METHOD AND APPARATUS FOR FILTERING EMAIL SPAM USING EMAIL NOISE REDUCTION

• US 20110055343A1
• Filed: 11/08/2010
• Published: 03/03/2011
• Est. Priority Date: 05/15/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Gleeson, Matt, Schneider, Ken, Mantel, Eli, Jensen, Sandy, Hoogstrate, David, Medlar, Art
• Granted Patent: US 8,402,102 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method and system for filtering email spam using email noise reduction are described. In one embodiment, the method includes detecting, in an email message, data indicative of noise added to the email message to avoid spam filtering. The method further includes modifying the content of the email message to reduce the noise, and comparing the modified content of the email message with the content of a spam message.

Claims

1-23. -23. (canceled)

24. A method, comprising:

a computer system detecting, in an email message, one or more character references added to the email message, wherein each character reference specifies a position of a character within a first character set;

the computer system modifying content of the email message, by converting at least one of the one or more character references to a character corresponding to the specified position within the first character set; and

the computer system comparing the modified content of the email message with content of a spam message.

25. The method of claim 24, wherein the at least one character reference has the form “

&

#<

num>

”

, wherein <

num>

is a value that specifies a position of a character within the first character set.

26. The method of claim 24, wherein the at least one character reference is an HTML character reference.

27. The method of claim 26, wherein the first character set is an ASCII character set.

28. The method of claim 24, wherein modifying the content of the email message includes:

the computer system converting a first group of character references in the email message into corresponding characters within the first character set;

the computer system making a determination that the converted first group of character references forms a new group of character references; and

responsive to the determination, the computer system converting the new group of character references into corresponding characters within the first character set.

29. The method of claim 28, wherein the email message includes HTML data, and wherein the converted first group of character references includes a character indicative of a reference to a character position in the first character set.

30. The method of claim 24, wherein at least one of the one or more character references is located in a URL in the email message.

31. A system, comprising:

one or more processors;

a memory having stored therein program instructions executable by the one or more processors to;

detect, in an email message, one or more character references added to the email message, wherein each character reference specifies a position of a character within a first character set;

modify content of the email message, by converting at least one of the one or more character references to a character corresponding to the specified position within the first character set; and

compare the modified content of the email message with content of a spam message.

32. The system of claim 31, wherein the at least one character reference has the form “

&

#<

num>

”

, wherein <

num>

is a value that specifies a position of a character within the first character set.

33. The system of claim 31, wherein the at least one character reference is an HTML character reference.

34. The system of claim 33, wherein the first character set is an ASCII character set.

35. The system of claim 31, wherein the program instructions are further executable to:

modify the content of the email message by converting a first group of character references in the email message into corresponding characters within the first character set;

make a determination that the converted first group of character references forms a new group of character references; and

responsive to the determination, convert the new group of character references into corresponding characters within the first character set.

36. The system of claim 35, wherein the email message includes HTML data, and wherein the converted first group of character references includes a character indicative of a reference to a character position in the first character set.

37. The system of claim 31, wherein the at least one character reference is located in a URL in the email message.

38. A non-transitory computer readable medium having stored thereon program instructions executable by a computer system to:

detect, in an email message, one or more character references added to the email message, wherein each character reference specifies a position of a character within a first character set;

modify content of the email message, by converting at least one of the one or more character references to a character corresponding to the specified position within the first character set; and

compare the modified content of the email message with content of a spam message.

39. The non-transitory computer readable medium of claim 38, wherein the at least one character reference has the form “

&

#<

num>

”

, wherein <

num>

is a value that specifies a position of a character within the first character set.

40. The non-transitory computer readable medium of claim 38, wherein the program instructions executable to modify the content of the email message include program instructions executable to make at least two passes through the content of the email message to convert character references to characters within the first character set.

41. The non-transitory computer readable medium of claim 38, wherein the at least one character reference is an HTML character reference, and wherein the first character set is an ASCII character set.

42. The non-transitory computer-readable medium of claim 38, wherein the at least one character reference uses a hexadecimal value to specify the position of a character within the first character set.

43. The non-transitory computer-readable medium of claim 38, wherein the at least one character reference is located in a URL in the email message.