Identification of content by metadata

• US 8,918,870 B2
• Filed: 11/04/2013
• Issued: 12/23/2014
• Est. Priority Date: 12/31/2008
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Yu, Sijie
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US14/071,192
• Publication Number:
  US 20140059049A1
• Time in Patent Office: 414 Days
• Field of Search: 726/22, 713/176
• US Class Current: 726/22
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/35 Clustering; Classification
• CPC Class Codes: G06F 16/5838 using colour
• CPC Class Codes: G06F 16/5846 using extracted text
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Systems and methods for identifying content in electronic messages are provided. An electronic message may include certain content. The content is detected and analyzed to identify any metadata. The metadata may include a numerical signature characterizing the content. A thumbprint is generated based on the numerical signature. The thumbprint may then be compared to thumbprints of previously received messages. The comparison allows for classification of the electronic message as spam or not spam.

Claims

1. A method for identifying content in electronic messages, the method comprising:

receiving an electronic message over a communication network; and

executing instructions stored in memory, wherein execution of the instructions by a processor;

determines one or more image-based content types of one or more images contained within the electronic message;

associates each of the one or more image-based content types with one or more metadata extraction routines;

extracts metadata from each of the one or more images using the one or more metadata extraction routines;

generates a numerical signature based on the extracted metadata from each of the one or more images, the numerical signature comprising a plurality of numerical values, each numerical value characterizing a different aspect of the one or more images;

generates one or more thumbprints using the numerical signature;

compares the one or more thumbprints to a plurality of thumbprints stored in a thumbprint database, the plurality of thumbprints associated with one or more other electronic messages that have previously been classified as spam;

classifies the electronic message as spam when at least one of the one or more thumbprints matches one of the plurality of thumbprints in the thumbprint database; and

identifies a spam outbreak based on a number of matches identified between the thumbprints of the classified message and thumbprints of the one or more other electronic messages previously classified as spam.

2. The method of claim 1, further comprising:

determining that the electronic message has already been classified as spam;

determining one or more variations on the numerical signature;

generating one or more other thumbprints for each of the one or more variations of the numerical signature; and

classifying each of the one or more thumbprints for each of the one or more variations of the numerical signature as spam.

3. The method of claim 1, further comprising storing the thumbprints in a thumbprint database.

4. The method of claim 1, wherein the thumbprints are compressed.

5. The method of claim 1, further comprising:

determining one or more variations on the numerical signature; and

generating one or more other thumbprints for each of the one or more variations of the numerical signature.

6. The method of claim 5, further comprising:

comparing the thumbprints and the one or more other thumbprints to a plurality of thumbprints stored in a thumbprint database; and

classifying the electronic message as spam when at least one of the thumbprints or the one or more other thumbprints matches one of the plurality of thumbprints in the thumbprint database that is associated with the one or more other electronic messages that are classified as spam.

7. A non-transitory computer readable storage medium having embodied thereon a program executable by a processor to perform a method for identifying content in electronic messages, the method comprising:

receiving an electronic message over a communication network;

determining one or more image-based content types of one or more images contained within the electronic message;

associating each of the one or more image-based content types with one or more metadata extraction routines;

extracting metadata from each of the one or more images using the one or more metadata extraction routines;

generating a numerical signature based on the extracted metadata from each of the one or more images, the numerical signature comprising a plurality of numerical values, each numerical value characterizing a different aspect of the one or more images;

generating one or more thumbprints using the numerical signature;

comparing the thumbprints to a plurality of thumbprints stored in a thumbprint database, the plurality of thumbprints associated with one or more other electronic messages that have previously been classified as spam;

classifying the electronic message as spam when at least one of the one or more thumbprints matches one of the plurality of thumbprints in the thumbprint database; and

identifying a spam outbreak based on a number of matches identified between the thumbprints of the classified message and thumbprints of the one or more other electronic messages previously classified as spam.

8. The non-transitory computer readable storage medium of claim 7, the program being further executable to:

determine whether the electronic message has already been classified as spam;

determine one or more variations on the numerical signature;

generate one or more other thumbprints for each of the one or more variations of the numerical signature; and

classify each of the one or more thumbprints for each of the one or more variations of the numerical signature as spam.

9. The non-transitory computer readable storage medium of claim 7, the program being further executable to store the thumbprints in a thumbprint database.

10. The non-transitory computer readable storage medium of claim 7, wherein the thumbprints are compressed.

11. The non-transitory computer readable storage medium of claim 7, the program being further executable to:

determine one or more variations on the numerical signature; and

generate one or more other thumbprints for each of the one or more variations of the numerical signature.

12. The non-transitory computer readable storage medium claim 11, the program being further executable to:

compare the thumbprints and the one or more other thumbprints to a plurality of thumbprints stored in a thumbprint database; and

classify the electronic message as spam when at least one of the thumbprints or the one or more other thumbprints matches one of the plurality of thumbprints in the thumbprint database that is associated with the one or more other electronic messages that are classified as spam.

13. A system for identifying content in electronic messages, the system comprising:

a communication interface that receives an electronic message over a communication network;

a processor; and

a memory, wherein the processor executes instructions stored in memory, wherein execution of the instructions by the processor;

determines one or more image-based content types of one or more images contained within the electronic message;

associates each of the one or more image-based content types with one or more metadata extraction routines;

extracts metadata from each of the one or more images using the one or more metadata extraction routines;

generates a numerical signature based on the extracted metadata from each of the one or more images, the numerical signature comprising a plurality of numerical values, each numerical value characterizing a different aspect of the one or more images;

generates one or more thumbprints using the numerical signature;

compares the one or more thumbprints to a plurality of thumbprints stored in a thumbprint database, the plurality of thumbprints associated with one or more other electronic messages that have previously been classified as spam;

classifies the electronic message as spam when at least one of the one or more thumbprints matches one of the plurality of thumbprints in the thumbprint database; and

identifies a spam outbreak based on a number of matches identified between the thumbprints of the classified message and thumbprints of the one or more other messages previously classified as spam.

14. The system of claim 13, wherein the processor executing instructions out of memory:

compares the thumbprints to a plurality of thumbprints stored in a thumbprint database; and

classifies the electronic message as spam when at least one of the thumbprints matches one of the plurality of thumbprints in the thumbprint database that is associated with the one or more other electronic messages that are classified as spam.

15. The system of claim 13, wherein the processor executing instructions out of memory:

determines one or more variations on the numerical signature;

generates one or more other thumbprints for each of the one or more variations of the numerical signature; and

classifies each of the one or more thumbprints for each of the one or more variations of the numerical signature as spam.

16. The system of claim 13, wherein the processor executing instructions out of memory:

determines one or more variations on the numerical signature; and

generates one or more other thumbprints for each of the one or more variations of the numerical signature.