SYSTEM AND METHOD FOR DETECTING EMAIL CONTENT CONTAINMENT

• US 20090089539A1
• Filed: 03/31/2008
• Published: 04/02/2009
• Est. Priority Date: 09/30/2007
• Status: Active Grant

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Bunker, Guy Barry Owen, Ngan, Tsuen Wan
• Granted Patent: US 8,037,145 B2
• Time in Patent Office: Days
• US Class Current: 711/216
• CPC Class Codes: G06F 16/3331 Query processing

Abstract

Systems and methods for detecting email content containment are disclosed. In one embodiment, a method comprises generating a first set of hash values corresponding to a first email document, wherein the first set includes a respective hash value corresponding to each of a plurality of character sequences of the first email document. The method further comprises generating a second set of hash values corresponding to a second email document, wherein the second set include a respective hash value corresponding to each of a plurality of character sequences of the second email document, and determining whether the first set of hash values is a subset of the second set of hash values.

Claims

1. A method, comprising:

generating a first set of hash values corresponding to a first email document, wherein the first set includes a respective hash value corresponding to each of a plurality of character sequences of the first email document;

generating a second set of hash values corresponding to a second email document, wherein the second set includes a respective hash value corresponding to each of a plurality of character sequences of the second email document; and

determining whether the first set of hash values forms a smaller subset of the second set of hash values.

2. The method of claim 1, wherein each of the plurality of character sequences of the first email document is a respective paragraph of the first email document, and wherein each of the plurality of character sequences of the second email document is a respective paragraph of the second email document.

3. The method of claim 1, further comprising:

generating a first bloom filter representing the first set of hash values corresponding to the first email document; and

generating a second bloom filter representing the second set of hash values corresponding to the second email document;

wherein said determining includes comparing the first bloom filter with the second bloom filter.

4. The method of claim 2, wherein said determining includes performing a bitwise OR operation on the first and second bloom filters.

5. The method of claim 4, further comprising providing an indication of whether content of the first email document may be contained within the second email document based on a result of said determining.

6. The method of claim 1, further comprising providing an indication of whether content of the first email document may be contained within the second email document based on a result of said determining.

7. A computer-readable memory medium storing program instructions that are computer-executable to:

generate a first set of hash values corresponding to a first email document, wherein the first set includes a respective hash value corresponding to each of a plurality of character sequences of the first email document;

generate a second set of hash values corresponding to a second email document, wherein the second set includes a respective hash value corresponding to each of a plurality of character sequences of the second email document; and

determine whether the first set of hash values forms a smaller subset of the second set of hash values.

8. The computer-readable memory medium of claim 7, wherein each of the plurality of character sequences of the first email document is a respective paragraph of the first email document, and wherein each of the plurality of character sequences of the second email document is a respective paragraph of the second email document.

9. The computer-readable memory medium of claim 7, wherein the program instructions further are computer-executable to:

generate a first bloom filter representing the first set of hash values corresponding to the first email document;

generate a second bloom filter representing the second set of hash values corresponding to the second email document; and

wherein determining whether the first set of hash values forms a smaller subset of the second set of hash values includes comparing the first bloom filter with the second bloom filter.

10. The computer-readable memory medium of claim 9, wherein the program instructions are further computer-executable to provide an indication of whether content of the first email document may be contained within the second email document based on comparing the first and second bloom filters.

11. The computer-readable memory medium of claim 9, wherein the program instructions are computer-executable to compare the first and second bloom filters by performing a bitwise OR operation.

12. The computer-readable memory medium of claim 7, wherein the program instructions are further computer-executable to disregard predetermined content of the first and second email documents.

13. The computer-readable memory medium of claim 12, wherein the predetermined content includes email header information.

14. A system, comprising:

one or more processors

memory storing program instructions that are computer-executable by the one or more processors to;

generate a first set of hash values corresponding to a first email document, wherein the first set includes a respective hash value corresponding to each of a plurality of character sequences of the first email document;

generate a second set of hash values corresponding to a second email document, wherein the second set includes a respective hash value corresponding to each of a plurality of character sequences of the second email document; and

determine whether the first set of hash values forms a smaller subset of the second set of hash values.

15. The system of claim 14, wherein each of the plurality of character sequences of the first email document is a respective paragraph of the first email document, and wherein each of the plurality of character sequences of the second email document is a respective paragraph of the second email document.

16. The system of claim 14, wherein the program instructions are further executable to:

generate a first bloom filter representing the first set of hash values corresponding to the first email document; and

generate a second bloom filter representing the second set of hash values corresponding to the second email document;

wherein determining whether the first set of hash values forms a smaller subset of the second set of hash values includes comparing the first bloom filter with the second bloom filter.

17. The system of claim 16, wherein the program instructions are executable to compare the first and second bloom filters by performing a bitwise OR operation.

18. The system of claim 14, wherein the program instructions are further executable to disregard one or more hash values in the first or second sets when determining whether the first set of hash values forms a smaller subset of the second set of hash values.

19. The system of claim 14, wherein the program instructions are further executable to identify the second email document as response to the first email document based on determining that the first set of hash values forms a smaller subset of the second set of hash values.

20. The system of claim 14, wherein one or more of the hash values of the first and second sets are generated using an MD5 or SHA-1 hashing algorithm.