System, method, and computer program product for identifying objects as at least potentially unwanted based on strings of symbols
First Claim
Patent Images
1. A method, comprising:
- receiving an electronic mail message at a client computing device that includes a processor and a memory;
parsing an object included in the electronic mail message to allow strings of symbols across lines of the object to be identified;
determining a ratio of symbols in a portion of the object to a total number of characters in the portion of the object;
comparing the ratio to a predetermined threshold to determine whether the object should be decoded;
decoding characters of the object based on a font size and associations of formation characters to determine decoded characters that extend across sequential lines of the object, wherein for a particular font and the font size, the strings of symbols are identified as formation characters based on corresponding width and line values associated with consecutive spaces in sequential lines;
comparing the decoded characters to known unwanted content; and
calculating a score associated with the object based on a predefined weight for decoded characters that match the known unwanted content.
9 Assignments
0 Petitions
Accused Products
Abstract
A system, method, and computer program product are provided for identifying objects as being at least potentially unwanted based on strings of symbols identified therein. In use, strings of symbols are identified in a plurality of sequential lines of an object. Further, the object is conditionally identified as being at least potentially unwanted, based on the strings of symbols.
9 Citations
20 Claims
-
1. A method, comprising:
-
receiving an electronic mail message at a client computing device that includes a processor and a memory; parsing an object included in the electronic mail message to allow strings of symbols across lines of the object to be identified; determining a ratio of symbols in a portion of the object to a total number of characters in the portion of the object; comparing the ratio to a predetermined threshold to determine whether the object should be decoded; decoding characters of the object based on a font size and associations of formation characters to determine decoded characters that extend across sequential lines of the object, wherein for a particular font and the font size, the strings of symbols are identified as formation characters based on corresponding width and line values associated with consecutive spaces in sequential lines; comparing the decoded characters to known unwanted content; and calculating a score associated with the object based on a predefined weight for decoded characters that match the known unwanted content. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
-
9. Non-transitory media that includes code for execution and when executed by one or more processors is operable to perform operations comprising:
-
receiving an electronic mail message at a client computing device that includes a processor and a memory; parsing an object included in the electronic mail message to allow strings of symbols across lines of the object to be identified; determining a ratio of symbols in a portion of the object to a total number of characters in the portion of the object; comparing the ratio to a predetermined threshold to determine whether the object should be decoded; decoding characters of the object based on a font size and associations of formation characters to determine decoded characters that extend across sequential lines of the object, wherein for a particular font and the font size, the strings of symbols are identified as formation characters based on corresponding width and line values associated with consecutive spaces in sequential lines; comparing the decoded characters to known unwanted content; and calculating a score associated with the object based on a predefined weight for decoded characters that match the known unwanted content. - View Dependent Claims (10, 11, 12, 13, 14)
-
-
15. An apparatus, comprising:
-
one or more processors operable to execute instructions such that the apparatus is configured for; receiving an electronic mail message; parsing an object included in the electronic mail message to allow strings of symbols across lines of the object to be identified; determining a ratio of symbols in a portion of the object to a total number of characters in the portion of the object; comparing the ratio to a predetermined threshold to determine whether the object should be decoded; decoding characters of the object based on a font size and associations of formation characters to determine decoded characters that extend across sequential lines of the object, wherein for a particular font and the font size, the strings of symbols are identified as formation characters based on corresponding width and line values associated with consecutive spaces in sequential lines; comparing the decoded characters to known unwanted content; and calculating a score associated with the object based on a predefined weight for decoded characters that match the known unwanted content. - View Dependent Claims (16, 17, 18, 19, 20)
-
Specification