Using distinguishing properties to classify messages

• US 7,882,189 B2
• Filed: 10/29/2007
• Issued: 02/01/2011
• Est. Priority Date: 02/20/2003
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Wilson, Brian K., Koblas, David A., Penzias, Arno A.
• Primary Examiner(s): Nguyen; Thu Ha T
• Application Number:
  US11/926,819
• Publication Number:
  US 20080104184A1
• Time in Patent Office: 1,191 Days
• Field of Search: 709/201, 709/205, 709/206, 709/207, 379/93.01, 713/150, 715/760
• US Class Current: 709/206
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying in the message a distinguishing property; generating a signature using the distinguishing property; and comparing the signature to a database of signatures generated by previously classified messages.

Claims

1. A method for e-mail message classification, the method comprising:

receiving from a recipient of an e-mail message an indication that the e-mail message is spam;

extracting content from the e-mail message before deleting the e-mail message from an inbox of the recipient, wherein the extracted content excludes information that does not distinguish the e-mail message;

generating a plurality of signatures based on distinguishing properties identified in the extracted content, and wherein the distinguishing properties exclude;

variable portions of contact information related to a sender of the e-mail message,

contact information lacking a required character, and

contact information including a forbidden character;

storing the plurality of signatures as a combination of signatures in a database of signatures;

tracking a number of times the combination of signatures appears in the database of signatures;

updating the database of signatures based on the tracked number of times the combination of signatures appears;

determining whether the tracked number of times the combination of signatures appears exceeds a predetermined threshold; and

classifying a subsequently received e-mail message as spam when a set of signatures based on the subsequently received e-mail message matches all of the stored combination of signatures for a previously received spam message and the tracked number of times the combination of signatures appears exceeds the predetermined threshold.

2. The method of claim 1, further comprising:

comparing the combination of signatures with one or more stored combinations of signatures in the database of signatures;

generating a new combination of signatures based on the comparison; and

adding the new combination of signatures to the database, wherein the subsequently received e-mail message is classified as spam when the set of signatures based on the subsequently received e-mail message matches all of the new combination of signatures.

3. The method of claim 1, further comprising identifying the distinguishing properties in the extracted content and wherein the identified distinguishing properties comprises contact information.

4. The method of claim 3, further comprising:

determining validity of the contact information; and

excluding the contact information determined to be invalid from the identified distinguishing properties.

5. The method of claim 3, further comprising:

determining whether the contact information is decoy contact information; and

excluding the contact information determined to be decoy contact information from the identified distinguishing properties.

6. The method of claim 5, wherein determining whether the contact information is decoy contact information comprises comparing the contact information to a list of well-known contact information.

7. The method of claim 1, further comprising discarding any signature based on a distinguishing property with fewer than a predefined number of bytes.

8. The method of claim 1, wherein generating a plurality of signatures comprises formatting the plurality of signatures using extensible markup language (XML).

9. The method of claim 1, further comprising tracking a number of times a signature appears in the database of signatures and updating the database of signatures based on the tracked number based on the tracked number of times the signature appears.

10. The method of claim 1, further comprising updating e-mail configurations for the recipient based on the received indication that the e-mail message is spam.

11. The method of claim 1, further comprising updating e-mail configurations for a network based on the received indication that the e-mail message is spam.

12. The method of claim 11, wherein updating the e-mail configurations comprises adding a sender address associated with the e-mail message to a blacklist, wherein further messages from the sender address is blocked.

13. The method of claim 1, further comprising:

receiving indications that an e-mail message is spam from a plurality of recipients of the e-mail message;

tracking a number of times indications are received concerning the e-mail message; and

updating the database based on the tracked number of times indications are received concerning the e-mail message.

14. The method of claim 13, further comprising:

determining whether the tracked number of indications meets a predetermined threshold; and

processing the subsequently received e-mail message as spam when a set of signatures based on the subsequently received e-mail message matches all of the stored combination of signatures and exceeds the predetermined threshold.

15. A non-transitory computer-readable storage medium, having embodied thereon a program, the program being executable by a processor to perform a method for e-mail message classification, the method comprising:

receiving from a recipient of an e-mail message an indication that the e-mail message is spam;

extracting content from the e-mail message before deleting the e-mail message from an inbox of the recipient, wherein the extracted content excludes information that does not distinguish the e-mail message;

generating a plurality of signatures based on distinguishing properties identified in the extracted content, and wherein the distinguishing properties exclude;

variable portions of contact information related to a sender of the e-mail message,

contact information lacking a required character, and

contact information including a forbidden character;

storing the plurality of signatures as a combination of signatures in a database of signatures;

tracking a number of times a combination of signatures appears in the database of signatures;

updating the database of signatures based on the tracked number of times the combination of signatures appears;

determining whether the tracked number of times the combination of signatures appears exceeds a predetermined threshold; and

classifying a subsequently received e-mail message as spam when a set of signatures based on the subsequently received e-mail message matches all of the stored combination of signatures for a previously received spam message and the tracked number of times the combination of signatures appears exceeds the predetermined threshold.

16. The non-transitory computer-readable storage medium of claim 15, wherein the program is further executable to:

compare the combination of signatures with one or more stored combinations of signatures in the database of signatures;

generate a new combination of signatures based on the comparison; and

add the new combination of signatures to the database, wherein the subsequently received e-mail message is classified as spam when the set of signatures based on the subsequently received e-mail message matches all of the new combination of signatures.