Group based spam classification
View Patent ↗An e-mail filter is used to classify received e-mails so that some of the classes may be filtered, blocked, or marked. The e-mail filter may include a classifier that can classify an e-mail as belonging to a particular class and an e-mail grouper that can detect substantially similar, but possibly not identical, e-mails. The e-mail grouper determines groups of substantially similar e-mails in an incoming e-mail stream. For each group, the classifier determines whether one or more test e-mails from the group belongs to the particular class. The classifier then designates the class to which the other e-mails in the group belong based on the results for the test e-mails.
1. A method of classifying e-mail as spam, the method comprising:
receiving multiple e-mails, wherein each received e-mail includes a header portion and a content portion;
storing the received e-mails;
analyzing the content portions of the stored e-mails to cluster the stored e-mails into multiple groups of substantially duplicate e-mails;
storing the multiple groups of substantially duplicate e-mails;
for at least one of the stored groups, selecting a set of one or more test e-mails from that group;
determining a proportion of spam e-mails in the selected set of test e-mails;
comparing the proportion of spam e-mails to a threshold proportion to determine whether the proportion of spam e-mails exceeds the threshold;
if the comparison indicates that the proportion of spam e-mails in the selected set of test e-mails exceeds the threshold proportion, classifying the e-mails in the at least one stored group as spam; and
if the comparison indicates that the proportion of spam e-mails in the selected set of test e-mails does not exceed the threshold proportion, classifying the e-mails in the at least one stored group as non-spam.
2. The method of claim 1 wherein selecting the set of one or more test e-mails comprises selecting a sufficient number of test e-mails for the set such that the proportion of spam e-mails in the set accurately reflects a proportion of spam e-mails in the at least one stored group.
3. The method of claim 1 wherein analyzing the content portions of the stored e-mails to cluster the stored e-mails into multiple groups of substantially duplicate e-mails comprises:
performing duplicate detection on the stored e-mails to cluster the stored e-mails into groups of substantially duplicate e-mails.
4. The method of claim 1 wherein analyzing the content portions of the stored e-mails to cluster the stored e-mails into groups of substantially duplicate e-mails comprises:
performing duplicate detection on a received e-mail when the e-mail is received to determine if the received e-mail is a substantially duplicate of e-mails in an existing group of substantially duplicate e-mails;
adding the received e-mail to the existing group of substantially duplicate e-mails when the received e-mail is a substantial duplicate of e-mails in the existing group; and
using the received e-mail to start a new group of substantially duplicate e-mails when the received e-mail is not a substantial duplicate of e-mails in the existing group of substantially duplicate e-mails.
5. The method of claim 1 further comprising:
saving a signature of the at least one group when the proportion of spam e-mails in the selected set of test e-mails exceeds the predetermined threshold proportion;
receiving a new e-mail;
using the signature to determine whether the new e-mail is a substantial duplicate of the e-mails in the at least one group;
classifying the new e-mail as spam when the new e-mail is a substantial duplicate of the e-mails in the at least one group.
6. The method of claim 5 wherein the substantially duplicate e-mails in the at least one stored group are part of a larger population of substantially duplicate e-mails, the method further comprising selecting a size for the at least one stored group such that a proportion of spam e-mails in the at least one stored group accurately reflects a proportion of spam e-mails in the larger population.
7. The method of claim 1 wherein the threshold proportion is based on a misclassification cost of misclassifying spam e-mail as non-spam e-mail and a misclassification cost of misclassifying non-spam e-mail as spam e-mail.
8. The method of claim 1 , further comprising handling the e-mails classified as spam.
9. The method of claim 8 wherein handling the e-mails classified as spam comprises deleting the e-mails classified as spam.
10. The method of claim 8 wherein handling the e-mails classified as spam comprises marking the e-mails as spam and forwarding the marked e-mails to a recipient specified by the marked e-mail.
11. A computer storage medium having a computer program embodied thereon for classifying e-mail as spam, the computer program comprising instructions for causing a computer to perform the following operations:
receive multiple e-mails, wherein each received e-mail includes a header portion and a content portion;
store the received e-mails;
analyze the content portions of the stored e-mails to cluster the stored e-mails into multiple groups of substantially duplicate e-mails;
store the multiple groups of substantially duplicate e-mails;
for at least one of the stored groups, select a set of one or more test e-mails from that group;
determine a proportion of spam e-mails in the selected set of test e-mails;
compare the proportion of spam e-mails to a threshold proportion to determine whether the proportion of spam e-mails exceeds the threshold;
if the comparison indicates that the proportion of spam e-mails in the selected set of test e-mails exceeds the threshold proportion, classify the e-mails in the at least one stored group as spam; and
if the comparison indicates that the proportion of spam e-mails in the selected set of test e-mails does not exceed the threshold proportion, classify the e-mails in the at least one stored group as non-spam.
12. The computer storage medium of claim 11 wherein, to select the set of one or more test e-mails, the computer program further comprises instruction for causing a computer to select a sufficient number of test e-mails for the set such that the proportion of spam e-mails in the set accurately reflects a proportion of spam e-mails in the at least one stored group.
