Bulk electronic message detection by header similarity analysis

• US 7,831,677 B1
• Filed: 03/27/2009
• Issued: 11/09/2010
• Est. Priority Date: 09/16/2004
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Hartman, Alfred C., Nachenberg, Carey S.
• Primary Examiner(s): Jacobs; Lashonda T
• Application Number:
  US12/413,287
• Time in Patent Office: 592 Days
• Field of Search: 709/206, 709/207, 709/203, 709/217, 709/223, 709/224
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Methods, apparatuses, and computer-readable media for detecting bulk electronic messages using header similarity analysis. Bulk electronic messages can be detected by parsing (115) header fields of an electronic message; associating (120) at least one constituent unit with each header field defining a set of constituent units for each header field; ascertaining (230) a feature vector for each set of constituent units; forming (240) a collection of feature vectors; and computing (250) an inner product from a set of constituent units from an additional electronic message and the collection of feature vectors from the initial electronic message resulting in a measure of similarity between the initial electronic message and the additional electronic message.

Claims

1. A computer-implemented method for detecting bulk electronic messages, comprising:

parsing, by a computer system, header fields of at least one electronic message;

associating, by the computer system, at least one constituent unit with each header field to define a set of constituent units for each field;

forming, by the computer system, a collection of constituent unit sets;

finding, by the computer system, cardinality of an intersection between an additional set of constituent units from an additional electronic message and the collection of constituent unit sets, to determine a measure of similarity; and

responsive to the measure of similarity exceeding a predetermined level, concluding, by the computer system, that the electronic messages are bulk electronic messages.

2. The method of claim 1, wherein the measure of similarity is a maximum similarity of the additional set of constituent units to any member of the collection of constituent unit sets.

3. The method of claim 1, wherein the measure of similarity is a minimum similarity of the additional set of constituent units to any member of the collection of constituent unit sets.

4. The method of claim 1, wherein the measure of similarity is a central tendency of similarities of the additional set of constituent units to members of the collection of constituent unit sets.

5. The method of claim 4, wherein the central tendency is an arithmetic mean.

6. The method of claim 4, wherein the central tendency is a median.

7. At least one computer-readable storage medium containing computer program instructions for detecting bulk electronic messages, the computer program instructions performing steps comprising:

determining a measure of similarity between headers of at least two electronic messages;

calculating a measure of similarity between message content of the at least two electronic messages; and

classifying the at least two messages as bulk electronic messages when the measure of similarity between the headers and the measure of similarity between the message content exceed a predetermined level.

8. The at least one computer-readable storage medium of claim 7 wherein the computer program instructions further perform the steps of:

parsing header fields of the least two electronic messages;

associating at least one constituent unit with each header field, defining a set of constituent units for each field;

forming a collection of constituent unit sets for each electronic message; and

finding cardinality of an intersection between each set of constituent units to determine the measure of similarity between headers.

9. The at least one computer-readable storage medium of claim 8, wherein the measure of similarity is determined based on a maximum similarity between the sets of constituent units.

10. The at least one computer-readable storage medium of claim 8, wherein the measure of similarity is determined based on a minimum similarity between the sets of constituent units.

11. The at least one computer-readable storage medium of claim 8, wherein the measure of similarity is determined based on a central tendency of similarities between the sets of constituent units.

12. The at least one computer-readable storage medium of claim 11, wherein the central tendency is an arithmetic mean.

13. An apparatus having a computer-readable storage medium having computer program instructions embodied therein for detecting bulk electronic messages, the computer program instructions comprising:

an examination module adapted to;

determine a measure of similarity between headers of at least two electronic messages;

calculate a measure of similarity between message content of the at least two electronic messages; and

classify the at least two messages as bulk electronic messages when the measure of similarity between the headers and the measure of similarity between the message content exceed a predetermined level; and

coupled communicatively to the examination module, a blocking module adapted to block the transmission of the at least two electronic messages responsive to the at least two electronic messages being classified as bulk electronic messages.

14. The apparatus of claim 13 wherein the examination module, in determining the measure of similarity between headers of the at least two electronic messages, is further adapted to:

parse header fields of the least two electronic messages;

associate at least one constituent unit with each header field, defining a set of constituent units for each field;

form a collection of constituent unit sets for each electronic message; and

find cardinality of an intersection between each set of constituent units to determine the measure of similarity between headers.

15. The apparatus of claim 14, wherein the measure of similarity is determined based on a maximum similarity between the sets of constituent units.

16. The apparatus of claim 14, wherein the measure of similarity is determined based on a minimum similarity between the sets of constituent units.

17. The apparatus of claim 14, wherein the measure of similarity is determined based on a central tendency of similarities between the sets of constituent units.

18. The apparatus of claim 17, wherein the central tendency is an arithmetic mean.