Apparatus and method to identify SPAM emails

• US 20060047760A1
• Filed: 08/27/2004
• Published: 03/02/2006
• Est. Priority Date: 08/27/2004
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Winarski, Daniel J., Encinas, Susan
• Granted Patent: US 7,500,265 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method and apparatus to identity SPAM emails is disclosed. The method sets a misspelling rejection ratio. Upon receipt of an email comprising (X) words, the method determines the number (Y) of misspelled words comprising that email. The method then calculates a misspelling ratio by dividing (Y) by (X), and then determines if the misspelling ratio is greater than or equal to the misspelling rejection ratio. If the method determines that the misspelling ratio is greater than or equal to the misspelling rejection ratio, then the method reports the email as SPAM. In certain embodiments, the detection of words used to trigger the rejection of SPAM is based on a fuzzy search of alternate spellings. These alternate spellings may come from a spell checker.

Claims

1. A method to identity SPAM emails, comprising the steps of:

setting a misspelling rejection ratio;

receiving an email comprising (X) words;

determining the number (Y) of misspelled words comprising said email;

calculating the misspelling ratio by dividing (Y) by (X);

determining if said misspelling ratio is greater than or equal to said misspelling rejection ratio;

operative if said misspelling ratio is greater than or equal to said misspelling rejection ratio, reporting said email as SPAM.

2. The method of claim 1, further comprising the steps of:

providing a pseudo user device capable of communicating with a user device;

receiving said email by said pseudo user device;

operative if said misspelling ratio is not greater than or equal to said misspelling rejection ratio, providing said email by said pseudo user device to said user device.

3. The method of claim 2, further comprising the step of operative if said misspelling ratio is not greater than or equal to said misspelling rejection ratio, performing a fuzzy word screen of said email.

4. The method of claim 3, wherein said performing a fuzzy word screen step comprises the following steps:

providing a library of prohibited words, an identity count, and a non-identity count, wherein said identity count and said non-identity count are initially set to 0;

setting a rejection identity count/non-identity count ratio;

selecting the (k)th word from said email, wherein (k) is greater than or equal to 1 and less than or equal to (X);

determining that the (k)th word comprises (A) characters;

retrieving from said library (M) prohibited words comprising (A) characters;

selecting the (j)th prohibited word, wherein (j) is greater than or equal to 1 and less than or equal to (M);

comparing, for each value of (m), the (m)th character of the (k)th email word with the (m)th character of the (j)th prohibited word, wherein (m) is greater than or equal to 1 and less than or equal to (A);

operative if the (m)th character of the (k)th email word is the same as the (m)th character of the (j)th prohibited word, incrementing said identity count;

operative if the (m)th character of the (k)th email word is not the same as the (m)th character of the (j)th prohibited word, incrementing said non-identity count;

calculating an actual identity count/non-identity count ratio;

determining if said actual identity count/non-identity count ratio is greater than or equal to said rejection identity count/non-identity count ratio;

operative if said actual identity count/non-identity count ratio is greater than or equal to said rejection identity count/non-identity count ratio, reporting said email as SPAM.

5. The method of claim 4, further comprising the step of operative if said actual identity count/non-identity count ratio is greater than or equal to said rejection identity count/non-identity count ratio, resetting said identity count and said non-identity count to 0.

6. The method of claim 4, further comprising the steps of:

operative if said actual identity count/non-identity count ratio is less than said rejection identity count/non-identity count ratio;

providing said email to said user device; and

resetting said identity count and said non-identity count to 0.

7. The method of claim 4, further comprising the steps of:

providing a prohibited word library wherein one or more of those prohibited words are designated highly prohibited words;

providing a database which includes characters comprising variants of one or more letters;

operative if the (m)th character of the (k)th email word is not the same as the (m)th character of the (j)th prohibited word, determining if the (j)th prohibited word comprises a highly prohibited word;

operative if the (j)th prohibited word comprises a highly prohibited word, determining if the (m)th character of the (k)th email word is a variant of the (m)th character of the (j)th prohibited word;

operative if the (m)th character of the (k)th email word is a variant of the (m)th character of the (j)th prohibited word, incrementing said identity count;

operative if the (m)th character of the (k)th email word is not a variant of the (m)th character of the (j)th prohibited word, incrementing said non-identity count.

