Identification of content by metadata

• US 9,231,767 B2
• Filed: 12/23/2014
• Issued: 01/05/2016
• Est. Priority Date: 12/31/2008
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Yu, Sijie
• Primary Examiner(s): Rashid, Harunur
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US14/581,717
• Publication Number:
  US 20150180670A1
• Time in Patent Office: 378 Days
• Field of Search: 726/22
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/35 Clustering; Classification
• CPC Class Codes: G06F 16/5838 using colour
• CPC Class Codes: G06F 16/5846 using extracted text
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Systems and methods for identifying content in electronic messages are provided. An electronic message may include certain content. The content is detected and analyzed to identify any metadata. The metadata may include a numerical signature characterizing the content. A thumbprint is generated based on the numerical signature. The thumbprint may then be compared to thumbprints of previously received messages. The comparison allows for classification of the electronic message as spam or not spam.

Claims

1. A method for identifying content in electronic messages, the method comprising:

receiving a first electronic message over a communication network;

extracting metadata characterizing one or more images in the first electronic message, the extracted metadata comprising a plurality of numerical values, each numerical value characterizing a different aspect of the one or more images;

adjusting a subset comprising one or more of the plurality of numerical values from the extracted metadata, wherein each numerical value in the subset is adjusted by a numerical difference value that falls within a pre-specified range;

generating a variation thumbprint based on the extracted metadata, the variation thumbprint based on the adjusted numerical values, wherein the variation thumbprint is stored in association with the extracted metadata from the first electronic message;

searching for one or more thumbprints matching the variation thumbprint of the first electronic message; and

classifying one or more electronic messages associated with the matching thumbprints, the electronic messages classified based on a classification of the first electronic message.

2. The method of claim 1, wherein a first numerical value of the plurality of numerical values characterizes a first aspect of a first image of the one or more images in the first electronic message, where the first aspect is one of a width dimension or a height dimension of the first image.

3. The method of claim 1, wherein a first numerical value of the plurality of numerical values characterizes a first aspect of a first image of the one or more images in the first electronic message, where the first aspect is one of a color location or a color intensity within a color table of the first image.

4. The method of claim 1, wherein one or more of the matching electronic messages are received after the first electronic message is received.

5. The method of claim 1, wherein one or more of the matching electronic messages are received before the first electronic message is received.

6. The method of claim 1, further comprising storing the variation thumbprint in a thumbprint database.

7. The method of claim 1, further comprising:

generating a first thumbprint based on the plurality of numerical values;

searching for one or more thumbprints matching the first thumbprint; and

associating the first thumbprint with the variation thumbprint, wherein one or more electronic messages associated with the thumbprints matching the first thumbprint is also classified based on the classification of the first electronic message.

8. The method of claim 7, further comprising storing the first thumbprint in a thumbprint database.

9. A system for identifying content in electronic messages, the system comprising:

a hardware processor coupled to a memory, wherein the processor executes;

a content filter executable to detect one or more images within a first electronic message received over a communication network,

a metadata analyzer executable to extract metadata characterizing the one or more images within the first electronic message, the extracted metadata comprising a plurality of numerical values, each numerical value characterizing a different aspect of the one or more images,

a thumbprint generator executable to;

adjust a subset comprising one or more of the plurality of numerical values from the extracted metadata, wherein each numerical value in the subset is adjusted by a numerical difference value that falls within a pre-specified range,

generate a variation thumbprint based on the extracted metadata, and search for thumbprints matching the variation thumbprint of the first electronic message, and

classify one or more electronic messages associated with the matching thumbprints, the electronic messages classified based on a classification of the first electronic message; and

wherein the memory stores the variation thumbprint in association with the extracted metadata from the first electronic message.

10. The system of claim 9, wherein a first numerical value of the plurality of numerical values characterizes a first aspect of a first image of the one or more images in the first electronic message, where the first aspect is one of a width dimension or a height dimension of the first image.

11. The system of claim 9, wherein a first numerical value of the plurality of numerical values characterizes a first aspect of a first image of the one or more images in the first electronic message, where the first aspect is one of a color location or a color intensity within a color table of the first image.

12. The system of claim 9, wherein one or more of the matching electronic messages that is classified by the classifier is received after the first electronic message is received.

13. The system of claim 9, wherein one or more of the matching electronic messages that is classified by the classifier is received before the first electronic message is received.

14. The system of claim 9, wherein the memory further stores the variation thumbprint in a thumbprint database.

15. The system of claim 9, wherein the thumbprint generator, is further executed by the processor to generate a first thumbprint based on the plurality of numerical values.

16. The system of claim 15, wherein the classifier is further executed by the processor to:

search for one or more thumbprints matching with the first thumbprint, and

associate the first thumbprint with the variation thumbprint, wherein one or more electronic messages associated with the thumbprints matching the first thumbprint is also classified based on the classification of the first electronic message.

17. The system of claim 15, wherein the memory further stores the first thumbprint in a thumbprint database.

18. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for identifying content in electronic messages, the method comprising:

receiving a first electronic message over a communication network;

extracting metadata characterizing one or more images in the first electronic message, the extracted metadata comprising a plurality of numerical values, each numerical value characterizing a different aspect of the one or more images;

adjusting a subset comprising one or more of the plurality of numerical values from the extracted metadata, wherein each numerical value in the subset is adjusted by a numerical difference value that falls within a pre-specified range;

generating a variation thumbprint based on the extracted metadata, the variation thumbprint based on the adjusted numerical values, wherein the variation thumbprint is stored in association with the extracted metadata from the first electronic message,

searching for thumbprints matching the variation thumbprint of the first electronic message; and

classifying one or more electronic messages associated with the matching thumbprints, the electronic messages classified based on a classification of the first electronic message.