System, method, and computer program product for filtering messages and training a classification module

• US 8,180,834 B2
• Filed: 10/07/2005
• Issued: 05/15/2012
• Est. Priority Date: 10/07/2004
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Kay, Erik Andrew, Moore, David, Willhite, Daniel L., Upson, Linus
• Primary Examiner(s): Moore, Ian N
• Assistant Examiner(s): TOWFIGHI, AFSHAWN M
• Application Number:
  US11/245,101
• Publication Number:
  US 20060095524A1
• Time in Patent Office: 2,412 Days
• Field of Search: 709204-207
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

The present invention provides systems, methods, computer program products, and combinations and subcombinations thereof for filtering received messages. The invention includes a client system having filtering logic, a statistical classifier module, and a classifier database. The classifier module is automatically trained, without manual intervention, when the score generated by the classifier for a received message is inconsistent with a user-defined authoritative status indication. In addition, the classifier module is initialized using user-identified messages in a ratio representative of the ratio of non-spam to spam messages received by the user.

Claims

1. A method for filtering messages received by a user, comprising:

determining, in a message classification module, a score for a received message by analyzing a plurality of portions of a body of the received message, wherein each portion in the plurality of portions is scored with a portion score;

determining a user-defined authoritative status for the received message, wherein step (b) comprises;

(i) determining whether an address associated with a sender of the received message matches an entry on a positive screening list,

(ii) assigning a non-spam user-defined authoritative status for the received message if the address associated with the sender matches an entry on the positive screening list,

(iii) storing the received message in a quarantine folder if the address associated with the sender does not match an entry on the positive screening list,

(iv) receiving a filtering status indication for the received message,

(v) assigning a non-spam user-defined authoritative status for the received message if the filtering status indication indicates user approval of the message, and

(vi) assigning a spam user-defined authoritative status for the received message if the filtering status indication indicates user disapproval of the message; and

automatically training the message classification module when the score is inconsistent with the user-defined authoritative status.

2. The method of claim 1, wherein step (b) further comprises:

(vii) determining whether an address associated with a sender of the received message matches an entry on a negative screening list; and

(viii) assigning a spam user-defined authoritative status for the received message if the address associated with the sender matches an entry on the negative screening list.

3. The method of claim 1, further comprising:

prior to step (a), initializing the classification module, wherein the initializing step includes;

receiving an indication of a set of existing non-spam messages stored for the user and an indication of a set of existing spam messages stored for the user,

determining a ratio of non-spam messages to spam messages,

training the classification module using the indicated messages in a ratio representative of the ratio of non-spam to spam messages, and

retraining the classification module using the indicated messages in a ratio representative of the ratio of non-spam to spam messages,

wherein the retraining step removes redundant training information from the classification module.

4. The method of claim 1, further comprising:

(d) initiating management of a database associated with the classification module;

(e) determining the total number of messages in the database, the total number of non-spam messages in the database, and the total number of spam messages in the database; and

(f) removing the oldest messages from the database according to a ratio representative of the ratio of the total number of non-spam messages to the total number of spam messages until a maximum message count is reached.

5. The method of claim 4, further comprising:

(g) removing the oldest messages from the database according to a ratio representative of the ratio of the total number of non-spam messages to the total number of spam messages until a minimum message count is reached if messages older than a predetermined age remain after step (f).

6. The method of claim 1, wherein step (b) further comprises:

(vii) if a spam user-defined authoritative status is assigned to the message, sending a message to the sender to unsubscribe the user from a mailing list if the sender address is a mailing list header.

7. The method of claim 1, wherein the received message includes a plurality of sender addresses and a plurality of recipient addresses, and wherein step (b) further comprises:

(vii) applying a broad approval process to a received message having a non-spam user-defined authoritative status, wherein each sender address and each recipient address is added to the positive screening list during the broad approval process; and

(vii) applying a broad approval process to a subsequently received message if a sender address in the subsequently received message matches an entry on the positive screening list.