12. The article of manufacture of claim 11, said computer readable program code further comprising a series of computer readable program steps to effect if said actual identity count/non-identity count ratio is greater than or equal to said rejection identity count/non-identity count ratio, resetting said identity count and said non-identity count to 0.

13. The article of manufacture of claim 11, said computer readable program code further comprising a series of computer readable program steps to effect:

operative if said actual identity count/non-identity count ratio is less than said rejection identity count/non-identity count ratio;

providing said email to said user device; and

resetting said identity count and said non-identity count to 0.

14. The article of manufacture of claim 4, wherein said article of manufacture further comprises a prohibited word library wherein one or more of those prohibited words are designated highly prohibited words and a database which includes characters comprising variants of one or more letters, said computer readable program code further comprising a series of computer readable program steps to effect:

operative if the (m)th character of the (k)th email word is not the same as the (m)th character of the (j)th prohibited word, determining if the (j)th prohibited word comprises a highly prohibited word;

operative if the (j)th prohibited word comprises a highly prohibited word, determining if the (m)th character of the (k)th email word is a variant of the (m)th character of the (j)th prohibited word;

operative if the (m)th character of the (k)th email word is a variant of the (m)th character of the (j)th prohibited word, incrementing said identity count;

operative if the (m)th character of the (k)th email word is not a variant of the (m)th character of the (j)th prohibited word, incrementing said non-identity count.

8. An article of manufacture comprising a computer useable medium having computer readable program code disposed therein to identity SPAM emails, the computer readable program code comprising a series of computer readable program steps to effect:

retrieving a pre-determined misspelling rejection ratio;

receiving an email comprising (X) words;

determining the number (Y) of misspelled words comprising said email;

calculating the misspelling ratio by dividing (Y) by (X);

determining if said misspelling ratio is greater than or equal to said misspelling rejection ratio;

operative if said misspelling ratio is greater than or equal to said misspelling rejection ratio, reporting said email as SPAM.

9. The article of manufacture of claim 8, wherein said article of manufacture is capable of communicating with a user device, said computer readable program code further comprising a series of computer readable program step to effect if said misspelling ratio is not greater than or equal to said misspelling rejection ratio, providing said email by said article of manufacture to said user device.

10. The article of manufacture of claim 8, said computer readable program code further comprising a series of computer readable program steps to effect if said misspelling ratio is not greater than or equal to said misspelling rejection ratio, performing a fuzzy word screen of said email.

11. The article of manufacture of claim 10, wherein said article of manufacture further comprises a library of prohibited words, and wherein the computer readable program code to perform a fuzzy word screen step further comprises a series of computer readable program step to effect:

maintaining an identity count, and a non-identity count, wherein said identity count and said non-identity count are initially set to 0;

retrieving a pre-determined rejection identity count/non-identity count ratio;

selecting the (k)th word from said email, wherein said (k)th word comprises (A) characters, and wherein (k) is greater than or equal to 1 and less than or equal to (X);

retrieving from said library (M) prohibited words comprising (A) characters;

selecting the (j)th prohibited word, wherein (j) is greater than or equal to 1 and less than or equal to (M);

comparing, for each value of (m), the (m)th character of the (k)th email word with the (m)th character of the (j)th prohibited word, wherein (m) ;

s greater than or equal to 1 and less than or equal to (A);

operative if the (m)th character of the (k)th email word is the same as the (m)th character of the (j)th prohibited word, incrementing said identity count;

operative if the (m)th character of the (k)th email word is not the same as the (m)th character of the (j)th prohibited word, incrementing said non-identity count;

calculating an actual identity count/non-identity count ratio;

determining if said actual identity count/non-identity count ratio is greater than or equal to said rejection identity count/non-identity count ratio;

operative if said actual identity count/non-identity count ratio is greater than or equal to said rejection identity count/non-identity count ratio, reporting said email as SPAM.

