Message classification using legitimate contact points

• US 8,935,348 B2
• Filed: 06/08/2013
• Issued: 01/13/2015
• Est. Priority Date: 02/20/2003
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan J., Koblas, David A., Wilson, Brian K.
• Primary Examiner(s): Duong, Oanh
• Application Number:
  US13/913,413
• Publication Number:
  US 20130318108A1
• Time in Patent Office: 584 Days
• Field of Search: 709/206, 709223-224, 709/225, 709/229, 709/246, 726/4, 726/23
• US Class Current: 709/206
• CPC Class Codes: G06F 16/24558 Binary matching operations
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying all items of a certain type in the message, determining whether each of the items meets a criterion, and in the event that all the items are determined to meet the criterion, determining a classification of the message. The system includes an interface configured to receive the message, a processor coupled to the interface, configured to identify all items of a certain type in the message; determine whether each of the items meets a criterion; and in the event that all the items are determined to meet the criterion, determine a classification of the message.

Claims

1. A method for classifying a message based on contact points, the method comprising:

storing a plurality of signatures in a database in memory, each of the signatures corresponding to a contact point previously identified as non-spam;

receiving a message over a communication network, the message including one or more contact points; and

executing instructions stored in memory, wherein execution of the instructions by a processor;

extracts a plurality of contact points from the received message,

determines whether the plurality of extracted contact points includes any contact points that does not correspond to any of the signatures in the database,

wherein the received message is classified as non-spam if all of the extracted contact points in the received message corresponds to one or more of the signatures in the database, and

wherein the received message is submitted to one or more additional classification processes if at least one of the extracted contact points does not correspond to any of the signatures in the database; and

adds a new contact point to the database based on a plurality of user classifications that include different classifications, wherein signatures for the new contact point are not added to the database until a probability that the new contact point is non-spam meets a threshold.

2. The method of claim 1, wherein extracting the contact points includes scanning text in the received message and matching against a plurality of formats associated with contact points.

3. The method of claim 1, wherein determining whether the extracted contact points includes any contact points that does not correspond to any of the signatures in the database comprises generating a signature for each of the extracted contact points and matching the generated signatures to the signatures in the database.

4. The method of claim 3, wherein generating the signature comprises reducing the extracted contact point to a canonical equivalent.

5. The method of claim 1, further comprising excluding signatures associated with known spam messages from the database.

6. The method of claim 1, further comprising updating the database based registration.

7. The method of claim 1, further comprising updating the database based on user classification.

8. The method of claim 1, further comprising updating the database by post-processing previously stored messages.

9. A system for classifying a message based on contact points, the method comprising:

memory for storing a plurality of signatures in a database, each of the signatures corresponding to a contact point previously identified as non-spam;

a communication interface for receiving a message over a communication network, the message including one or more contact points; and

a processor for executing instructions stored in memory, wherein execution of the instructions by the processor;

extracts a plurality of contact points from the received message,

determines whether the plurality of extracted contact points includes any contact points that does not correspond to any of the signatures in the database,

wherein the received message is classified as non-spam if all of the extracted contact points in the received message corresponds to one or more of the signatures in the database, and

wherein the received message is submitted to one or more additional classification processes if at least one of the extracted contact points does not correspond to any of the signatures in the database; and

adds a new contact point to the database based on a plurality of user classifications that include different classifications, wherein signatures for the new contact point are not added to the database until a probability that the new contact point is non-spam meets a threshold.

10. The system of claim 9, wherein the processor extracts the contact points by scanning text in the received message and matching against a plurality of formats associated with contact points.

11. The system of claim 9, wherein the processor determines whether the extracted contact points includes any contact points that does not correspond to any of the signatures in the database by generating a signature for each of the extracted contact points and matching the generated signatures to the signatures in the database.

12. The system of claim 11, wherein the processor generates the signature by reducing the extracted contact point to a canonical equivalent.

13. The system of claim 9, wherein the database stored in memory excludes signatures that are associated with known spam messages.

14. The system of claim 9, wherein the database stored in memory is updated based registration.

15. The system of claim 9, wherein the database stored in memory is updated based on user classification.

16. The system of claim 9, wherein the database stored in memory is updated based on post-processing previously stored messages.

17. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for classifying a message based on contact points, the method comprising:

storing a plurality of signatures in a database, each of the signatures corresponding to a contact point previously identified as non-spam;

receiving a message including one or more contact points;

extracting a plurality of contact points from the received message; and

determining whether the plurality of extracted contact points includes any contact points that does not correspond to any of the signatures in the database,

wherein the received message is classified as non-spam if all of the extracted contact points in the received message corresponds to one or more of the signatures in the database, and

wherein the received message is submitted to one or more additional classification processes if at least one of the extracted contact points does not correspond to any of the signatures in the database;

adds a new contact point to the database based on a plurality of user classifications that include different classifications, wherein signatures for the new contact point are not added to the database until a probability that the new contact point is non-spam meets a threshold.