Using distinguishing properties to classify messages

• US 20040167968A1
• Filed: 02/20/2003
• Published: 08/26/2004
• Est. Priority Date: 02/20/2003
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: MailFrontier Incorporated (SonicWall Holdings Ltd.)
• Inventors: Wilson, Brian K., Koblas, David A., Penzias, Arno A.
• Granted Patent: US 8,266,215 B2
• Time in Patent Office: Days
• US Class Current: 709/207
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying in the message a distinguishing property; generating a signature using the distinguishing property; and comparing the signature to a database of signatures generated by previously classified messages.

Claims

1. A method for classifying a message comprising:

receiving the message;

identifying in the message a distinguishing property;

generating a signature using the distinguishing property; and

comparing the signature to a database of signatures generated by previously classified messages.

2. A method for classifying a message as recited in claim 1 wherein the distinguishing property includes contact information.

3. A method for classifying a message as recited in claim 1 wherein the distinguishing property includes contact information;

and the contact information includes an email address.

4. A method for classifying a message as recited in claim 1 wherein the distinguishing property includes contact information;

and the contact information includes a telephone number.

5. A method for classifying a message as recited in claim 1 wherein the distinguishing property includes contact information;

and the contact information includes a universal resource locator (URL).

6. A method for classifying a message as recited in claim 1 wherein the distinguishing property includes contact information;

and the contact information includes an Internet Protocol (IP) address.

7. A method for classifying a message as recited in claim 1 wherein the distinguishing property includes contact information;

and the contact information includes a domain name.

8. A method for classifying a message as recited in claim 1 wherein the distinguishing property includes a name.

9. A method for classifying a message as recited in claim 1 wherein the distinguishing property includes a stock ticker symbol.

10. A method for classifying a message as recited in claim 1 wherein the distinguishing property includes instructions for performing a task.

11. A method for classifying a message as recited in claim 1 further including determining whether the signature exists in a database of previously stored signatures.

12. A method for classifying a message as recited in claim 1 further including determining whether the signature exists in a database of previously stored signatures;

and in the event that the signature does not exist in the database, adding the signature to the database.

13. A method for classifying a message as recited in claim 1 further including adding the signature to a database.

14. A method for classifying a message as recited in claim 1 further including adding the signature to a database;

wherein the database tracks the number of times the message has been identified as junk message.

15. A method for classifying a message as recited in claim 1 further including adding the signature to a database;

wherein the database tracks the number of times the message has been identified as junk message and the database is located on a mail device.

16. A method for classifying a message as recited in claim 1 further including adding the signature to a database;

wherein the database is located on a server.

17. A method for classifying a message as recited in claim 1 further including adding the signature to a database;

wherein the database is located on a network accessible by a spam-blocking server.

18. A method for classifying a message as recited in claim 1 wherein the signature is transferred to a database using an XML based protocol.

19. A method for classifying a message as recited in claim 1 wherein generating the signature includes performing a hash function on the distinguishing property.

20. A method for classifying a message as recited in claim 1 wherein generating the signature includes performing a hash function on the distinguishing property;

and the hash function is a SHA function.

21. A method for classifying a message as recited in claim 1 wherein generating the signature includes performing a hash function on the distinguishing property;

and the hash function is an MD5 function.

22. A method for classifying a message as recited in claim 1 wherein generating the signature includes performing a hash function on the distinguishing property and the hash function is a checksum function.

23. A method for classifying a message as recited in claim 1 wherein the signature is generate for distinguishing properties that meet a minimum byte requirement.

24. A method for classifying a message as recited in claim 1 wherein identifying the distinguishing property comprises preprocessing the message to remove non-essential information.

25. A method for classifying a message as recited in claim 1 wherein identifying the distinguishing property comprises processing the message to exclude decoy information.

26. A computer program product for classifying a message, the computer program product being embodied in a computer readable medium and comprising computer instructions for:

receiving the message;

identifying in the message an distinguishing property;

generating a signature using the distinguishing property; and

comparing the signature to a database of signatures generated by previously classified messages.

27. A system for classifying a message comprising:

an interface configured to receive a message; and

a processor configured to;

identify in the message a distinguishing property;

generate a signature using the distinguishing property; and

compare the signature to a database of signatures generated by previously classified messages.

28. A method for classifying a message comprising:

receiving the message;

receiving a classification of the message;

identifying in the message a distinguishing property;

generating a signature using the distinguishing property;

submitting the signature to a database.