Grouping of documents that contain markup language code

• US 7,788,576 B1
• Filed: 10/04/2006
• Issued: 08/31/2010
• Est. Priority Date: 10/04/2006
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Tsai, Dung-Jou, Hsu, Cheng-Hsin, Chen, Guan-Liang, Chen, Hsin-Yi
• Primary Examiner(s): RIES, LAURIE ANNE
• Application Number:
  US11/542,820
• Time in Patent Office: 1,427 Days
• Field of Search: 715/234, 715/237, 715/271, 715/752
• US Class Current: 715/234
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

In one embodiment, a fingerprint is generated for each document (e.g., e-mail, web page) containing markup language (e.g., HTML) code. The fingerprint is indicative of the structure of the markup language code in the document. The fingerprint may be formed by extracting markup language tags from the document and then linking together the extracted tags to form a single string. The fingerprint may be hashed through a hashing function to generate a signature key that may be used to create a directory for the document and other documents having the same fingerprint. The grouping of documents with the same fingerprint facilitates creation of anti-spam rules or identification of web pages from particular websites, for example.

Claims

1. A method of grouping e-mails that contain HTML (HyperText Markup Language) code, the method to be performed by a computer and comprising:

(a) extracting HTML tags from an e-mail in a plurality of e-mails;

(b) forming a fingerprint of the e-mail by linking together the extracted HTML tags to form a single string;

(c) hashing the fingerprint to form a signature key; and

(d) grouping the e-mail with other e-mails having the same fingerprint.

2. The method of claim 1 wherein grouping the e-mail with other e-mails having the same fingerprint comprises storing the e-mail in a directory for the signature key.

3. The method of claim 1 further comprising:

repeating steps (a), (b), (c), and (d) for other e-mails in the plurality of e-mails.

4. The method of claim 1 wherein forming a fingerprint of the e-mail by linking together the extracted HTML tags comprises:

concatenating the extracted HTML tags to form the single string.

5. The method of claim 4 wherein the concatenated extracted HTML tags include separation codes demarcating where the extracted HTML tags have been concatenated together.

6. The method of claim 1 wherein the e-mail comprises spam e-mail and is grouped together with other spam e-mails having the same fingerprint.

7. A computer comprising:

a tag extractor configured to extract markup language tags from a document containing markup language code; and

a fingerprint generator configured to generate a fingerprint of the document containing markup language code, the fingerprint being indicative of a structure of the markup language code in the document, the fingerprint generator being configured to generate the fingerprint by forming together markup language tags extracted by the tag extractor from the document.

8. The computer of claim 7 further comprising:

a signature key generator configured to hash the fingerprint to generate a signature key of the fingerprint.

9. The computer of claim 8 wherein the signature key is configured to be used to create a directory for the e-mail and other e-mails having the same fingerprint as the e-mail.

10. The computer of claim 7 wherein the markup language comprises HTML.

11. A method to be performed by a computer, the method comprising:

extracting markup language tags from a document; and

forming a structure identifier indicative of a structure of markup language code in the document, the structure identifier being formed from the markup language tags extracted from the document.

12. The method of claim 11 wherein the structure identifier is formed by concatenating the markup language tags extracted from the document.

13. The method of claim 12 wherein the concatenated markup language tags include separation codes.

14. The method of claim 11 wherein the document comprises an e-mail received in the computer.

15. The method of claim 14 further comprising:

comparing the structure identifier with structure identifiers of spam e-mails to determine if the e-mail is spam.

16. The method of claim 11 wherein the document comprises a web page received in the computer.

17. The method of claim 16 further comprising:

comparing the structure identifier with other structure identifiers to identify a web server serving the web page.

18. The method of claim 11 further comprising:

hashing the structure identifier to generate a signature key.

19. The method of claim 18 further comprising:

creating a directory for the signature key; and

storing the document in the directory along with other documents with the same structure identifiers.

20. The method of claim 11 wherein the markup language comprises HTML.