Message classification using legitimate contact points

• US 8,108,477 B2
• Filed: 07/13/2009
• Issued: 01/31/2012
• Est. Priority Date: 02/20/2003
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan J., Koblas, David A., Wilson, Brian K.
• Primary Examiner(s): Duong, Oanh
• Application Number:
  US12/502,189
• Publication Number:
  US 20100017488A1
• Time in Patent Office: 932 Days
• Field of Search: 709203-207, 709217-219, 709/229, 709223-225, 726/13, 726/14
• US Class Current: 709/206
• CPC Class Codes: G06F 16/24558 Binary matching operations
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying all items of a certain type in the message, determining whether each of the items meets a criterion, and in the event that all the items are determined to meet the criterion, determining a classification of the message. The system includes an interface configured to receive the message, a processor coupled to the interface, configured to identify all items of a certain type in the message; determine whether each of the items meets a criterion; and in the event that all the items are determined to meet the criterion, determine a classification of the message.

Claims

1. A method for classifying a message, the method comprising:

registering one or more signatures for a database in memory, the database for maintaining legitimate signatures corresponding to legitimate contact points, each of the legitimate contact points previously identified as legitimate based on aggregated user inputs indicating legitimacy of a corresponding message, wherein registration comprises;

receiving a registration message associated with a certificate of legitimacy,

executing instructions stored in memory, wherein execution of the instructions by a processor;

determines that the certificate of legitimacy is valid,

tests the registration message to determine that the registration message is not spam,

generates one or more signatures based on one or more contact points included in the registration message, and

stores the one or more signatures in the database;

receiving the message over a communication network; and

executing further instructions stored in the memory, wherein execution of the further instructions by the processor;

identifies one or more contact points in the message,

generates one or more signatures corresponding to each of the contact points identified in the message,

classifies the message as acceptable when at least one of the one or more signatures for each of the contact points exists in the database, and

submits the message to further processing when at least one of the one or more signatures for each of the contact points does not exist in the database.

2. The method of claim 1, wherein generating the one or more signatures includes:

reducing the contact points into canonical equivalents, and

generating signatures for each of the canonical equivalents.

3. The method of claim 1, wherein generating the one or more signatures includes performing a function on characters associated with the contact point, the function selected from the group consisting of hash functions, checksum, compression, and expansion.

4. The method of claim 1, further comprising updating the database with the one or more signatures corresponding to the message when the message is classified as acceptable.

5. The method of claim 1, further comprising maintaining a database of spam signatures corresponding to spam contact points, wherein classifying the message as acceptable is further based on none of the generated signatures for the message existing in the database of spam signatures.

6. The method of claim 5, wherein each signature in the database of spam signatures is associated with aggregated user inputs.

7. The method of claim 6, wherein each signature in the database of legitimate signatures and the database of spam signatures is further associated with a probability based on the associated aggregated user inputs.

8. The method of claim 7, further comprising adding or removing a signature from the database of legitimate or spam signatures based on the associated probability meeting a threshold.

9. An apparatus for classifying a message, the apparatus comprising

a memory for maintaining a database of signatures corresponding to contact points, each of the contact points previously identified as legitimate based on aggregated user inputs indicating legitimacy of a corresponding message;

an interface for receiving the message over a communication network; and

a processor for executing instructions stored in the memory, wherein execution of the instructions by the processor;

registers one or more signatures for the database, the registration comprising;

receiving a registration message associated with a certificate of legitimacy,

determining that the certificate of legitimacy is valid,

testing the registration message to determine that the registration message is not spam,

generating one or more signatures based on one or more contact points included in the registration message, and

storing the one or more signatures in the database;

identifies one or more contact points in the message;

generates one or more signatures corresponding to each of the contact points identified in the message;

classifies the message as acceptable when at least one of the one or more signatures for each of the contact points exists in the database; and

submits the message to further processing when at least one of the one or more signatures for each of the contact points does not exist in the database.

10. The apparatus of claim 9, wherein generating the one or more signatures includes reducing the contact points into canonical equivalents and generating signatures for each of the canonical equivalents.

11. The apparatus of claim 9, wherein generating the one or more signatures includes performing a function on characters associated with the contact point, the function selected from the group consisting of hash functions, checksum, compression, and expansion.

12. The apparatus of claim 9, wherein further execution of instructions by the processor updates the database with the one or more signatures corresponding to the acceptable message when the message is classified as acceptable.

13. The apparatus of claim 9, further comprising maintaining a database of spam signatures corresponding to spam contact points, wherein classifying the message as acceptable is further based on none of the generated signatures for the message existing in the spam database.

14. The apparatus of claim 13, wherein each signature in the spam database is associated with aggregated user inputs regarding spam status.

15. The apparatus of claim 14, wherein each signature in the legitimate database and the spam database is further associated with a probability based on the associated aggregated user inputs.

16. The apparatus of claim 15, further comprising adding or removing a signature from the legitimate database or the spam database based on the associated probability meeting a threshold.

17. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for classifying a message, the method comprising:

registering one or more signatures for a database of legitimate signatures corresponding to legitimate contact points, each of the legitimate contact points previously identified as legitimate based on aggregated user inputs indicating legitimacy of a corresponding message, the registration including;

receiving a registration message associated with a certificate of legitimacy,

determining that the certificate of legitimacy is valid,

testing the registration message to determine that the registration message is not spam,

generating one or more signatures based on one or more contact points included in the registration message, and

storing the one or more signatures in the database;

identifying one or more contact points in a received message;

generating one or more signatures corresponding to each of the contact points identified in the received message;

classifying the received message as acceptable when at least one of the one or more generated signatures for each of the identified contact points exists in the database; and

forwarding the received message for further processing when at least one of the one or more generated signatures for each of the identified contact points does not exist in the database.