Origination/destination features and lists for spam prevention

• US 7,665,131 B2
• Filed: 01/09/2007
• Issued: 02/16/2010
• Est. Priority Date: 06/04/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gwozdz, Daniel, Rupersburg, Micah C., Howell, Nathan D., Rounthwaite, Robert L., Goodman, Joshua T., Mehr, John D., Starbuck, Bryan T.
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US11/621,363
• Publication Number:
  US 20070118904A1
• Time in Patent Office: 1,134 Days
• Field of Search: 726/13
• US Class Current: 726/13
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

The present invention involves a system and method that facilitate extracting data from messages for spam filtering. The extracted data can be in the form of features, which can be employed in connection with machine learning systems to build improved filters. Data associated with origination information as well as other information embedded in the body of the message that allows a recipient of the message to contact and/or respond to the sender of the message can be extracted as features. The features, or a subset thereof, can be normalized and/or deobfuscated prior to being employed as features of the machine learning systems. The (deobfuscated) features can be employed to populate a plurality of feature lists that facilitate spam detection and prevention. Exemplary features include an email address, an IP address, a URL, an embedded image pointing to a URL, and/or portions thereof.

Claims

1. A system that facilitates extracting data in connection with spam processing, comprising:

a memory;

a processor coupled to the memory;

a component that receives an item and extracts a set of features associated with an origination of a message or part thereof and/or information that enables an intended recipient to contact, respond or receive in connection with the message, wherein the component that receives the item determines a last trusted server IP address to distinguish between legitimate and fake prepended server IP addresses and the last trusted server IP address is extracted as a feature from the item;

and a component that employs a subset of the extracted features in connection with building a filter by adding the subset of the extracted features to a training set of data utilized for training and updating the filter, wherein the filter determines a probability that the message is spam when the subset of the extracted features passes through the filter.

2. The system of claim 1, further comprising a normalization component that deobfuscates a subset of the features.

3. The system of claim 1, further comprising a machine learning system component that employs the deobfuscated features to learn at least one of spam and non-spam.

4. The system of claim 1, the subset of features comprising at least one IP address, the at least one IP address being at least a portion of any one of a reply-to address, a carbon copy address, a mail-to address, a received-from address, and a URL located in the message.

5. The system of claim 4, the IP address comprising a block ID, wherein the block ID can be extracted as at least one feature.

6. The system of claim 5, wherein the block ID is determined at least in part by consulting a block directory.

7. The system of claim 5, wherein the block ID is determined at least in part by guessing, thereby extracting as features any one of at least a first 1 bit, at least a first 2 bits, at least a first 3 bits, and up to at least a first 31 bits of the IP address.

8. The system of claim 1, wherein the subset of features comprises each of a first 1 up to a first 31 bits of an IP address.

9. The system of claim 1, the subset of features comprising a URL.

10. The system of claim 1, further comprising a component that employs at least a subset of the extracted features to populate at least one feature list.

11. The system of claim 10, the at least one feature list is any one of a list of good users, a list of spammers, a list of positive features indicating legitimate sender, or a list of features indicating spam.

12. The system of claim 1, the subset of features comprising at least one of a host name or a domain name extracted from an email address.

13. The system of claim 1, the subset of features comprising at least a portion of an FQDN extracted from any one of an email address and a URL.

14. The system of claim 1, the subset of features comprising at least a portion of a domain name extracted from any one of an email address and a URL.

15. A method that facilitates extracting data in connection with spam processing, comprising:

receiving a message;

extracting a set of features associated with an origination of the message or part thereof and/or information that enables an intended recipient to contact, respond or receive in connection with the message;

wherein a last trusted server IP address is an extracted feature from the message and a determination is made to distinguish between legitimate and fake prepended server IP addresses; and

employing a subset of the extracted features in connection with building a filter by adding the subset of the extracted features to a training set of data utilized for training and updating the filter, wherein the filter determines a probability of the message being spam when the subset of the extracted features passes through the filter.

16. The method of claim 15, wherein the set of features comprises website address.

17. The method of claim 16, further comprising extracting additional features from a website address comprises performing at least one of the following acts:

removing at least one suffix at a time thereby yielding respective additional features; and

removing at least one prefix at a time, thereby yielding respective additional features.

18. The method of claim 15, further comprising assigning a feature type to the respective extracted features to notify a user of message content based at least in part upon the respective extracted features and using the feature type as an additional feature.

19. The method of claim 18, further comprising determining that at least one of a feature type and a feature are any one of rare and common and using a rarity and a commonality of a feature as an additional feature.

20. A system that facilitates extracting data in connection with spam processing, comprising:

a memory;

a processor coupled to the memory;

a means for receiving a message;

a means for extracting a set of features associated with an origination of the message or part thereof and/or information that enables an intended recipient to contact, respond or receive in connection with the message;

the means for extracting the set of features that determines a last trusted server IP address that distinguishes between legitimate and fake prepended server IP addresses, wherein the last trusted server IP address is extracted as a feature; and

a means for employing a subset of the extracted features in connection with building a filter, wherein the filter determines a probability of the message being spam.