Identification of content

• US 8,578,484 B2
• Filed: 12/31/2009
• Issued: 11/05/2013
• Est. Priority Date: 12/31/2008
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Yu, Sijie
• Primary Examiner(s): Gee, Jason
• Application Number:
  US12/651,327
• Publication Number:
  US 20100299752A1
• Time in Patent Office: 1,405 Days
• Field of Search: 726/22
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes

Abstract

Systems and methods for identifying content in electronic messages are provided. An electronic message may include certain content. The content is detected and analyzed to identify any metadata. The metadata may include a numerical signature characterizing the content. A thumbprint is generated based on the numerical signature. The thumbprint may then be compared to thumbprints of previously received messages. The comparison allows for classification of the electronic message as spam or not spam.

Claims

1. A method for identifying content in electronic messages, the method comprising:

receiving an electronic message having been classified as spam;

executing instructions stored in memory, wherein execution of the instructions by a processor;

detects content included in the received electronic message,

identifies metadata for the detected content, the metadata including a numerical signature comprising a concatenation of a plurality of numbers, each number characterizing an aspect of the content,

generates at least one variation for the numerical signature, wherein the variation characterizes a plurality of aspects of content that is different from any content in the received electronic message, and

generates a thumbprint based on the numerical signature and a thumbprint based on the at least one variation; and

storing the thumbprints in a database in memory, the thumbprints being accessible from the database for comparison to a thumbprint of a subsequently received message, wherein the subsequently received message is classified as spam or not spam based on the comparison to the stored thumbprints.

2. The method of claim 1, wherein the content is an image.

3. The method of claim 2, wherein each number characterizes an aspect of the image.

4. The method of claim 3, wherein at least one of the numbers characterizes a color of a specified part of the image.

5. The method of claim 3, wherein one or more numbers characterize a size dimension of the image.

6. The method of claim 3, wherein the variation is selected from a predetermined range relative to one of the numbers.

7. The method of claim 6, further comprising rounding a number of the numerical signature, wherein the predetermined range is relative to the rounded number.

8. The method of claim 1, wherein generating the thumbprints comprises fuzzy hashing of the signature being thumbprinted and fuzzy hashing of the variation being thumbprinted.

9. The method of claim 1, further comprising conducting a search for similar content based on one or more of the stored thumbprints.

10. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for identifying content in electronic messages, the method comprising:

receiving an electronic message classified as spam;

detecting content included in the received electronic message;

identifying metadata for the detected content, the metadata including a numerical signature comprising a concatenation of a plurality of numbers, each number characterizing an aspect of the content;

generating at least one variation for the numerical signature, wherein the variation characterizes a plurality of aspects of content that is different from any content in the received electronic message;

generating a thumbprint based on the numerical signature and a thumbprint based on the at least one variation; and

storing the thumbprints in a database, the thumbprints being accessible from the database for comparison to a thumbprint of a subsequently received message, wherein the subsequently received message is classified as spam or not spam based on the comparison to the stored thumbprints.

11. A method for identifying content in electronic messages, the method comprising:

receiving an electronic message; and

executing instructions stored in memory, wherein execution of the instructions by a processor;

detects content included in the received electronic message,

identifies metadata for the detected content, the metadata including a numerical signature comprising a concatenation of a plurality of numbers, each number characterizing an aspect of the content,

generates at least one variation for the numerical signature, wherein the variation characterizes a plurality of aspects of content that is different from any content in the received electronic message,

generates a thumbprint based on the numerical signature of the metadata and a thumbprint based on the variation, and

compares the generated thumbprints to thumbprint information stored in a database storing thumbprint information associated with each of a plurality of content found in electronic messages previously received and classified as spam, wherein the electronic message is classified as spam or not spam based on the comparison.

12. The method of claim 11, wherein the content is an image.

13. The method of claim 12, wherein each number characterizes an aspect of the image.

14. The method of claim 13, wherein at least one of the numbers characterizes a color of a specified part of the image.

15. The method of claim 13, wherein one or more numbers characterize a size dimension of the image.

16. The method of claim 13, wherein the variation is selected from a predetermined range relative to one of the numbers.

17. The method of claim 16, further comprising rounding a number of the numerical signature, wherein the predetermined range is relative to the rounded number.

18. The method of claim 11, wherein generating the thumbprints comprises fuzzy hashing of the signature being thumbprinted and fuzzy hashing of the variation being thumbprinted.

19. The method of claim 11, further comprising conducting a search for similar content based on one or more of the stored thumbprints.

20. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for identifying content in electronic messages, the method comprising:

receiving an electronic message;

detecting content included in the received electronic message;

identifying metadata for the detected content, the metadata including a numerical signature comprising a concatenation of a plurality of numbers, each number characterizing an aspect of the content;

generating at least one variation for the numerical signature, wherein the variation characterizes a plurality of aspects of content that is different from any content in the received electronic message,

generating a thumbprint based on the numerical signature of the metadata and a thumbprint based on the variation; and

comparing the generated thumbprints to thumbprint information stored in a database storing thumbprint information associated with each of a plurality of content found in electronic messages previously received and classified as spam, wherein the electronic message is classified as spam or not spam based on the comparison.

21. A system for identifying content in electronic messages, the system comprising:

a memory configured to store a database of thumbprint information associated with each of a plurality of content found in electronic messages previously received and classified as spam;

an interface configured to receive an electronic message; and

a processor configured to execute instructions stored in memory, wherein execution of the instructions;

detects content included in the received electronic message,

identifies metadata for the detected content, the metadata including a numerical signature comprising a concatenation of a plurality of numbers, each number characterizing an aspect of the content,

generates at least one variation for the numerical signature, wherein the variation characterizes a plurality of aspects of content that is different from any content in the received electronic message,

generates a thumbprint based on the numerical signature of the metadata and a thumbprint based on the variation, and

compares the thumbprint to the thumbprint information stored in the database, wherein the electronic message is classified as spam or not spam based on the comparison.

22. The system of claim 21, wherein storing thumbprint information from one of the previously received and classified electronic messages comprises:

identifying metadata for content detected in the previously received and classified message, the metadata including a numerical signature characterizing the content;

determining at least one variation for the numerical signature; and

generating a thumbprint based on the numerical signature and a thumbprint based on the at least one variation.