SYSTEM AND METHOD FOR EFFICIENTLY FINDING EMAIL SIMILARITY IN AN EMAIL REPOSITORY

• US 20090319506A1
• Filed: 06/19/2008
• Published: 12/24/2009
• Est. Priority Date: 06/19/2008
• Status: Abandoned Application

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Ngan, Tsuen Wan
• Application Number:
  US12/142,546
• Publication Number:
  US 20090319506A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

Systems and methods for efficiently identifying emails with content similarity are disclosed. In one embodiment, a method comprises grouping a first set of a plurality of email documents with only common-type subsets of character sequences in a first searchable group, and grouping a second set of the plurality of email documents with one or more uncommon-type subsets of character sequences in a second searchable group. The method further comprises selectively searching either only one of or both of the first and second searchable groups, and identifying selected one or more email documents of the plurality of email documents that may contain content that is similar to the particular email document based on the searching.

Claims

1. A method, comprising:

identifying, for each email document of a plurality of email documents, whether each subset of one or more subsets of character sequences within the email document is a common-type subset of character sequences or an uncommon-type subset of character sequences;

grouping a first set of the plurality of email documents with only common-type subsets of character sequences in a first searchable group;

grouping a second set of the plurality of email documents with one or more uncommon-type subsets of character sequences in a second searchable group;

identifying whether each subset of character sequences in a particular email document to be evaluated is a common-type or an uncommon-type subset of character sequences;

selectively searching either only one of or both of the first and second searchable groups depending upon whether the particular email contains only common-type subsets of character sequences, only uncommon-type subsets of character sequences, or a combination of common-type and uncommon-type subsets of character sequences; and

identifying selected one or more email documents of the plurality of email documents that may contain content that is similar to the particular email document based on the searching.

2. The method of claim 1, wherein each subset of character sequences is a paragraph.

3. The method of claim 1, wherein the searching is both the first and second searchable groups if the particular email document contains only common-type subsets of character sequences, and wherein the searching is only the second searchable group if the particular email document contains only uncommon-type subsets of character sequences or a combination of common-type and uncommon-type subsets of character sequences.

4. The method of claim 1, wherein the searching is only the first searchable group if the particular email document contains only common-type subsets of character sequences, wherein the searching is only the second searchable group if the particular email document contains only uncommon-type subsets of character sequences, and wherein the searching is both the first and second group if the particular email document contains a combination of common-type and uncommon-type subsets of character sequences.

5. The method of claim 1, further comprising:

generating a first set of hash values corresponding to the particular email document, wherein the first set includes a respective hash value corresponding to each of the subsets of character sequences of the particular email document;

generating a second set of hash values corresponding to one of the identified, selected one or more email documents, wherein the second set includes a respective hash value corresponding to each of the subsets of character sequences of the identified, selected email document; and

comparing the first set of hash values with the second set of hash values.

6. The method claim 5, wherein one or more of the hash values of the first and second sets are generated using an MD5 or SHA-1 hashing algorithm.

7. The method of claim 5, further comprising:

generating a first bloom filter representing the first set of hash values corresponding to the particular email document;

generating a second bloom filter representing the second set of hash values corresponding to the identified, selected email document; and

wherein the comparing includes comparing the first bloom filter with the second bloom filter.

8. A computer readable medium storing program instructions that are computer executable to:

identify, for each email document of a plurality of email documents, whether each subset of one or more subsets of character sequences within the email document is a common-type subset of character sequences or an uncommon-type subset of character sequences;

group a first set of the plurality of email documents with only common-type subsets of character sequences in a first searchable group;

group a second set of the plurality of email documents with one or more uncommon-type subsets of character sequences in a second searchable group;

identify whether each subset of character sequences in a particular email document to be evaluated is a common-type or an uncommon-type subset of character sequences;

selectively search either only one of or both of the first and second searchable groups depending upon whether the particular email contains only common-type subsets of character sequences, only uncommon-type subsets of character sequences, or a combination of common-type and uncommon-type subsets of character sequences; and

identify selected one or more email documents of the plurality of email documents that may contain content that is similar to the particular email document based on the search.

9. The computer readable medium of claim 9, wherein each subset of character sequences is a paragraph.

10. The computer readable medium of claim 9, wherein the program instructions are executable to search only the second searchable group if the particular email document contains at least one uncommon-type subset of character sequences.

11. The computer readable medium of claim 9, wherein the program instructions are executable to search either only the first searchable group or both the first and second searchable groups if the particular email document contains only common-type subsets of character sequences.

12. The computer readable medium of claim 9, wherein the program instructions are executable to search both the first and second searchable groups if the particular email contains a combination of common-type and uncommon-type subsets of character sequences, and the program instructions are further executable to search the first searchable group using the common-type subsets of character sequences in the particular email document and the second searchable group using the uncommon-type subsets of character sequences in the particular email document.

13. The computer readable medium of claim 9, wherein the program instructions are further executable to disregard predetermined content of each email document in the plurality of email documents, prior to identifying whether each subset of character sequences within the email document is a common-type subset of character sequences or an uncommon-type subset of character sequences.

14. The computer readable medium of claim 13, wherein the predetermined content includes email header information.

15. A system, comprising:

one or more processors;

a memory storing program instructions that are computer-executable by the one or more processors to;

identify, for each email document of a plurality of email documents, whether each subset of one or more subsets of character sequences within the email document is a common-type subset of character sequences or an uncommon-type subset of character sequences;

group a first set of the plurality of email documents with only common-type subsets of character sequences in a first searchable group;

group a second set of the plurality of email documents with one or more uncommon-type subsets of character sequences in a second searchable group;

identify whether each subset of character sequences in a particular email document to be evaluated is a common-type or an uncommon-type subset of character sequences;

selectively search either only one of or both of the first and second searchable groups depending upon whether the particular email contains only common-type subsets of character sequences, only uncommon-type subsets of character sequences, or a combination of common-type and uncommon-type subsets of character sequences; and

identify selected one or more email documents of the plurality of email documents that may contain content that is similar to the particular email document based on the search.

16. The system of claim 15, wherein each subset of character sequences is a paragraph.

17. The system of claim 15, wherein the program instructions are executable to search both the first and second searchable groups if the particular email document contains only common-type subsets of character sequences, and search only the second searchable group if the particular email document contains only uncommon-type subsets of character sequences or a combination of common-type and uncommon-type subsets of character sequences.

18. The system of claim 15, wherein the program instructions are executable to search only the first searchable group if the particular email document contains only common-type subsets of character sequences, search only the second searchable group if the particular email document contains only uncommon-type subsets of character sequences, and search both the first and second group if the particular email contains a combination of common-type and uncommon-type subsets of character sequences.

19. The system of claim 15, wherein program instructions are further executable to:

generate a first bloom filter representing the subsets of character sequences corresponding to the particular email document;

generate a second bloom filter representing the subsets of character sequences corresponding to one of the identified, selected one or more email documents; and

compare the first bloom filter with the second bloom filter.

20. The system of claim 19, wherein the program instructions are executable to compare the first bloom filter with the second bloom filter by performing a bitwise OR operation.