Using distinguishing properties to classify messages

• US 8,484,301 B2
• Filed: 01/27/2011
• Issued: 07/09/2013
• Est. Priority Date: 02/20/2003
• Status: Expired due to Term

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Wilson, Brian K., Koblas, David A., Penzias, Arno A.
• Primary Examiner(s): NGUYEN, THU HA T
• Application Number:
  US13/015,526
• Publication Number:
  US 20110184976A1
• Time in Patent Office: 894 Days
• Field of Search: 709/201, 709/205, 709/206, 709/207, 379/93.01, 713/150, 715/760
• US Class Current: 709/206
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying in the message a distinguishing property; generating a signature using the distinguishing property; and comparing the signature to a database of signatures generated by previously classified messages.

Claims

1. A method for extracting a distinguishing property of an e-mail message, the method comprising:

receiving an e-mail message; and

executing instructions stored in memory, wherein execution of the instructions by a processor;

extracts one or more distinguishing properties from the e-mail message,

generates a signature based on the one or more distinguishing properties, the generated signature stored in a database of signatures,

determines that the generated signature was previously stored in the database of signatures,

tracks a number of times the generated signature appears in the database of signatures,

updates the database of signatures based on the tracked number of times the generated signature appears, and

processes the e-mail message after determining that the tracked number of times the generated signature has appeared exceeds a predetermined threshold, wherein processing the e-mail message includes classifying the e-mail message as spam.

2. The method of claim 1, wherein extracting one or more distinguishing properties from the e-mail message includes identifying an e-mail address associated with a sender of the e-mail message and extracting a domain name embedded in the e-mail address.

3. The method of claim 1, wherein extracting one or more distinguishing properties from the e-mail message includes identifying a phone number associated with the e-mail message.

4. The method of claim 1, wherein extracting one or more distinguishing properties from the e-mail message includes identifying a physical address associated with the e-mail message.

5. The method of claim 1, wherein extracting one or more distinguishing properties from the e-mail message includes identifying a stock ticker symbol associated with the e-mail message.

6. The method of claim 1, further comprising preprocessing the received e-mail message to exclude non-essential information associated with the e-mail message, the non-essential information including information that does not distinguish the e-mail message.

7. The method of claim 6, wherein the non-essential information includes a decoy e-mail address, the decoy address excluded from the e-mail address after matching the decoy address to an address found on a whitelist.

8. The method of claim 1, wherein a hash function is used to generate the signature.

9. The method of claim 1, wherein the signature is generated after the one or more distinguishing properties meet a minimum byte requirement.

10. The method of claim 1, wherein the generated signature is formatted using extensible markup language.

11. The method of claim 1, wherein processing the e-mail message further includes quarantining the e-mail message classified as spam.

12. The method of claim 1, wherein processing the e-mail message further includes moving the e-mail classified as spam into a junk folder.

13. A system for extracting a distinguishing property of an e-mail message, the system comprising:

a database to store a plurality of generated signatures;

a processor to execute instructions; and

a spam blocking client stored in memory and executable by the processor to;

extract one or more distinguishing properties from a received e-mail message,

generate a signature based on the one or more distinguishing properties, the generated signature stored in the database,

determine that the generated signature was previously stored in the database,

track a number of times the generated signature appears in the database,

update the database based on the tracked number of times the generated signature appears, and

process the e-mail message after determining that the tracked number of times the generated signature has appeared exceeds a predetermined threshold, wherein processing the message includes classifying the e-mail message as spam.

14. The system of claim 13, wherein the generated signature stored in the database is correlated with one or more signatures previously stored in the database, and wherein the correlated signatures represent a combination of signatures indicative of a spam e-mail message.

15. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for extracting a distinguishing property of an e-mail message, the method comprising:

receiving an e-mail message;

extracting one or more distinguishing properties from the e-mail message;

generating a signature based on the one or more distinguishing properties, the generated signature stored in a database of signatures;

determining that the generated signature was previously stored in the database of signatures;

tracking a number of times the generated signature appears in the database of signatures;

updating the database of signatures based on the tracked number of times the generated signature appears; and

processing the e-mail message after determining that the tracked number of times the generated signature has appeared exceeds a predetermined threshold, wherein processing the e-mail message includes classifying the e-mail message as spam.