Method and apparatus for grouping spam email messages

• US 7,739,337 B1
• Filed: 06/20/2005
• Issued: 06/15/2010
• Est. Priority Date: 06/20/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Jensen, Sanford
• Primary Examiner(s): Jagannathan; Melanie
• Assistant Examiner(s): CHANG, STEPHANIE L
• Application Number:
  US11/157,327
• Time in Patent Office: 1,821 Days
• Field of Search: 709/204, 709/206, 709/207, 709/202, 707/5, 706/16
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method and system for grouping spam email messages are described. In one embodiment, the method includes receiving probe email messages indicative of spam and modifying the probe email messages to reduce noise. The method further includes comparing the probe email messages using fuzzy logic to identify similar email messages, and creating groups of similar email messages. Each of the created groups pertains to a distinct spam attack.

Claims

1. A method comprising:

receiving, at a computer system, a plurality of spam email messages;

for at least one received spam email message having a size less than a threshold;

the computer system finding a feature in the spam email message;

the computer system repeatedly adding the feature to the spam email message until its size reaches the threshold;

the computer system subsequently performing comparisons involving the spam email messages to identify similar spam email messages;

the computer system creating a first group of spam email messages and a second group of spam email messages, wherein messages in the first group are similar to one another and pertain to a first type of spam attack, and wherein messages in the second groups are similar to one another and pertain to a second type of spam attack distinct from the first type of spam attack;

the computer system creating a filter for one or more of the first and second groups; and

the computer system distributing the created filters to a plurality of client computer systems for detection of spam email messages.

2. The method of claim 1 wherein the spam email messages are collected using a plurality of fictitious probe email addresses selected to appear on spam email mailing lists.

3. The method of claim 1 further comprising the computer system removing data indicative of noise from the spam email messages, the data indicative of noise being selected from the group consisting of formatting data, numeric character references, character entity references, and uniform resource locator (URL) data including password syntax data.

4. The method of claim 1 wherein the feature is a uniform resource locator (URL).

5. The method of claim 1 wherein the feature is a phone number.

6. The method of claim 1 wherein the feature is a keyword or a name.

7. A method comprising:

a computer system determining that a size of a newly received spam message is below a threshold;

the computer system finding a feature in the new spam message;

the computer system adding on the feature to the new spam message until the size of the new spam message reaches the threshold;

upon the new spam message reaching the threshold, the computer system grouping the new spam message into an existing spam message group or a new spam message group;

the computer system creating a filter for the group into which the new spam message has been grouped; and

the computer system distributing the created filter to one or more client computer systems for detection of spam email messages.

8. The method of claim 7 wherein the new spam message is a probe email message collected using one of a plurality of fictitious probe email addresses selected to appear on spam email mailing lists.

9. The method of claim 7 further comprising:

the computer system removing data indicative of noise from the new spam message prior to determining that the size of the new spam message is below the threshold, the data indicative of noise being selected from the group consisting of formatting data, numeric character references, character entity references, and uniform resource locator (URL) data including password syntax data.

10. The method of claim 7 wherein the feature is a uniform resource locator (URL).

11. The method of claim 7 wherein the feature is a phone number, a keyword, or a name.

12. A system comprising:

a processor;

a memory storing program instructions that are executable by the processor to;

receive a plurality of spam email messages;

for one or more of those received spam email message having a size below a predetermined threshold;

find a feature in the spam email message;

append the feature to the spam email messages until its size reaches the predetermined threshold;

subsequently compare the spam email messages to identify similar spam email messages;

create at least two groups of spam email messages, wherein the spam email messages in each of the at least two groups are similar to other spam email messages in that group, and wherein each of the groups pertains to a distinct spam attack;

create a filter for one or more of the at least two groups; and

distribute resulting filters to a plurality of client computer systems for detection of spam email messages.

13. The system of claim 12 wherein the feature is a uniform resource locator (URL).

14. The system of claim 12 wherein the feature is a phone number.

15. The system of claim 12 wherein the feature is a keyword or a name.

16. The system of claim 12 wherein the spam email messages are collected using a plurality of fictitious probe email addresses selected to appear on spam email mailing lists.

17. An apparatus comprising:

means for receiving a plurality of spam email messages;

means for repeatedly adding content to each of those received spam email messages having sizes less than a threshold, wherein the content added to a given received spam email message includes a feature found in that message;

means for subsequently creating a group of similar ones of the received spam email messages;

means for creating a filter for the group of similar spam email messages; and

means for distributing the filter to one or more client computer systems for detection of spam email messages.

18. A computer readable medium comprising executable instructions which when executed on a processing system cause said processing system to perform a method comprising:

receiving a plurality of spam email messages;

for each of one or more of those spam email messages having a size less than a predetermined threshold, adding a feature found in the spam email message to the spam email message until its size reaches the threshold;

subsequently placing spam email messages in the received plurality of spam email messages into one of a plurality of groups, wherein spam email messages in a given one of the plurality of groups are similar to one another;

creating a filter for one or more of the plurality of groups; and

distributing the created one or more filters to a plurality of client computer systems for detection of spam email messages.