13. The computer storage medium of claim 11 wherein, to analyze the content portions of the stored e-mails to cluster the stored e-mails into multiple groups of substantially duplicate e-mails, the computer program further comprises instruction for causing a computer to:
perform duplicate detection on the set of stored e-mails to cluster the stored e-mails into groups of substantially duplicate e-mails.
14. The computer storage medium of claim 11 wherein, to analyze the content portions of the stored e-mails to cluster the stored e-mails into groups of substantially duplicate e-mails, the computer program further comprises instruction for causing a computer to:
perform duplicate detection on a received e-mail when the e-mail is received to determine if the received e-mail is a substantial duplicate of e-mails in an existing group of substantially duplicate e-mails;
add the received e-mail to the existing group of substantially duplicate e-mails when the received e-mail is a substantial duplicate of e-mails in the existing group; and
use the received e-mail to start a new group of substantially duplicate e-mails when the received e-mail is not a substantial duplicate of e-mails in the existing group of substantially duplicate e-mails.
15. The computer storage medium of claim 11 wherein the computer program further comprises instruction for causing a computer to:
save a signature of the at least one group when the proportion of spam e-mails in the selected set of test e-mails exceeds the threshold proportion;
receive a new e-mail;
use the signature to determine whether the new e-mail is a substantial duplicate of the e-mails in the at least one group;
classify the new e-mail as spam when the new e-mail is a substantial duplicate of the e-mails in the at least one group.
16. The computer storage medium of claim 15 wherein the substantially duplicate e-mails in the at least one stored group are part of a larger population of substantially duplicate e-mails, computer program further comprises instruction for causing a computer to select a size for the at least one stored group such that a proportion of spam e-mails in the at least one stored group accurately reflects a proportion of spam e-mails in the larger population.
17. The computer storage medium of claim 11 wherein the threshold proportion is based on a misclassification cost of misclassifying spam e-mail as non-spam e-mail and a misclassification cost of misclassifying non-spam e-mail as spam e-mail.
18. An apparatus for classifying e-mail as spam, the apparatus comprising:
one or more processors and a computer-readable medium coupled to the one or more processors, the medium storing instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving multiple e-mails, wherein each received e-mail includes a header portion and a content portion;
storing received e-mails;
analyzing the content portions of the stored e-mails to cluster the stored e-mails into multiple groups of substantially duplicate e-mails;
storing the multiple groups of substantially duplicate e-mails;
for at least one of the groups, selecting a set of one or more test e-mails from that group;
determining the proportion of spam e-mails in the set of test e-mails; and
comparing the proportion of spam e-mails to a threshold proportion to determine whether the proportion of spam e-mails exceeds the threshold; and
means for classifying the e-mails in the at least one stored group as spam if the comparison indicates that the proportion of spam e-mails in the selected set of test e-mails exceeds the threshold proportion, and
means for classifying the e-mails in the at least one stored group as non-spam if the comparison indicates that the proportion of spam e-mails in the selected set of test e-mails does not exceed the threshold proportion.
19. The apparatus of claim 18 wherein selecting the set of one or more test e-mails comprises selecting a sufficient number of test e-mails for the set such that the proportion of spam e-mails in the set accurately reflects a proportion of spam e-mails in the at least one stored group.
20. The apparatus of claim 18 wherein analyzing the content portions of the stored e-mails to cluster the stored e-mails into groups of substantially duplicate e-mails comprises:
performing duplicate detection on the set of stored e-mails to cluster the set of stored e-mails into groups of substantially duplicate e-mails.
21. The apparatus of claim 18 wherein analyzing the content portions of the stored e-mails to cluster the stored e-mails into groups of substantially duplicate e-mails comprises:
performing duplicate detection on a received e-mail when the e-mail is received to determine if the received e-mail is a substantial duplicate of e-mails in an existing group of substantially duplicate e-mails;
adding the received e-mail to the existing group of substantially duplicate e-mails when the received e-mail is a substantial duplicate of e-mails in the existing group; and
using the received e-mail to start a new group of substantially duplicate e-mails when the received e-mail is not a substantial duplicate of e-mails in the existing group of substantially duplicate e-mails.
22. The apparatus of claim 18 further comprising:
saving a signature of the at least one group when the proportion of spam e-mails in the selected set of test e-mails exceeds the threshold proportion;
receiving a new e-mail;
using the signature to determine whether the new e-mail is a substantial duplicate of the e-mails in the at least one group;
classifying the new e-mail as spam when the new e-mail is a substantial duplicate of the e-mails in the at least one group.
23. The apparatus of claim 22 wherein the substantially duplicate e-mails in the at least one stored group are part of a larger population of substantially duplicate e-mails, the apparatus further comprising selecting a size for the at least one stored group such that a proportion of spam e-mails in the at least one stored group accurately reflects a proportion of spam e-mails in the larger population.
24. The apparatus of claim 18 wherein the threshold proportion is based on a misclassification cost of misclassifying spam e-mail as non-spam e-mail and a misclassification cost of misclassifying non-spam e-mail as spam e-mail.