Method and architecture for blocking email spams

• US 7,636,716 B1
• Filed: 11/05/2004
• Issued: 12/22/2009
• Est. Priority Date: 12/03/2003
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Cheng, Yun-Chian
• Primary Examiner(s): Cottingham; John R.
• Assistant Examiner(s): Arjomandi; Noosha
• Application Number:
  US10/982,540
• Time in Patent Office: 1,873 Days
• Field of Search: 707/6, 709/207
• US Class Current: 1/1
• CPC Class Codes: G06F 16/353 into predefined classes
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: Y10S 707/99936 Pattern matching access
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

In a method for blocking email spams, the header fields and the message body of a received email first are identified. Predefined patterns are identified by matching in the header fields and message body, wherein a data structure of characteristic information is created for each recognized pattern. The characteristic information then are analyzed by rule inference to determine whether the received email is a spam.

Claims

1. A method of blocking an email spam, comprising:

matching a predefined pattern in a message body and message header fields of an email received on a computer host;

creating a data structure of characteristic information corresponding to the matched pattern, the data structure of characteristic information being created after the email is received on the computer host;

wherein the characteristic information of the matched pattern includes information for locating the matched pattern in the message header fields or message body, and information describing the content of the matched pattern;

analyzing the characteristic information of the matched pattern to determine whether the email is a spare; and

if the email is a spam, blocking the spam.

2. The method according to claim 1, wherein the received email is parsed to identify the message header fields and the message body.

3. The method according to claim 1, wherein a rule inference process is performed to analyze the characteristic information and determine whether the email is a spam.

4. The method according to claim 3, wherein heuristic rules are implemented in the rule inference process to determine whether the email is a spam.

5. The method according to claim 3, wherein a history of rules fired in the rule inference process is returned if the email is determined as being a spam.

6. The method according to claim 1, wherein matching the predefined pattern in the message header fields and the message body is performed by a scanner program generated by a fast lexical analyzer generator.

7. The method according to claim 2, wherein a rule file is configured to describe the rules implemented in the rule inference process.

8. The method according to claim 7, wherein the rule file is configured as a readable character based rule file so as to allow a user to view the description of the rules.

9. The method according to claim 7, wherein the rule file is configured in a manner to allow a user to enable or disable the rules.

10. The method according to claim 7, wherein the rule file is configured in a manner to allow a user to modify weights of the rules.

11. An anti-spam architecture implemented in a computer host to block email spams, comprising:

a calling program, identifying a message body and message header fields from a received email, and operating to block the email if the email is determined as a spam; and

an anti-spam module, called by the calling program to determine whether the received email is a spare and accordingly informing the calling program of the result, wherein the anti-spam module identifies at least a predefined pattern in the message header fields and message body, and creates a data structure of characteristic information corresponding to the matched pattern after receiving the email the characteristic information being analyzed to determine whether the email is a spare;

wherein the characteristic information associated with the matched pattern includes information for locating the matched patterns in the message header field and message body, and information describing the content of the matched pattern.

12. The anti-spam architecture according to claim 11, wherein the calling program is a mail transportation agent.

13. The anti-spam architecture according to claim 11, wherein the anti-spam module comprises a message scanner that matches the predefined pattern as a keyword or regular expression in the message header fields and message body, and creates a data structure of characteristic information corresponding to the matched pattern.

14. The anti-spam architecture according to claim 11, wherein the anti-spam module comprises a rule-based expert system that analyzes by rule inference the characteristic information of the matched pattern to determine whether the email is a spam.

15. The anti-spam architecture according to claim 13, wherein the message scanner calls a scanner program generated by a fast lexical analyzer generator.

16. The anti-spam architecture according to claim 14, wherein the rule-based expert system implements rules loaded from a rule file.

17. The anti-spam architecture according to claim 14, wherein the rule-based expert system returns a history of rules fired in the rule inference process if the email is determined as being a spam.

18. The anti-spam architecture according to claim 14, wherein the rules implemented in the rule-based expert system includes heuristic rules.

19. The anti-spam architecture according to claim 16, wherein the rule file is configured as a readable character based rule file to allow a user to view the description of the rules.

20. The anti-spam architecture according to claim 16, wherein the rule file is configured in a manner to allow a user to enable or disable the rules.

21. The anti-spam architecture according to claim 16, wherein the rule file is configured in a manner to allow a user to modify weights of the rules.