Using distinguishing properties to classify messages

• US 8,266,215 B2
• Filed: 02/20/2003
• Issued: 09/11/2012
• Est. Priority Date: 02/20/2003
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Wilson, Brian K., Koblas, David A., Penzias, Arno A.
• Primary Examiner(s): NGUYEN, THU HA T
• Application Number:
  US10/371,987
• Publication Number:
  US 20040167968A1
• Time in Patent Office: 3,491 Days
• Field of Search: 709/206, 709/207, 709/204, 709/238, 713/151, 713/201, 713/150, 715/500, 715/760, 379/93.01
• US Class Current: 709/206
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying in the message a distinguishing property; generating a signature using the distinguishing property; and comparing the signature to a database of signatures generated by previously classified messages.

Claims

1. A method for classifying a message, comprising:

receiving the message;

identifying in the message at least two distinguishing properties, wherein a domain name in the text of the message is a first distinguishing property;

generating at least two signatures, a first signature of the at least two signatures using the domain name and a second signature using a second distinguishing property of the distinguishing properties;

comparing the at least two signatures to a database of signatures generated by previously classified messages, wherein the second distinguishing property includes information in the text of the message that can be used by a recipient of the message to fulfill a goal of a sender of the message; and

processing the message according to the comparison.

2. The method of claim 1, wherein the second distinguishing property includes contact information.

3. The method of claim 1, wherein the second distinguishing property includes contact information, and the contact information includes an email address.

4. The method of claim 1, wherein the second distinguishing property includes contact information, and the contact information includes a telephone number.

5. The method of claim 1, wherein the second distinguishing property includes contact information and the contact information includes a universal resource locator (URL).

6. The method of claim 1, wherein the second distinguishing property includes an Internet Protocol (IP) address.

7. The method of claim 1, wherein the second distinguishing property includes a name.

8. The method of claim 1, wherein the second distinguishing property includes a stock ticker symbol.

9. The method of claim 1, wherein the second distinguishing property includes instructions for performing a task.

10. The method of claim 1, further including determining whether the at least two signatures exist in a database of previously stored signatures and in the event that the at least two signatures do not exist in the database, adding the at least two signatures to the database.

11. The method of claim 10, wherein the at least two signatures are transferred to a database using an XML based protocol.

12. The method of claim 1, wherein the database tracks the number of times the message has been identified as a junk message.

13. The method of claim 1, wherein the database is located on a mail device.

14. The method of claim 1, wherein the database is located on a server.

15. The method of claim 1, wherein the database is located on a network accessible by a spam-blocking server.

16. The method of claim 1, wherein generating the at least two signatures includes performing a hash function on at least one of the distinguishing properties.

17. The method of claim 16, wherein the hash function is a SHA function.

18. The method of claim 16, wherein the hash function is an MD5 function.

19. The method of claim 16, wherein the hash function is a checksum function.

20. The method of claim 1, wherein the at least two signatures are generated for the distinguishing properties that meet a minimum byte requirement.

21. The method of claim 1, wherein identifying the distinguishing properties includes preprocessing the message to remove non-essential information.

22. The method of claim 1, wherein identifying the distinguishing properties includes processing the message to exclude decoy information.

23. The method of claim 1, wherein the domain name is not a first distinguishing property if an address includes forbidden characters.

24. The method of claim 1, wherein the domain name is not a first distinguishing property if an address is in a whitelist.

25. The method of claim 1, wherein the domain name is extracted from a URL.

26. The method of claim 1, wherein the domain name is extracted from an email address.

27. A computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for classifying a message, the method comprising:

receiving the message;

identifying in the message at least two distinguishing properties, wherein a domain name in the text of the message is a first distinguishing property;

generating at least two signatures, a first signature of the at least two signatures using the domain name and a second signature using a second distinguishing property of the distinguishing properties;

comparing the at least two signatures to a database of signatures generated by previously classified messages, wherein the second distinguishing property includes information in the text of the message that can be used by a recipient of the message to fulfill a goal of a sender of the message; and

processing the message according to the comparison.

28. A system for classifying a message comprising:

a mail client in a communication network, the mail client configured to;

receive the message,

identify in the message at least two distinguishing properties, wherein a domain name in the text of the message is a first distinguishing property; and

generate at least two signatures, a first signature of the at least two signatures using the domain name and a second signature using a second distinguishing property of the distinguishing properties; and

a mail server configured to;

compare the at least two signatures to a database of signatures generated by previously classified messages, wherein the second distinguishing property includes information in the text of the message that can be used by a recipient of the message to fulfill a goal of a sender of the message, and

process the message according to the comparison.