Systems and methods for dynamically integrating heterogeneous anti-spam filters

• US 8,572,184 B1
• Filed: 10/04/2007
• Issued: 10/29/2013
• Est. Priority Date: 10/04/2007
• Status: Active Grant

• Current Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Original Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Inventors: Cosoi, Catalin A.
• Primary Examiner(s): STRANGE, AARON N
• Application Number:
  US11/867,547
• Time in Patent Office: 2,217 Days
• Field of Search: 709/207, 709/206, 709/224
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

In some embodiments, a spam filtering method includes computing the relevance of each of a plurality of anti-spam filters according to a relevance parameter set, and deciding whether an electronic message is spam or non-spam according to the relevancies and individual classification scores generated by the anti-spam filters. The relevance of an anti-spam filter indicates the degree to which a classification score produced by that particular filter determines the final classification of a given message. The relevance parameter set of each anti-spam filter may include, among others, a training maturity indicative of the degree of training of the filter, a filter update age indicative of the time elapsed since the latest update of the filter, a false-positive classification indicator, and a false-negative classification indicator of the anti-spam filter.

Claims

1. A spam filtering method comprising employing at least one processor to perform the steps of:

computing a relevance of a first anti-spam filter according to a relationship R=M−

T×

f(N,P), wherein M represents a training maturity of the first filter, T is an update age of the first filter indicative of a time period since a latest update of the first filter, wherein P is a false positive classification indicator of the first filter, N is a false negative classification indicator of the first filter, and wherein ƒ

is a function of N and P;

computing a relevance of a second anti-spam filter according to a training maturity of the second filter, an update age of the second filter indicative of a time period since the latest update of the second filter, a false positive classification indicator of the second filter, and a false negative classification indicator of the second filter; and

determining whether an electronic communication is spam or non-spam according to a first result generated by applying the first anti-spam filter to the electronic communication, a second result generated by applying the second anti-spam filter to the electronic communication, the relevance of the first filter, and the relevance of the second filter.

2. The method of claim 1, wherein computing the relevance of the first filter comprises setting the relevance of the first filter to a value substantially equal to

3. The method of claim 1, wherein computing the relevance of the first filter comprises setting the relevance of the first filter to a value substantially equal to

4. The method of claim 1, comprising computing the relevance of the first filter at a recipient client connected to an electronic communications server, the recipient client receiving the electronic communication from the electronic communications server, the recipient client including an electronic communication display application for displaying the electronic communication to a user.

5. The method of claim 1, wherein determining whether the electronic communication is spam or non-spam comprises determining a combined classification score substantially equal to S=S₁R₁+S₂R₂, wherein S₁ and S₂ are the first and second classification scores, respectively, and wherein R₁ and R₂ are the relevance of the first filter and the relevance of the second filter, respectively.

6. The method of claim 1, wherein the electronic communication is an email message.

7. A non-transitory computer readable medium storing instructions, which, when executed by a computer system, cause the computer system to form:

a first anti-spam filter and a second anti-spam filter configured to input an electronic communication and to compute first and second spam classification scores, respectively, for the electronic communication;

a filter relevance calculator configured to compute a relevance of the first anti-spam filter and a relevance of the second anti-spam filter, wherein computing the relevance of the first filter comprises setting the relevance of the first filter to a value substantially equal to R=M−

T×

f(N,P), wherein M, T, N, P represent a training maturity of the first filter, an update age of the first filter indicative of a time period since a latest update of the first filter, a false negative classification indicator of the first filter, and a false positive classification indicator of the first filter, respectively, wherein ƒ

represents a function of N and P, and wherein the second relevance is computed according to a training maturity of the second filter, an update age of the second filter indicative of a time period since a latest update of the second filter, a second false negative classification indicator of the second filter, and a second false positive classification indicator of the second filter; and

a decision module connected to the first and second anti-spam filters and to the filter relevance calculator, configured to determine whether an electronic communication is spam or non-spam according to the first and second spam classification scores, the relevance of the first filter, and the relevance of the second filter.

8. A spam filtering method comprising employing at least one processor to perform the steps of:

computing a relevance of a first anti-spam filter according to a first relevance parameter set, the first relevance parameter set including a training maturity of the first filter, a false positive classification indicator of the first filter, and a false negative classification indicator of the first filter, and an update age of the first filter indicative of a time period since a latest update of the first filter;

computing a relevance of a second anti-spam filter according to a second relevance parameter set, the second relevance parameter set including an a training maturity of the second filter, a false positive classification indicator of the second filter, and a false negative classification indicator of the second filter, and an update age of the second filter, indicative of a time period since a latest update of the second filter; and

determining whether an electronic communication is spam or non-spam according to a first result generated by applying the first filter to the electronic communication, a second result generated by applying the second filter to the electronic communication, the relevance of the first filter, and the relevance of the second filter.

9. The method of claim 8, wherein the first relevance parameter set comprises a filter confidence indicative of a spam-identification confidence level of the first filter.

10. The method of claim 8, wherein computing the relevance of the first filter comprises setting the relevance of the first filter to a value substantially equal to

11. The method of claim 10, comprising determining w_i using a neural network with supervised learning.

12. The method of claim 10, wherein computing the relevance of the first filter comprises setting the relevance of the first filter to a value substantially equal to R=w₁M+w₂TA+w₃TP+w₄TN+w₅TC, wherein M, T, P, N represent the training maturity of the first filter, the update age of the first filter, the false positive classification indicator of the first filter, and the false negative classification indicator of the first filter, wherein A is an aging speed indicator of the first filter, and wherein C is a filter confidence indicative of a spam-identification confidence level of the first filter.

13. The method of claim 8, comprising computing the relevance of the first filter at a recipient client connected to an electronic communications server, the recipient client receiving the electronic communication from the electronic communications server, the recipient client including an electronic communication display application for displaying the electronic communication to a user.

14. The method of claim 8, wherein determining whether the electronic communication is spam or non-spam comprises determining a combined classification score substantially equal to S=S₁R₁+S₂R₂, wherein S₁ and S₂ are the first and second classification scores, respectively, and wherein R₁ and R₂ are the relevance of the first filter and the relevance of the second filter, respectively.

15. The method of claim 8, wherein the electronic communication is an email message.

16. A non-transitory computer readable medium encoding instructions which, when executed by at least one processor, cause the at least one processor to perform the steps of:

computing a relevance of a first anti-spam filter according to a difference between i. a training maturity of the first filter and ii. a product of an update age of the first filter and a function of a false negative classification indicator and a false positive classification indicator of the first filter,

computing a relevance of a second anti-spam filter according to a training maturity of the second filter, an update age of the second filter indicative of a time period since a latest update of the second filter, a false negative classification indicator of the second filter, and a false positive classification indicator of the second filter; and

determining whether an electronic communication is spam or non-spam according to a first result generated by applying the first anti-spam filter to the electronic communication, a second result generated by applying the second anti-spam filter to the electronic communication, the relevance of the first filter, and the relevance of the second filter.