Methods and apparatus for detecting spam messages in an email system

• US 8,880,611 B1
• Filed: 06/30/2004
• Issued: 11/04/2014
• Est. Priority Date: 06/30/2004
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Lim, Jing Yee, Golub, Seth, Cutts, Matthew Daniell
• Primary Examiner(s): SERRAO, RANODHI N
• Application Number:
  US10/882,939
• Time in Patent Office: 3,779 Days
• Field of Search: 709/204, 709/205, 709/206, 709/207
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A spam detector accesses a message body of an email, extracts one or more features of a return path from the message body, and uses the extracted features to detect the return path for a user to respond to the email. The return path may include a postal address, and the extracted feature may comprise one or more of a complete or partial street name, city name, state name, country name, street number address, postal code, designations for post office box, and post office box number.

Claims

1. A method for detecting spam, comprising:

at a server system that executes spam detection software so as to classify an email message;

accessing a message body of the email message;

extracting a plurality of features of a return path existing in the message body, the return path for use by a recipient of the email to respond to a message in the email;

generating a reconstructed return path from the plurality of extracted features of the return path existing in the message body of the email message, wherein the return path is a postal address, and the extracted features are postal address sub-features comprising a plurality of address components selected from the group consisting of;

complete or partial street name, city name, state name, country name, street number address, postal code, designations for post office box, and post office box number; and

classifying the email in accordance with at least the reconstructed return path;

wherein extracting a plurality of return path features includes extracting a first postal address sub-feature that is separated from a second postal address sub-feature by one or more non-postal address terms in the message body.

2. The method of claim 1 further comprising testing the reconstructed return path against existing information to determine a probability that the email is spam.

3. The method of claim 2 further comprising using dynamic Internet searching in the testing.

4. The method of claim 2 further comprising using information from a data repository dynamically updated by Web-searching to make the determination of probability.

5. The method of claim 2, further comprising applying weighting factors to the return path to create a trust characteristic for the return path.

6. A non-transitory machine-readable medium having stored thereon a set of instructions that are executed by a server system so as to perform a method comprising:

accessing a body portion of an email message;

extracting a plurality of features of a return path from the body portion of the email message;

generating a reconstructed return path from the plurality of extracted features of the return path existing in the body portion of the email message, wherein the return path is a postal address, and the extracted features are postal address sub-features comprising a plurality of address components selected from the group consisting of;

complete or partial street name, city name, state name, country name, street number address, postal code, designations for post office box, and post office box number; and

classifying the email in accordance with at least the reconstructed return path;

wherein extracting a plurality of return path features includes extracting a first postal address sub-feature that is separated from a second postal address sub-feature by one or more non-postal address terms in the message body.

7. The medium of claim 6 further comprising instructions for testing the reconstructed return path against existing information to determine a probability that the email is spam.

8. The medium of claim 7 further comprising instructions for using dynamic Internet searching in the testing.

9. The medium of claim 7 further comprising instructions for using information from a data repository dynamically updated by Web searching to make the determination of probability.

10. The medium of claim 7, further comprising instructions for applying weighting factors to the return path to create a trust characteristic for the return path.

11. A method for detecting spam, comprising:

at a server system that executes spam detection software so as to classify email message;

accessing a message body of an email;

extracting a plurality of return path features from the message body, wherein at least one of the extracted return path features is a postal address feature comprising a plurality of address sub-features selected from the group consisting of;

complete or partial street name, city name, state name, country name, street number address, postal code, designations for post office box, and post office box number;

combining values for the extracted return path features, including the postal address sub-features, in accordance with a weighting scheme for the extracted return path features, including the postal address sub-features, to produce a result; and

classifying the email based on the result;

wherein extracting a plurality of return path features includes extracting a first postal address sub-feature that is separated from a second postal address sub-feature by one or more non-postal address terms in the message body.

12. The method of claim 11 further comprising testing the extracted return path features against existing information to determine a probability that the email is spam.

13. The method of claim 12 further comprising using dynamic Internet searching in the testing.

14. The method of claim 12 further comprising using information from a data repository dynamically updated by Web searching to make the determination of probability.

15. A non-transitory machine-readable medium having stored thereon a set of instructions that are executed by a server system so as to perform a method comprising:

accessing a message body of an email;

extracting a plurality of return path features from the message body, wherein at least one of the extracted return path features is a postal address feature comprising a plurality of address sub-features selected from the group consisting of;

complete or partial street name, city name, state name, country name, street number address, postal code, designations for post office box, and post office box number;

combining values for the extracted return path features, including the postal address sub-features, in accordance with a weighting scheme for the extracted return path features, including the postal address sub-features, to produce a result; and

classifying the email based on the result;

wherein extracting a plurality of return path features includes extracting a first postal address sub-feature that is separated from a second postal address sub-feature by one or more non-postal address terms in the message body.

16. The machine-readable medium of claim 15 further comprising instructions for testing the extracted return path features against existing information to determine a probability that the email is spam.

17. The machine-readable medium of claim 16 further comprising instructions for using dynamic Internet searching in the testing.

18. The machine-readable medium of claim 16 further comprising instructions for using information from a data repository dynamically updated by Web searching to make the determination of probability.