Obfuscation of spam filter
First Claim
1. A spam filtering system comprising:
- a computer processor;
one or more spam filters;
and a randomization component that randomizes scores of the filters for one or more messages based at least in part upon a hash computed to randomize the message score, the hash is computed based at least in part upon one or more features extracted from the message whose respective individual contributions to the message score exceed a threshold, thus obfuscating the functionality of the spam filter wherein the spam filtering system making use of a sigmoid function having the formula of
finalscore=1/1+e−
^summedscorewherein at least one of the summedscore value or the finalscore value is randomized to effectively modify spammer behavior and to mitigate reverse engineering of the filtering system.
2 Assignments
0 Petitions
Accused Products
Abstract
The subject invention provides systems and methods that facilitate obfuscating a spam filtering system to hinder reverse engineering of the spam filters and/or to mitigate spammers from finding a message that consistently gets through the spam filters almost every time. The system includes a randomization component that randomizes a message score before the message is classified as spam or non-spam so as to obscure the functionality of the spam filter. Randomizing the message score can be accomplished in part by adding a random number or pseudo-random number to the message score before it is classified as spam or non-spam. The number added thereto can vary depending on at least one of several types of input such as time, user, message content, hash of message content, and hash of particularly important features of the message, for example. Alternatively, multiple spam filters can be deployed rather than a single best spam filter.
135 Citations
28 Claims
-
1. A spam filtering system comprising:
-
a computer processor; one or more spam filters; and a randomization component that randomizes scores of the filters for one or more messages based at least in part upon a hash computed to randomize the message score, the hash is computed based at least in part upon one or more features extracted from the message whose respective individual contributions to the message score exceed a threshold, thus obfuscating the functionality of the spam filter wherein the spam filtering system making use of a sigmoid function having the formula of
finalscore=1/1+e−
^summedscorewherein at least one of the summedscore value or the finalscore value is randomized to effectively modify spammer behavior and to mitigate reverse engineering of the filtering system. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16)
-
-
15. The system of claim having a substantial effect on messages that border between spam and non-spam, whereby messages that are border-line spam are classified as spam at least part of the time by randomizing scores of the messages.
-
17. A computer readable storage medium comprising computer executable instructions to carry out a method that facilitates obfuscating a spam filter comprising:
-
running a message through a spam filter; computing at least one score associated with the message; randomizing the score of the message before classifying the message as spam or non-spam by adding at least one of a random number or a pseudo-random number to the score of the message, the number added to the score of the message depending at least in part upon a hash of at least a portion of one or more features extracted from the message having respective contributions to the score greater than zero, the at least one score associated with the message comprises a finalscore and a summedscore wherein the finalscore is a sigmoid function of the summedscore having the formula of wherein at least one of the summedscore value or the finalscore value is randomized to effectively modify spammer behavior and to mitigate reverse engineering of the filtering system; and classifying the message as spam or non-spam. - View Dependent Claims (18, 19, 20, 21, 22, 23, 24, 25)
-
-
26. A computer-readable storage medium having stored thereon the following computer executable components:
-
a randomization component that randomizes at least one score of one or more spam filters based at least in part upon a hash computed to randomize a message score, the hash is computed based at least in part upon one or more features extracted from the message whose respective individual contributions to the message score exceed a threshold, the at least one score associated with the filters comprises a finalscore and a summedscore wherein the finalscore is a sigmoid function of the summedscore having the formula of wherein at least one of a summedscore value or a finalscore value is randomized thus obfuscating the functionality of a the spam filters so as to hinder reverse engineering the one or more spam filters. - View Dependent Claims (27)
-
-
28. A system that facilitates obfuscating a spare filter comprising:
-
a computer processor; a means for running a message through a spare filter;
a means for computing at least one score associated with the message;
a means for randomizing the score of the message by modifying the score with at least one of a random number or a pseudo-random number, the number modifying the score of the message depending at least in part upon a hash of at least a portion of one or more features extracted from the message having respective contributions to the score greater than zero;
the score of the message comprises a finalscore score and a summedscore wherein the finalscore is a sigmoid function of the summedscore having the formula of
finalscore=1/1+e−
^summedscorewherein at least one of the summedscore value or the finalscore value is randomized before classifying the message as spare or non-spare; and
a means for classifying the message as spare or non-spare.
-
Specification