Mail server probability spam filter
View Patent ↗Email senders may transmit emails over the internet to a mail server that handles emails for a plurality of users (clients). The mail server may use a spam filter to remove the spam and then transmit the filtered emails to the addressed clients. The spam filter may use a white list, black list, probability filter and keyword filter. The probability filter may use a user mail corpus and a user spam corpus for creating a user probability table that lists tokens and the probability that an email is a spam if the email contains the token. The probability filter may also use a general mail corpus and a general spam corpus for creating a general probability table that. Tokens of incoming emails may be searched for in the user probability table, and if not found, the general probability table to calculate the probability that the email is a spam.
1. A process for filtering spam emails from a stream of emails, comprising the steps of:
A) building a general mail corpus, a general spam corpus; a user mail corpus and a user spam corpus;
B) building a general probability table based on the general mail corpus and the general spam corpus, wherein the general probability table includes a list of tokens and a corresponding list of probabilities that an email is a spam for containing the corresponding token;
C) building a user probability table based on the user mail corpus and the user spam corpus;
wherein the user probability table includes a list of tokens and a corresponding list of probabilities that an email is a spam for containing the corresponding token;
D) receiving an email;
E) parsing the email into a plurality of tokens;
F) finding a token score for each token in the plurality of tokens, comprising the steps of:
a) searching the user probability table for each token;
b) if a token is not listed in the user probability table, searching the general probability table for that token; and
c) if the token is also not listed in the general probability table, ignoring the token or setting the token to a nominal value;
G) determining an email score, wherein the email score approximates a probability the email is a spam for containing all or some subset of the tokens in the email;
H) if the email score is above a predetermined value, diverting the email; and
I) if the email score is not above the predetermined value, transmitting the email to a user.
2. The process for claim 1 , further comprising the steps of:
J) adding a diverted email to the user spam corpus; and
K) adding a transmitted email to the user mail corpus.
3. The process for claim 2 , further comprising the steps of:
L) adding a diverted email to the general spam corpus; and
M) adding a transmitted email to the general mail corpus.
4. The process for claim 3 , further comprising the step of:
N) performing a white list filter before step E) and, if a sender of the email is on a white list, transmitting the email to a client, adding the email to the user mail corpus, adding the email to the general mail corpus and stopping the filtering process for the email.
5. The process for claim 4 , further comprising the step of:
O) performing a black list filter before step E) and, if a sender of the email is on a black list, diverting the email, adding the email to the user spam corpus, adding the email to the general spam corpus and stopping the filtering process for the email.