Using distinguishing properties to classify messages

• US 9,524,334 B2
• Filed: 11/11/2015
• Issued: 12/20/2016
• Est. Priority Date: 02/20/2003
• Status: Expired due to Term

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Wilson, Brian K., Koblas, David A., Penzias, Arno A.
• Primary Examiner(s): NGUYEN, THU HA T
• Application Number:
  US14/938,573
• Publication Number:
  US 20160078124A1
• Time in Patent Office: 405 Days
• Field of Search: 703/203, 703/206, 709/203, 709/206, 709/205
• US Class Current: 1/1
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying in the message a distinguishing property; generating a signature using the distinguishing property; and comparing the signature to a database of signatures generated by previously classified messages.

Claims

1. A method for classifying messages, the method comprising:

receiving an electronic message over a communication network; and

executing instructions stored in memory, wherein execution of the instructions by a processor;

scans the received electronic message to identify candidate sections that include top-level domains, wherein the scanned candidate sections include the body of the received electronic message,

identifies one or more top-level domain names in each candidate section, wherein at least one of the identified top-level domain names is part of an email address,

verifies that the email address associated with the at least one top-level domain name from the electronic message is valid based on detected presence of required characters,

identifies that the email address associated with the at least one top-level domain name from the electronic message does not include any forbidden characters,

characterizes the electronic message as having one or more distinguishing features based on the verification that the email address includes the required characters and the identification that the email address does not include the forbidden characters, wherein the distinguishing features include at least email addresses that have the required characters and that lack the forbidden characters,

generates a signature for the characterized electronic message based on a set of distinguishing features; and

storing the generated signature for the electronic message in memory for comparison to subsequently received electronic messages.

2. The method of claim 1, wherein the generated signature corresponds to the received electronic message characterized as being spam.

3. The method of claim 2, wherein the generated signatures for spam are stored in a database that includes other signatures associated with electronic messages characterized as being spam.

4. The method of claim 3, wherein the spam database includes information related to how many times a particular signature has been associated with an electronic message characterized as being spam.

5. The method of claim 1 further comprising excluding email addresses associated with the received electronic message characterized as being decoys.

6. The method of claim 5, wherein the exclusion of decoy email addresses is performed by comparing the verified one or more email addresses against a list of well-known domains.

7. The method of claim 1, wherein the identified candidate sections further includes URLs.

8. The method of claim 7, wherein the URLs have identifiable IP addresses that are characterized as one or more distinguishing features for the received electronic message.

9. The method of claim 1, wherein generation of the signature includes transformation of the set of distinguishing features via compression, expansion, or checksum.

10. The method of claim 1, wherein generation of the signature is based on the use of the set of distinguishing features without any transformation.

11. The method of claim 1, wherein generation of the signature is performed using a hash function.

12. The method of claim 1 further comprising correlating the stored signatures thereby obtaining one or more relationships that is used to characterize subsequently received electronic messages.

13. A system for classifying messages, comprising:

a user device that receives electronic messages over a communication network;

a processor that executes instructions stored in memory to;

scan the received electronic messages from the mail device to identify candidate sections that include top-level domains, wherein the scanned candidate sections include the body of the received electronic message,

identify one or more top-level domains in each candidate section, wherein at least one of the identified top-level domain names is part of an email address,

verify that an email address associated with the at least one top-level domain name from the electronic message is valid based on detected presence of required characters,

identify that the email address associated with the electronic message does not include any forbidden characters,

characterize the electronic message as having one or more distinguishing features based on the verification that the email address has the required characters and the identification that the email addresses does not include the forbidden characters, wherein the distinguishing features include at least email addresses that have the required characters and that lack the forbidden characters, and

generate a signature for the characterized electronic message based on a set of distinguishing features; and

a server that stores the generated signature for the electronic message for comparison to subsequently received electronic messages.

14. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for classifying messages, the method comprising:

receiving an electronic message over a communication network; and

scanning the received electronic message to identify candidate sections that include top-level domains, wherein the scanned candidate sections include the body of the received electronic message;

identifying one or more top-level domain names in each candidate section, wherein at least one of the identified top-level domain names is part of an email address;

verifying that the email address associated with the at least one top-level domain name from the electronic message is valid based on detected presence of required characters;

identifying that the email address associated with the at least one top-level domain name from the electronic message does not include any forbidden characters;

characterizing the electronic message as having one or more distinguishing features based on the verification that the email address includes the required characters and the identification that the email address does not include the forbidden characters, wherein the distinguishing features include at least email addresses that have the required characters and that lack the forbidden characters;

generating a signature for the characterized electronic message based on a set of distinguishing features; and

storing the generated signature for the electronic message in memory for comparison to subsequently received electronic messages.