8. The method of claim 1, wherein step (b) further comprises:

(vii) sorting a set of messages stored in the quarantine folder according to their associated scores.

9. The method of claim 8, wherein step (b) further comprises:

(vii) obscuring one or more messages having a score within a range indicating spam.

10. The method of claim 8, wherein step (b) further comprises:

(vii) hiding one or more messages having a score within a range indicating spam.

11. The method of claim 1, further comprising:

prior to step (b)

authenticating the received message; and

displaying a visual indication of the authentication,

wherein the visual indication of the authentication includes an image representative of the message sender.

12. The method of claim 11, wherein the image is a picture of the message sender.

13. The method of claim 11, wherein the visual indication further includes a description of what was authenticated.

14. The method of claim 1, wherein the portion score identifies a number of spam messages with which the portion is associated.

15. The method of claim 1, wherein the user-defined authoritative status is defined by a recipient of the received message.

16. The method of claim 1, wherein each portion score is calculated based on a categorization of each received message that includes each respective portion as a spam message or a non-spam message.

17. The method of claim 1, wherein each portion score is calculated based on a frequency of appearance of each portion in spam or non-spam messages.

18. A computer program product comprising a non-transitory computer useable medium including control logic stored therein, the control logic enabling the filtering of messages received by a user, and the control logic, if executed, causing a processor to perform operations comprising:

determining, in a message classification module, a score for a received message by analyzing a plurality of portions of a the body of the received message, wherein each portion in the plurality of portions is scored with a portion score;

determining a user-defined authoritative status for the received message;

determining whether an address associated with a sender of the received message matches an entry on a positive screening list; and

assigning a non-spam user-defined authoritative status for the received message if the address associated with the sender matches an entry on the positive screening list;

storing the received message in a quarantine folder if the address associated with the sender does not match an entry on the positive screening list;

receiving a filtering status indication for the received message;

assigning a non-spam user-defined authoritative status for the received message if the filtering status indication indicates user approval of the message;

assigning a spam user-defined authoritative status for the received message if the filtering status indication indicates user disapproval of the message; and

automatically training the classification module when the score is inconsistent with the user-defined authoritative status.

19. The computer program product of claim 18, wherein the operations further comprise:

determining whether an address associated with a sender of the received message matches an entry on a negative screening list; and

assigning a spam user-defined authoritative status for the received message if the address associated with the sender matches an entry on the negative screening list.

20. The computer program product of claim 18, wherein the operations further comprise:

initializing the classification module, wherein initializing the classification module comprises;

receiving an indication of a set of existing non-spam messages stored for the user and an indication of a set of existing spam messages stored for the user,

determining a ratio of non-spam messages to spam messages,

training the classification module using the indicated messages in a ratio representative of the ratio of non-spam to spam messages, and

retraining the classification module using the indicated messages in a ratio representative of the ratio of non-spam to spam messages.

21. The computer program product of claim 18, wherein the operations further comprise:

initiating management of a database associated with the classification module;

determining the total number of messages in the database, the total number of non-spam messages in the database, and the total number of spam messages in the database; and

removing the oldest messages from the database according to a ratio representative of the ratio of the total number of non-spam messages to the total number of spam messages until a maximum message count is reached.

22. A method for initializing a statistical classification module in a message filtering system, comprising:

initializing a spam message classification module, wherein initializing the spam message classification module comprises;

receiving a first indication by a message recipient of a set of existing non-spam messages stored for the message recipient and second indication by the message recipient of a set of existing spam messages stored for the message recipient,

determining a ratio of the non-spam messages stored for the message recipient to the spam messages stored for the message recipient,

training the spam message classification module to recognize spam messages and non-spam messages using a subset of the indicated messages, and

removing redundant training information from the spam message classification module;

receiving a third indication by the message recipient identifying a received message as spam or non-spam;

determining that a spam classification error has occurred if a spam classification generated by the spam message classification module is inconsistent with the third indication; and

in response to determining that the spam classification error has occurred, re-training the spam message classification module using the received message.

