Identification of content by metadata

• US 8,578,485 B2
• Filed: 03/01/2010
• Issued: 11/05/2013
• Est. Priority Date: 12/31/2008
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Yu, Sijie
• Primary Examiner(s): Shaw, Peter
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US12/715,337
• Publication Number:
  US 20100281538A1
• Time in Patent Office: 1,345 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/35 Clustering; Classification
• CPC Class Codes: G06F 16/5838 using colour
• CPC Class Codes: G06F 16/5846 using extracted text
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Systems and methods for identifying content in electronic messages are provided. An electronic message may include certain content. The content is detected and analyzed to identify any metadata. The metadata may include a numerical signature characterizing the content. A thumbprint is generated based on the numerical signature. The thumbprint may then be compared to thumbprints of previously received messages. The comparison allows for classification of the electronic message as spam or not spam.

Claims

1. A method for identifying content in electronic messages, the method comprising:

receiving information regarding an electronic message having been classified as spam, the classification based on one or more thumbprints, wherein deriving each thumbprint comprises;

extracting metadata characterizing one or more images in the electronic message,

generating a numerical signature based on the extracted metadata characterizing the one or more images in the classified message, the numerical signature comprising a plurality of numerical values, each numerical value characterizing a different aspect of the one or more images, the different aspects including dimension, location of color, and intensity of color in a color table, and

compressing the numerical signature;

executing instructions stored in memory, wherein execution of the instructions by a processor searches for matches to the thumbprints of the classified message, wherein the search comprises;

comparing the thumbprints of the classified message to thumbprints associated with a plurality of other electronic messages;

identifying a match between at least one of the thumbprints of the classified message and at least one of the plurality of thumbprints, the at least one thumbprint associated with at least one of the other messages;

retrieving the at least one other electronic message associated with the at least one thumbprint matching the thumbprint of the classified message;

classifying the at least one retrieved electronic message as spam based on the identified match; and

identifying a spam outbreak based on a number of matches identified between the thumbprints of the classified message and thumbprints of the other messages.

2. The method of claim 1, wherein the numerical signature is a concatenation of a plurality of numbers, each number characterizing an aspect of the one or more images in the electronic message.

3. The method of claim 1, wherein the identification of the spam outbreak is further based on a number of the other messages retrieved based on the identified match.

4. The method of claim 3, wherein the plurality of other electronic messages include electronic messages that have been previously classified as spam.

5. The method of claim 1, wherein the electronic message includes content having a format selected from the group consisting of portable document format, Microsoft®

Word, Microsoft Excel, audio, and video.

6. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for identifying content in electronic messages, the method comprising:

receiving information regarding an electronic message having been classified as spam, the classification based on a thumbprints, wherein deriving each thumbprint comprises;

extracting metadata characterizing one or more images in the electronic message,

generating a numerical signature based on the extracted metadata characterizing the one or more images in the electronic message, the numerical signature comprising a plurality of numerical values, each numerical value characterizing a different aspect of the one or more images, the different aspects including dimension, location of color, and intensity of color in a color table, and

compressing the numerical signature; and

searching for matches to the thumbprint of the classified message, wherein the search comprises;

comparing the thumbprint of the classified message to a plurality of thumbprints associated with a plurality of unclassified electronic messages;

identifying a match between the thumbprint of the classified message and at least one of the plurality of thumbprints, the at least one thumbprint associated with at least one of the unclassified messages;

retrieving the at least one unclassified electronic message associated with the at least one thumbprint matching the thumbprint of the classified message;

classifying the at least one retrieved electronic message as spam based on the identified match; and

identifying a spam outbreak based on a number of matches identified between the thumbprints of the classified message and thumbprints of the other messages.

7. The non-transitory computer-readable storage medium of claim 6, wherein the numerical signature is a concatenation of a plurality of numbers, each number characterizing an aspect of the one or more images in the electronic message.

8. The non-transitory computer-readable storage medium of claim 6, wherein the identification of the spam outbreak is further based on a number of the other messages retrieved based on the identified match.

9. The non-transitory computer-readable storage medium of claim 8, wherein the plurality of other electronic messages include electronic messages that have been previously classified as spam.

10. The non-transitory computer-readable storage medium of claim 6, wherein the electronic message includes content having a format selected from the group consisting of portable document format, Microsoft®

Word, Microsoft Excel, audio, and video.

11. A system for identifying content in electronic messages, the system comprising:

a memory configured to store a database of thumbprint information associated with each of a plurality of content found in electronic messages previously received and classified as spam, the classification based on one or more thumbprints, wherein deriving each thumbprint comprises;

extracting metadata characterizing one or more images in the electronic message,

generating a numerical signature based on the extracted metadata characterizing the one or more images in the content, the numerical signature comprising a plurality of numerical values, each numerical value characterizing a different aspect of the one or more images, the different aspects including dimension, location of color, and intensity of color in a color table, and

compressing the numerical signature;

an interface configured to receive an indication regarding an electronic message having been classified as spam; and

a processor configured to execute instructions stored in memory, wherein execution of the instructions searches for matches to the thumbprint of the classified message, wherein the search comprises;

comparing the thumbprints of the classified message to thumbprints associated with a plurality of other electronic messages;

identifying a match between at least one of the thumbprints of the classified message and at least one of the plurality of thumbprints, the at least one thumbprint associated with at least one of the other messages;

retrieving the at least one other electronic message associated with the at least one thumbprint matching the thumbprint of the classified message;

classifying the at least one retrieved electronic message as spam based on the identified match; and

identifying a spam outbreak based on a number of matches identified between the thumbprints of the classified message and thumbprints of the other messages.

12. The system of claim 11, wherein the numerical signature is a concatenation of a plurality of numbers, each number characterizing an aspect of the one or more images in the electronic message.

13. The system of claim 11, wherein the identification of the spam outbreak is further based on a number of the other messages retrieved based on the identified match.

14. The system of claim 13, wherein the plurality of other electronic messages include electronic messages that have been previously classified as spam.

15. The system of claim 11, wherein the electronic message includes content having a format selected from the group consisting of portable document format, Microsoft®

Word, Microsoft Excel, audio, and video.