System and method for filtering spam messages utilizing URL filtering module

• US 8,145,710 B2
• Filed: 06/17/2004
• Issued: 03/27/2012
• Est. Priority Date: 06/18/2003
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Hoogstrate, David, Jensen, Sandy, Medlar, Art, Schneider, Ken, Cowings, David
• Primary Examiner(s): MIRZA, ADNAN M
• Application Number:
  US10/871,583
• Publication Number:
  US 20090070872A1
• Time in Patent Office: 2,840 Days
• Field of Search: 709/205, 709/206
• US Class Current: 709/205
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Systems and methods for filtering spam messages utilizing a URL filtering module are described. In one embodiment, the method includes detecting, in an incoming message, data indicative of a URL and comparing the URL from the incoming message with URLs characterizing spam. The method further includes determining whether the incoming message is spam based on the comparison of the URL from the incoming message with the URLs characterizing spam.

Claims

1. A method, comprising:

a computer system receiving a message identified as being a spam message;

the computer system extracting, from the received message, a first uniform resource locator (URL), wherein the first URL includes a host component and a path component;

the computer system generating a first hash value based on the host component, but not the path component, of the first URL;

the computer system generating a second hash value based on the host component and the path component of the first URL;

the computer system using the generated first hash value to create a first spam filter, wherein the first spam filter is usable to determine whether a subsequently received message includes the host component of the first URL; and

the computer system using the generated second hash value to create a second spam filter, wherein the second spam filter is usable to determine whether the subsequently received message includes the host component and the path component of the first URL.

2. The method of claim 1, further comprising before creating the spam filter, the computer system reducing noise in the first URL.

3. The method of claim 2, wherein said reducing includes normalizing decimal or hexadecimal information in the received message.

4. The method of claim 1, wherein the received message is addressed to a probe email address.

5. The method of claim 1, further comprising the computer system distributing the first and second spam filters to one or more other computer systems.

6. The method of claim 1, wherein the first and second spam filters are each assigned a weight value based on that spam filter'"'"'s effectiveness at identifying spam messages.

7. The method of claim 1, wherein the first spam filter is usable to identify the subsequently received message as being spam based on the subsequently received message including the host component of the first URL and at least a portion of a second URL.

8. The method of claim 1, wherein the first spam filter is usable to identify the subsequently received message as being spam based on the subsequently received message including the host component of the first URL but not including a second URL.

9. The method of claim 1, further comprising the computer system using the created first and second filters to identify subsequently received messages as being spam messages.

10. The method of claim 1, wherein the first URL is associated with a spam category, and wherein the method further comprises the computer system performing different actions based on the spam category.

11. A non-transitory computer-readable medium having program instructions stored thereon that are executable by a computer system to cause the computer system to perform operations comprising:

receiving a message identified as being a spam message;

extracting, from the received message, a first uniform resource locator (URL), wherein the first URL includes a host component and a path component;

generating a first hash value based on the host component, but not the path component, of the first URL;

generating a second hash value based on the host component and the path component of the first URL;

using the generated first hash value to create a first spam filter, wherein the first spam filter is usable to determine whether a subsequently received message includes the host component of the first URL; and

using the generated second hash value to create a second spam filter, wherein the second spam filter is usable to determine whether the subsequently received message includes the host component and the path component of the first URL.

12. The computer-readable medium of claim 11, wherein the first and second spam filters are each assigned a weight value based on that spam filter'"'"'s effectiveness at identifying spam messages.

13. The computer-readable medium of claim 11, wherein the first spam filter is usable to identify the subsequently received message as being spam based on the subsequently received message including the host component of the first URL and at least a portion of a second URL.

14. The computer-readable medium of claim 11, wherein the first spam filter is usable to identify the subsequently received message as being spam based on the subsequently received message including the host component of the first URL but not including a second URL.

15. The computer-readable medium of claim 11, wherein the operations further comprise distributing the first and second spam filters to one or more other computer systems.

16. The computer-readable medium of claim 11, wherein the operations further comprise using the created first and second filters to identify subsequently received messages as being spam messages.