Method and apparatus for detecting spam in email messages and email attachments

• US 7,941,490 B1
• Filed: 05/11/2005
• Issued: 05/10/2011
• Est. Priority Date: 05/11/2004
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Cowings, David O.
• Primary Examiner(s): Bates; Kevin
• Assistant Examiner(s): McKenzie; Marcus
• Application Number:
  US11/127,814
• Time in Patent Office: 2,190 Days
• Field of Search: 709204-207
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method and system for a character-based document comparison are described. In one embodiment, the method includes receiving an email message and determining a level of noise present in the message. The level of noise present in the email message is then utilized to determine whether the message is indicative of spam.

Claims

1. A method comprising:

a computer system receiving an email message;

the computer system performing a plurality of demangling operations on the received email message, wherein each demangling operation identifies a different type of obfuscation technique, and wherein said performing includes modifying content of the received email message;

the computer system counting a number of the performed plurality of demangling operations that indicate a presence of noise in the received email message; and

the computer system utilizing the counted number of demangling operations to determine whether the email message is indicative of spam.

2. The method of claim 1 wherein performing a first of the plurality of demangling operations on the received email message includes:

identifying, in the received email message, a first set of data indicative of a first type of obfuscation technique; and

responsive to the identifying, modifying the email message.

3. The method of claim 1 wherein performing one of the plurality of demangling operations includes:

identifying, in the email message, one or more numeric character references or character entity references indicative of a first type of obfuscation technique; and

responsive to the identifying, modifying at least one of the identified references.

4. The method of claim 3 wherein performing one of the plurality of demangling operations includes:

identifying, in the email message, URL password syntax data indicative of a second type of obfuscation technique; and

responsive to the identifying, modifying the identified URL password syntax data.

5. The method of claim 1 wherein performing one of the plurality of demangling operations includes:

identifying HTML formatting data in the email message; and

responsive to the identifying, removing the identified HTML formatting data from the email message.

6. The method of claim 1 further comprising the computer system blocking the email message if the email message is determined to be spam.

7. The method of claim 1 wherein performing one of the plurality of demangling operations includes:

identifying noise in a header of an attachment of the email message; and

responsive to the identifying, removing the identified noise from the header.

8. The method of claim 7 wherein the identifying includes utilizing a mathematical signature associated with a type of the attachment.

9. The method of claim 7 wherein the identified noise is identified in a file extension associated with the attachment.

10. A computer system comprising:

a processor;

a memory storing program instructions executable by the processor to;

receive an email message;

perform a plurality of demangling operations on the received email message, including modifying content of the received email message, wherein each demangling operation identifies a different type of obfuscation technique;

count a number of the performed plurality of demangling operations that indicate a presence of noise in the received email message; and

utilize the counted number of demangling operations to determine whether the email message is indicative of spam.

17. The computer system of claim 10 wherein the program instructions executable to perform one of the plurality of demangling operations are executable to:

identify one or more numeric character references or character entity references in the email message; and

responsive to identifying the one or more numeric character references or character entity references, modify at least one of the identified references.

18. The computer system of claim 10 wherein the program instructions executable to perform one of the plurality of demangling operations are executable to:

identify URL password syntax data in the email message; and

responsive to identifying the URL password syntax data, modify the identified URL password syntax data.

19. The computer system of claim 10 wherein the program instructions executable to perform one of the plurality of demangling operations are executable to:

identify noise in a header of an attachment of the email message; and

responsive to identifying the noise in the header, remove the identified noise from the header.

11. A non-transitory computer readable storage medium storing program instructions that are executable to:

receive an email message;

perform a plurality of demangling operations on the received email message,

wherein each demangling operation identifies a different type of obfuscation technique, and wherein one or more of the demangling operations modifies the received email message;

count a number of the performed plurality of demangling operations that indicate a presence of noise in the received email message; and

utilize the counted number of demangling operations to determine whether the email message is indicative of spam.

12. The non-transitory computer readable storage medium of claim 11 wherein the program instructions executable to perform one of the plurality of demangling operations are executable to:

identify one or more numeric character references or character entity references in the email message; and

responsive to identifying the one or more numeric character references or character entity references, modify at least one of the identified references.

13. The non-transitory computer readable storage medium of claim 11 wherein the program instructions executable to perform one of the plurality of demangling operations are executable to:

identify URL password syntax data in the email message; and

responsive to identifying the URL password syntax data, modify the identified URL password syntax data.

14. The non-transitory computer readable storage medium of claim 11 wherein the program instructions executable to perform one of the plurality of demangling operations are executable to:

identify HTML formatting data in the email message; and

responsive to identifying the HTML formatting data, remove the identified HTML formatting data from the email message.

15. The non-transitory computer readable storage medium of claim 11 wherein the program instructions executable to perform one of the plurality of demangling operations are executable to:

identify noise in a header of an attachment of the email message; and

responsive to identifying the noise in the header, remove the identified noise from the header.

16. The non-transitory computer readable storage medium of claim 15 wherein the identified noise is identified in a file extension associated with the attachment.

20. A non-transitory computer readable storage medium storing program instructions that are executable to:

count a number of different obfuscation techniques present in a received email message;

assign a first spam weight value in response to the counted number being within a first range; and

determine whether the received email message is a spam email message, including by utilizing the first spam weight value.

21. The non-transitory computer readable storage medium of claim 20, wherein the program instructions are further executable to:

modify the received email message to remove noise associated with one or more of the number of different obfuscation techniques counted as being present in the received email message; and

compute a second spam weight value indicative of whether the modified email message resembles a known spam message;

wherein the program instructions executable to determine whether the received email message is a spam email message utilize the first and second spam weight values.

22. The non-transitory computer readable storage medium of claim 21, wherein the program instructions executable to count a number of different obfuscation techniques are executable to determine whether a numeric character reference or character entity reference is present in the email message.

23. The non-transitory computer readable storage medium of claim 21, wherein the program instructions are further executable to assign a second spam weight value in response to the counted number being within a second range, and wherein determining whether the received email message is a spam email message includes utilizing the second spam weight value.