15. A computer program product usable with a programmable computer processor having computer readable program code embodied therein to identity SPAM emails, comprising:

computer readable program code which causes said programmable computer processor to retrieve a pre-determined misspelling rejection ratio;

computer readable program code which causes said programmable computer processor to receive an email comprising (X) words;

computer readable program code which causes said programmable computer processor to determine the number (Y) of misspelled words comprising said email;

computer readable program code which causes said programmable computer processor to calculate the misspelling ratio by dividing (Y) by (X);

computer readable program code which causes said programmable computer processor to determine if said misspelling ratio is greater than or equal to said misspelling rejection ratio;

computer readable program code which, if said misspelling ratio is greater than or equal to said misspelling rejection ratio, causes said programmable computer processor to report said email as SPAM.

16. The computer program product of claim 15, further comprising computer readable program code which, if said misspelling ratio is not greater than or equal to said misspelling rejection ratio, causes said programmable computer processor to provide said email to a user device.

17. The computer program product of claim 15, further comprising:

a library of prohibited words;

computer readable program code which causes said programmable computer processor to maintain an identity count, and a non-identity count, wherein said identity count and said non-identity count are initially set to 0;

computer readable program code which causes said programmable computer processor to retrieve a pre-determined rejection identity count/non-identity count ratio;

computer readable program code which causes said programmable computer processor to select the (k)th word from said email, wherein said (k)th word comprises (A) characters, and wherein (k) is greater than or equal to 1 and less than or equal to (X);

computer readable program code which causes said programmable computer processor to retrieve from said library (M) prohibited words comprising (A) characters;

computer readable program code which causes said programmable computer processor to select the (j)th prohibited word, wherein (j) is greater than or equal to 1 and less than or equal to (M);

computer readable program code which causes said programmable computer processor to compare, for each value of (m), the (m)th character of the (k)th email word with the (m)th character of the (j)th prohibited word, wherein (m) is greater than or equal to 1 and less than or equal to (A);

computer readable program code which, if the (m)th character of the (k)th email word is the same as the (m)th character of the (j)th prohibited word, causes said programmable computer processor to increment said identity count;

computer readable program code which, if the (m)th character of the (k)th email word is not the same as the (m)th character of the (j)th prohibited word, causes said programmable computer processor to increment said non-identity count;

computer readable program code which causes said programmable computer processor to calculate an actual identity count/non-identity count ratio;

computer readable program code which causes said programmable computer processor to determine if said actual identity count/non-identity count ratio is greater than or equal to said rejection identity count/non-identity count ratio;

computer readable program code which, if said actual identity count/non-identity count ratio is greater than or equal to said rejection identity count/non-identity count ratio, causes said programmable computer processor to report said email as SPAM.

18. The computer program product of claim 17, further comprising computer readable program code which, if said actual identity count/non-identity count ratio is greater than or equal to said rejection identity count/non-identity count ratio, causes said programmable computer processor to reset said identity count and said non-identity count to 0.

19. The computer program product of claim 17, further comprising computer readable program code which, if said actual identity count/non-identity count ratio is less than said rejection identity count/non-identity count ratio, causes said programmable computer processor to:

providing said email to said user device; and

resetting said identity count and said non-identity count to 0.

20. The computer program product of claim 17, further comprising:

a prohibited word library wherein one or more of those prohibited words are designated highly prohibited words and a database which includes characters comprising variants of one or more letters;

comprising computer readable program code which, if the (m)th character of the (k)th email word is not the same as the (m)th character of the (j)th prohibited word, causes said programmable computer processor to determine if the (j)th prohibited word comprises a highly prohibited word;

comprising computer readable program code which, if the (j)th prohibited word comprises a highly prohibited word, causes said programmable computer processor to determine if the (m)th character of the (k)th email word is a variant of the (m)th character of the (j)th prohibited word;

comprising computer readable program code which, if the (m)th character of the (k)th email word is a variant of the (m)th character of the (j)th prohibited word, causes said programmable computer processor to increment said identity count;

comprising computer readable program code which, if the (m)th character of the (k)th email word is not a variant of the (m)th character of the (j)th prohibited word, causes said programmable computer processor to increment said non-identity count.