Method and apparatus for filtering email spam using email noise reduction

• US 7,831,667 B2
• Filed: 05/13/2004
• Issued: 11/09/2010
• Est. Priority Date: 05/15/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Jensen, Sandy, Gleeson, Matt, Schneider, Ken, Mantel, Eli, Medlar, Art, Hoogstrate, David
• Primary Examiner(s): Pwu; Jeffrey
• Assistant Examiner(s): Musa; Abdelnabi O
• Application Number:
  US10/845,819
• Publication Number:
  US 20050108339A1
• Time in Patent Office: 2,371 Days
• Field of Search: 709/204, 709/205, 709/206
• US Class Current: 709/206
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method and system for filtering email spam using email noise reduction are described. In one embodiment, the method includes detecting, in an email message, data indicative of noise added to the email message to avoid spam filtering. The method further includes modifying the content of the email message to reduce the noise, and comparing the modified content of the email message with the content of a spam message.

Claims

1. A method, comprising:

a computer system detecting, in an email message, one or more character references added to the email message to avoid spam filtering, wherein each character reference specifies a position of a character within a first character set;

the computer system modifying content of the email message, including by converting at least one of the one or more character references to a character corresponding to the specified position within the first character set; and

the computer system comparing the modified content of the email message with content of a spam message;

wherein each of the one or more character references is an HTML character reference of the form “

&

#<

num>

”

, wherein <

num>

is a value that specifies a position of a character within the first character set.

2. The method of claim 1, wherein the first character set is an ASCII character set.

3. The method of claim 1, wherein said modifying the content of the email message comprises:

the computer system converting a first group of character references in the email message into corresponding characters within the first character set;

the computer system making a determination that the converted first group of character references forms a new group of character references; and

responsive to said determination, the computer system converting the new group of character references into corresponding characters within the first character set.

4. The method of claim 3, wherein the email message includes HTML data, and wherein the converted first group of character references includes a character indicative of a reference to a character position in the first character set.

5. The method of claim 1, wherein at least one of the one or more character references is located in a URL in the email message.

6. The method of claim 1, wherein said comparing comprises:

determining whether the modified content of the email message is similar to the content of the spam message.

7. A system, comprising:

one or more processors;

a memory having stored therein program instructions executable by the one or more processors to;

detect, in an email message, one or more character references added to the email message to avoid spam filtering, wherein each character reference specifies a position of a character within a first character set;

modify content of the email message, including by converting at least one of the one or more character references to a character corresponding to the specified position within the first character set;

compare the modified content of the email message with content of a spam message; and

wherein each of the one or more character references is an HTML character reference of the form “

&

#<

num>

”

, wherein <

num>

is a value that specifies a position of a character within the first character set.

8. The system of claim 7, wherein the first character set is an ASCII character set.

9. The system of claim 7, wherein the program instructions are further executable to:

modify the content of the email message by converting a first group of character references in the email message into corresponding characters within the first character set;

make a determination that the converted first group of character references forms a new group of character references; and

responsive to said determination, convert the new group of character references into corresponding characters within the first character set.

10. The system of claim 9, wherein the email message includes HTML data, and wherein the converted first group of character references includes a character indicative of a reference to a character position in the first character set.

11. The system of claim 7, wherein at least one of the one or more character references is located in a URL in the email message.

12. The system of claim 7, wherein the program instructions are executable to compare the modified content of the email message with the content of the spam message by determining whether the modified content of the email message is similar to the content of the spam message.

13. A non-transitory tangible computer-readable medium having stored thereon program instructions executable by a computer system to:

detect, in an email message, one or more character references added to the email message to avoid spam filtering, wherein each character reference specifies a position of a character within a first character set;

modify content of the email message, including by converting at least one of the one or more character references to a character corresponding to the specified position within the first character set;

compare the modified content of the email message with content of a spam message; and

wherein each of the one or more character references is an HTML character reference of the form “

&

#<

num>

”

, wherein <

num>

is a value that specifies a position of a character within the first character set.

14. The tangible computer-readable medium of claim 13, wherein the first character set is an ASCII character set.

15. The tangible computer-readable medium of claim 13, wherein the program instructions are further executable to:

convert a first group of character references in the email message into corresponding characters within the first character set;

make a determination that the converted first group of character references forms a new group of character references; and

responsive to said determination, convert the new group of character references into corresponding characters within the first character set.

16. The tangible computer-readable medium of claim 15, wherein the email message includes HTML data, and wherein the converted first group of character references includes a character indicative of a reference to a character position in the first character set.

17. The tangible computer-readable medium of claim 13, wherein at least one of the one or more character references is located in a URL in the email message.

18. A non-transitory tangible computer-readable medium having stored thereon program instructions that are computer executable to:

detect, in an electronic message, one or more character references, wherein each character reference specifies a position of a character within a first character set;

modify content of the electronic message, including by converting at least one of the one or more character references to a character corresponding to the specified position within the first character set; and

compare the modified content of the electronic message with a spam message;

wherein each of the one or more character references is an HTML character reference of the form “

&

#<

num>

”

, wherein <

num>

is a value that specifies a position of a character within the first character set.

19. The tangible computer-readable medium of claim 18, wherein the program instructions executable to modify the content of the email message include program instructions executable to make at least two passes through the content of the email message to convert character references to characters within the first character set.

20. An apparatus, comprising:

a processor;

a memory having stored therein program instructions executable by the processor to;

detect, in an electronic message, one or more character references, wherein each character reference specifies a position of a character within a first character set;

modify content of the electronic message, including by converting at least one of the one or more character references to a character corresponding to the specified position within the first character set; and

compare the modified content of the electronic message with a spam message;

wherein each of the one or more character references is an HTML character reference of the form “

&

#<

num>

”

, wherein <

num>

is a value that specifies a position of a character within the first character set.

21. The apparatus of claim 20, wherein the electronic message includes markup data.

22. The apparatus of claim 20, wherein the program instructions executable to modify the content of the email message include program instructions executable to make at least two passes through the content of the email message to convert character references to characters within the first character set.