based on a number of times the message feature is associated with a previously received message determined to be unsolicited;

receiving a message for analysis;

determining that a sender address of the received message is not in a database of known sender addresses;

identifying one or more message features in the received message;

tracking user classification of previously received messages, wherein the user classification indicates whether the previously received messages are junk or unjunk, the user classification maintained in a table stored in memory;

computing a score for each message feature identified in the received message based on the good count and spam count associated with the identified message feature and user classification of received messages associated with the identified message feature;

determining that the received message is an unsolicited message based on the computed score; and

processing the received message according to the score derived from analysis of the identified message features in the received message.

2. The method of claim 1, wherein the score derived from the analysis of the received message indicates that the received message is an unsolicited message, and processing the received message includes deleting the received message.

3. The method of claim 1, wherein the score derived from the analysis of the received message indicates that the received message is an unsolicited message, and processing the received message includes quarantining the received message.

4. The method of claim 1, wherein the score derived from the analysis of the received message is inconclusive as to whether the received message is an unsolicited message, and processing the received message includes further analyzing the received message, wherein further analysis determines whether the received message is an unsolicited message.

5. The method of claim 4, wherein further analysis of the received message indicates that the received message is an unsolicited message, and the received message is deleted.

6. The method of claim 5, further comprising updating a statistical classifier in response to analysis of the received message indicating that the received message was an unsolicited message.

7. The method of claim 4, wherein further analysis of the received message indicates that the message is an unsolicited message, and the received message is quarantined.

8. The method of claim 7, further comprising updating a statistical classifier in response to analysis of the received message indicating that the received message was an unsolicited message.

9. The method of claim 1, wherein the score derived from the analysis of the received message indicates that the received message is not an unsolicited message, and processing the received message includes delivering the intended message to an intended recipient.

10. The method of claim 9, further comprising updating a statistical classifier in response to analysis of the received message indicating that the received message was not an unsolicited message.

11. The method of claim 10, 5, or 8, wherein updating a statistical classifier includes updating tokens or features corresponding to received messages.

12. The method of claim 11, wherein the tokens or features includes an automatically incremented indicia of received messages not being an unsolicited message and an automatically incremented indicia of received messages being an unsolicited message.

13. The method of claim 12, wherein the tokens or features may be further augmented by a direct user classification of received messages being an unsolicited message or not being an unsolicited message.

14. The method of claim 13, wherein the tokens or features may be further augmented by an indirect user classification of received messages being an unsolicited message or not being an unsolicited message.

15. The method of claim 14, wherein the indirect user classification is removal of a received message from a message quarantine to an inbox or removal of a received message from an inbox to a message quarantine.

16. The method of claim 1, wherein the database of known sender addresses is derived from an address in a recipient address book.

17. The method of claim 1, wherein the database of known sender addresses is derived from an address to which an intended recipient has previously sent a message.

18. An apparatus for classifying a message, the apparatus comprising:

a processor configured to execute a program stored in memory, wherein execution of the program by the processor;

identifies one or more message features in a received message,

tracks user classification of previously received messages, wherein the user classification indicates whether the previously received messages are junk or unjunk and wherein the user classification is maintained in a table stored in memory,

computes a score for each identified message feature, the score based on a good count and spam count associated with the identified message feature and the user classification of previously received messages associated with the identified message feature, and

processes the received message according to the score derived from analysis of the one or more identified features in the received message;

memory configured to store information regarding the one or more identified message features of previously received messages, the information regarding the one or more identified message features used to compute the score for each identified message feature; and

a database of known sender addresses, wherein processing of the received message is further based on a determining whether a sender of the received message has a known sender address.

19. The apparatus of claim 18, wherein the database of known sender addresses is derived from an address in a recipient address book.

20. The apparatus of claim 18 further comprising a whitelist counter stored in memory and executable by the processor to track the number of times an identified message feature has appeared in a whitelisted message.

21. The apparatus of claim 20, wherein a value from the whitelist counter is used to compute the score associated with the identified message feature.