Hash-based systems and methods for detecting and preventing transmission of unwanted e-mail
First Claim
Patent Images
1. A method for detecting potentially unwanted e-mail messages, comprising:
- receiving a plurality of e-mail messages;
processing the plurality of e-mail messages by removing HTML comments and HTML tags from the plurality of e-mail messages;
generating one or more hash values based on one or more portions of the plurality of e-mail messages such that each of the plurality of e-mail messages has one or more corresponding generated hash values;
counting the one or more of the generated hash values associated with at least one of the plurality of e-mail messages that match one or more hash values associated with at least one prior e-mail message;
determining that the at least one of the plurality of e-mail messages is a potentially unwanted e-mail message based on the counting of the one or more of the generated hash values associated with the at least one of the plurality of e-mail messages that match the one or more of the hash values associated with the at least one prior e-mail message;
generating at least one suspicion score for the at least one of the plurality of e-mail messages based on the counting of the one or more of the generated hash values associated with the at least one of the plurality of e-mail messages that match the one or more hash values associated with the at least one prior e-mail message; and
taking remedial action on the at least one of the plurality of e-mail messages that is determined to be the potentially unwanted e-mail message, based on the at least one suspicion score, the taking remedial action including deleting a newly received e-mail message.
2 Assignments
0 Petitions
Accused Products
Abstract
A system (120) detects transmission of potentially unwanted e-mail messages. The system (120) may receive e-mail messages and generate hash values based on one or more portions of the e-mail messages. The system (120) may then determine whether the generated hash values match hash values associated with prior e-mail messages. The system (120) may determine that one of the e-mail messages is a potentially unwanted e-mail message when one or more of the generated hash values associated with the e-mail message match one or more of the hash values associated with the prior e-mail messages.
963 Citations
83 Claims
-
1. A method for detecting potentially unwanted e-mail messages, comprising:
-
receiving a plurality of e-mail messages; processing the plurality of e-mail messages by removing HTML comments and HTML tags from the plurality of e-mail messages; generating one or more hash values based on one or more portions of the plurality of e-mail messages such that each of the plurality of e-mail messages has one or more corresponding generated hash values; counting the one or more of the generated hash values associated with at least one of the plurality of e-mail messages that match one or more hash values associated with at least one prior e-mail message; determining that the at least one of the plurality of e-mail messages is a potentially unwanted e-mail message based on the counting of the one or more of the generated hash values associated with the at least one of the plurality of e-mail messages that match the one or more of the hash values associated with the at least one prior e-mail message; generating at least one suspicion score for the at least one of the plurality of e-mail messages based on the counting of the one or more of the generated hash values associated with the at least one of the plurality of e-mail messages that match the one or more hash values associated with the at least one prior e-mail message; and taking remedial action on the at least one of the plurality of e-mail messages that is determined to be the potentially unwanted e-mail message, based on the at least one suspicion score, the taking remedial action including deleting a newly received e-mail message. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26)
-
-
27. A computer program product embodied on a non-transitory computer-readable medium, comprising:
-
computer code for receiving a plurality of e-mail messages; computer code for processing the plurality of e-mail messages by removing HTML comments and HTML tags from the plurality of e-mail messages; computer code for generating one or more hash values based on one or more portions of the plurality of e-mail messages such that each of the plurality of e-mail messages has one or more corresponding generated hash values; computer code for counting the one or more of the generated hash values associated with at least one of the plurality of e-mail messages that match one or more hash values associated with at least one prior e-mail message; computer code for determining that the at least one of the plurality of e-mail messages is a potentially unwanted e-mail message based on the counting of the one or more of the generated hash values associated with the at least one of the plurality of e-mail messages that match the one or more of the hash values associated with the at least one prior e-mail message; computer code for generating at least one suspicion score for the at least one of the plurality of e-mail messages based on the counting of the one or more of the generated hash values associated with the at least one of the plurality of e-mail messages that match the one or more hash values associated with the at least one prior e-mail message; and computer code for taking remedial action on the at least one of the plurality of e-mail messages that is determined to be the potentially unwanted e-mail message, based on the at least one suspicion score, the taking remedial action including deleting a newly received e-mail message. - View Dependent Claims (28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72)
-
-
73. A system including a processor and a non-transitory computer-readable medium, comprising:
-
means for receiving a plurality of e-mail messages; means for processing the plurality of e-mail messages by removing HTML comments and HTML tags from the plurality of e-mail messages; means for generating one or more hash values based on one or more portions of the plurality of e-mail messages such that each of the plurality of e-mail messages has one or more corresponding generated hash values; means for counting the one or more of the generated hash values associated with at least one of the plurality of e-mail messages that match one or more hash values associated with at least one prior e-mail message; means for determining that the at least one of the plurality of e-mail messages is a potentially unwanted e-mail message based on the counting of the one or more of the generated hash values associated with the at least one of the plurality of e-mail messages that match the one or more of the hash values associated with the at least one prior e-mail message; means for generating at least one suspicion score for the at least one of the plurality of e-mail messages based on the counting of the one or more of the generated hash values associated with the at least one of the plurality of e-mail messages that match the one or more hash values associated with the at least one prior e-mail message; and means for taking remedial action on the at least one of the plurality of e-mail messages that is determined to be the potentially unwanted e-mail message, based on the at least one suspicion score, the taking remedial action including deleting a newly received e-mail message. - View Dependent Claims (74, 75, 76, 77, 78, 79, 80, 81, 82, 83)
-
Specification