Intelligent SPAM detection system using an updateable neural analysis engine

• US 6,769,016 B2
• Filed: 07/26/2001
• Issued: 07/27/2004
• Est. Priority Date: 07/26/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Jagger, Luke D., Rothwell, Anton C., Dennis, William R., Clarke, David R.
• Primary Examiner(s): Alam, Hosain
• Assistant Examiner(s): WON, MICHAEL YOUNG
• Application Number:
  US09/916,930
• Publication Number:
  US 20030088627A1
• Time in Patent Office: 1,097 Days
• Field of Search: 709/206, 709/207, 706/15
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99942 Manipulating data structure, e.g. compression, compaction, compilation

Abstract

A system, method and computer program product are provided for detecting an unwanted message. First, an electronic mail message is received. Text in the electronic mail message is decomposed. Statistics associated with the text are gathered using a statistical analyzer. A neural network engine coupled to the statistical analyzer is taught to recognize unwanted messages based on statistical indicators. The statistical indicators are analyzed utilizing the neural network engine for determining whether the electronic mail message is an unwanted message.

Claims

1. A method for detecting an unwanted electronic mail message, comprising:

receiving user input via a graphical user interface, the user input including indicators of unwanted electronic mail messages, wherein the indicator for a particular unwanted message includes at least one of a URL, a sender, and domain of a sender, the graphical user interface further including a window for displaying to a user all of the text of the entire particular unwanted message and permitting the user to highlight text of the particular unwanted message in the window, a menu including the highlighted text and a list of a plurality of measurements for selecting at least one of the measurements to apply to the highlighted text, and a button for adding the selected measurements to the indicators, wherein the measurements each correspond to a unique specific condition associated with the highlighted text that must be met before an electronic mail message is to be classified as unwanted;

storing the user input indicators in a database;

receiving an electronic mail message prior to delivery of the electronic mail message to an intended recipient of the electronic mail message;

analyzing the electronic mail message using the user input indicators stored in the database;

classifying the electronic mail message as unwanted, possibly unwanted, and wanted based on the analysis using the user input indicators stored in the database;

sending the electronic mail message to the intended recipient if the electronic mail message is not determined to be unwanted; and

selecting a disposition of the electronic mail message if the electronic mail message is determined to be unwanted, the disposition selected from the group consisting of not delivering the electronic mail message to the intended recipient, sending the electronic mail message to an administrator, and sending the electronic mail message to a quarantine.

2. The method as recited in claim 1, wherein the measurements to apply to the highlighted text are selected from the menu utilizing a right-click action of a mouse and a pop-up window.

3. The method as recited in claim 1, wherein the measurements include a plurality of instances of the highlighted text.

4. The method as recited in claim 1, wherein the measurements include a count of a number of instances of the highlighted text.

5. The method as recited in claim 1, wherein the measurements include a ratio of the highlighted text with respect to a total number of words.

6. The method as recited in claim 1, wherein the graphical user interface is further adapted to allow review of the measurements.

7. The method as recited in claim 1, wherein the graphical user interface includes an applet.

8. The method as recited in claim 1, wherein the graphical user interface is displayed in response to the selection of a uniform resource locator.

9. The method as recited in claim 8, wherein the uniform resource locator is included in an electronic mail message sent to the user.

10. The method as recited in claim 9, wherein the electronic mail message including the uniform resource locator is sent to the user in response to the submission by the user of an electronic mail message determined to be unwanted.

11. A computer program product for detecting an unwanted electronic mail message, comprising:

computer code for receiving user input via a graphical user interface, the user input including indicators of unwanted electronic mail messages, wherein the indicator for a particular unwanted message includes at least one of a URL, a sender, and domain of a sender, the graphical user interface further including a window for displaying to a user all of the text of the entire particular unwanted message and permitting the user to highlight text of the particular unwanted message in the window, a menu including the highlighted text and a list of a plurality of measurements for selecting at least one of the measurements to apply to the highlighted text, and a button for adding the selected measurements to the indicators, wherein the measurements each correspond to a unique specific condition associated with the highlighted text that must be met before an electronic mail message is to be classified as unwanted;

computer code for storing the user input indicators in a database;

computer code for receiving an electronic mail message prior to delivery of the electronic mail message to an intended recipient of the electronic mail message;

computer code for analyzing the electronic mail message using the user input indicators stored in the database;

computer code for classifying the electronic mail message as unwanted, possibly unwanted, and wanted based on the analysis using the user input indicators stored in the database;

computer code for sending the electronic mail message to the intended recipient if the electronic mail message is not determined to be unwanted; and

computer code for selecting a disposition of the electronic mail message if the electronic mail message is determined to be unwanted, the disposition selected from the group consisting of not delivering the electronic mail message to the intended recipient, sending the electronic mail message to an administrator, and sending the electronic mail message to a quarantine.

12. A method for detecting an unwanted electronic mail message, comprising:

receiving user input via a graphical user interface, the user input including indicators of unwanted electronic mail messages, wherein the indicator for a particular unwanted message includes at least one of a URL, a sender, and domain of a sender, the graphical user interface further including a window for displaying to a user all of the text of the entire particular unwanted message and permitting the user to highlight text of the particular unwanted message in the window, a menu including the highlighted text and a list of a plurality of measurements for selecting at least one of the measurements to apply to the highlighted text, and a button for adding the selected measurements to the indicators, wherein the measurements each correspond to a unique specific condition associated with the highlighted text that must be met before an electronic mail message is to be classified as unwanted, the graphical user interface further adapted to allow the user to review the measurements, the measurements to apply to the highlighted text being selected from the menu utilizing a right-click action of a mouse, the measurements including the existence of a plurality of instances of the highlighted text, a count of the number of instances of the highlighted text, a ratio of the highlighted text with respect to a total number of words, the graphical user interface including an applet displayed in response to the selection of a uniform resource locator included in an electronic mail message sent to the user in response to the submission by the user of an electronic mail message determined to be unwanted;

the user input being encrypted at least in part;

storing the user input indicators in a database;

receiving an electronic mail message prior to delivery of the electronic mail message to an intended recipient of the electronic mail message;

analyzing the electronic mail message using the user input indicators stored in the database;

analyzing the electronic mail message using data collected from a public archive of known unwanted messages;

analyzing the electronic mail message using a neural network engine by;

gathering statistics associated with the text using a statistical analyzer by analyzing a character type including Unicode,

teaching the neural network engine coupled to the statistical analyzer to recognize unwanted messages based on statistical indicators, wherein the teaching of the neural network engine includes identifying a message as an unwanted message, the features of the message that make the message unwanted are identified, and the identified features are stored and used by the neural network engine to identify subsequent unwanted messages, wherein the unwanted messages are each expressed as a vector with a plurality of variables selected from the group consisting of capitals, punctuation, and dollars from a statistics table, and

analyzing the statistical indicators utilizing the neural network engine,

classifying the electronic mail message as unwanted, possibly unwanted, and wanted based on the analysis using the user input indicators stored in the database, the analysis using data collected from an archive of known unwanted messages, and the analysis using the neural network engine;

sending the electronic mail message to the intended recipient if the electronic mail message is not determined to be unwanted;

selecting a disposition of the electronic mail message if the electronic mail message is determined to be unwanted, the disposition selected from the group including not delivering the electronic mail message to the intended recipient, sending the electronic mail message to an administrator, and sending the electronic mall message to a quarantine; and

allowing configuration of analysis parameters while simultaneously performing the analyses.