23. A method for filtering messages received by a first user, comprising:

determining whether an address of a sender of a received message matches an entry on a positive screening list of a second human user, wherein the second human user is identified as trusted by the first user;

if the address associated with the sender of the received message matches the entry, applying a broad approval process to the received message, wherein each sender address and each recipient address in a header of the received message is added to the positive screening list during the broad approval process; and

applying the broad approval process to a subsequently received message if the sender address in the subsequently received message matches an entry on the positive screening list of the second human user.

24. The method of claim 23, further comprising:

prior to step (a), storing a plurality of received message in a quarantine folder if the address associated with the sender of each message does not match an entry on the positive screening list.

25. The method of claim 24, further comprising:

(d) applying an updated screening list to the plurality of received messages stored in the quarantine folder; and

(e) adding a first quarantined received message to an inbox of the first user if the sender of the quarantined received message matches an entry in the updated screening list.

26. The method of claim 25, wherein step (e) further comprises:

applying a broad approval process to the first quarantined received message wherein each sender address and each recipient address of the first quarantined message is added to the positive screening list; and

applying the updated screening list to the remaining received messages stored in the quarantine folder.

27. A computer program product comprising a non-transitory computer useable medium including control logic stored therein, the control logic enabling the filtering of messages received by a first user, and the control logic, if executed, causing a processor to perform operations comprising:

determining whether an address of a sender of a received message matches an entry on a positive screening list of a second human user, wherein the second human user is identified as trusted by the first user;

applying a broad approval process to the received message, wherein each sender address and each recipient address in a header of the received message is added to the positive screening list during the broad approval process, if the address associated with the sender of the received messages matches an entry on the positive screening list; and

applying the broad approval process to a subsequently received message if the sender address in the subsequently received message matches an entry on the positive screening list of the second human user.

28. The computer program product of claim 27, wherein the operations further comprise:

storing a plurality of received messages in a quarantine folder if the address associated with the sender of each message does not match an entry on the positive screening list.

29. The computer program product of claim 28, wherein the operations further comprise:

applying an updated screening list to the plurality of received messages stored in the quarantine folder; and

adding a first quarantined received message to an inbox of the first user if the sender of the quarantined received message matches an entry in the updated screening list.

30. The computer program product of claim 29, wherein the operations further comprise:

applying a broad approval process to the first quarantined received message wherein each sender address and each recipient address of the first quarantined message is added to the positive screening list; and

applying the updated screening list to the remaining received messages stored in the quarantine folder.

31. A method for filtering messages received by a user, comprising:

determining, in a content analysis engine, a score for each received message by analyzing a plurality of portions of a body of each received message, wherein each portion in the plurality of portions is associated with a portion score;

determining whether an address associated with a sender of each received message matches an entry on a positive screening list;

storing a set of received messages in a quarantine folder if the address associated with the sender of each message in the set of received messages does not match an entry on the positive screening list; and

sorting the set of received messages stored in the quarantine folder according to their associated scores.

32. The method of claim 31, further comprising:

(e) obscuring one or more messages in the set of received messages having a score within a range indicating spam.

33. The method of claim 31, further comprising:

(e) hiding one or more messages in the set of received messages having a score within a range indicating spam.

34. A computer program product comprising a non-transitory computer useable medium including control logic stored therein, the control logic enabling the filtering of messages received by a user, and the control logic, if executed, causing a processor to perform operations comprising:

determining a score for each received message by analyzing a plurality of portions of a body of each received message, wherein each portion in the plurality of portions is scored with a portion score;

determining whether an address associated with a sender of each received message matches an entry on a positive screening list;

storing a set of received messages in a quarantine folder if the address associated with the sender of each message in the set of received messages does not match an entry on the positive screening list; and

sorting the set of received messages stored in the quarantine folder according to their associated scores.

35. The computer program product of claim 34, wherein the operations further comprise:

obscuring one or more messages in the set of received messages having a score within a range indicating spam.

36. The computer program product of claim 34, wherein the operations further comprise:

hiding one or more messages in the set of received messages having a score within a range indicating spam.