Granted Patent B2

US 8,271,603 · App. 11/455,037 · Granted Sep 18, 2012

Abstract

Claims (38)

1. A method for diminishing false positive classifications of unsolicited electronic-mail, the method comprising:

maintaining a database of signatures in memory, each of the signatures associated with unsolicited electronic-mail to be excluded from an end-user mail client and based on at least a set of message classifiers used to identify distinguishing properties, at least a portion of the signatures generated based on one of the distinguishing properties using a transformation method;

intercepting an electronic-mail message at a network appliance coupled to an electronic-mail server, the electronic-mail message intercepted prior to receipt of the electronic-mail message by the electronic-mail server; and

executing instructions stored in memory, wherein execution of the instructions by a processor:

applies a set of message classifiers to the electronic-mail message, the set of message classifiers comprising:

at least one rule-based heuristic;

at least one content filter used to identify non-essential and decoy information; and

user-generated feedback; and

generates one or more signatures using the transformation method, wherein one or more signatures are indicative of unsolicited electronic-mail based on at least the set of message classifiers applied to the electronic-mail message, and wherein-the one or more signatures are applied to subsequent incoming electronic-mail messages, wherein unsolicited electronic-mail may be identified and false positive identifications of normal electronic-mail messages are reduced.

2. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , wherein the rule-based heuristic includes identification of a uniform resource locator.

3. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , wherein the rule-based heuristic includes identification of a domain name.

4. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , wherein the rule-based heuristic includes identification of an electronic mail address.

5. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , wherein the rule-based heuristic includes identification of an Internet protocol address.

6. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , wherein the rule-based heuristic includes identification of a telephone number.

7. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , wherein the rule-based heuristic includes identification of a physical address.

8. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , wherein the rule-based heuristic includes identification of a name.

9. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , wherein the rule-based heuristic includes identification of a stock ticker

symbol.

10. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , wherein the content filter preprocesses the electronic-mail message.

11. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 10 , wherein preprocessing the electronic-mail message comprises ignoring non-essential information.

12. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 10 , wherein preprocessing the electronic-mail message comprises removing non-essential information.

13. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 10 , wherein preprocessing comprises identifying decoy information.

14. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , wherein the non-essential information comprises spaces, carriage returns, tabs, blank lines, punctuation, hyper-text markup language tags for color, or hyper-text markup language tags for font.

15. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , wherein the decoy information comprises decoy electronic-mail addresses, decoy domain names, decoy uniform resource locators, or decoy Internet protocol addresses.

16. The method for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 1 , further comprising updating a signature database based on at least false positive identification of the electronic-mail message as indicated by user-generated feedback.

17. A system for diminishing false positive classifications of unsolicited electronic-mail, the system comprising:

a database of signatures, each of the signatures associated with unsolicited electronic-mail to be excluded from an end-user mail client and based on at least a set of message classifiers used to identify distinguishing properties, at least a portion of the signatures generated based on one of the distinguishing properties using a transformation method;

an electronic-mail server coupled to a network appliance, the network appliance configured to intercept unsolicited electronic-mail as identified by a signature from the database of signatures prior to receipt of the electronic-mail by the mail server; and

an end-user mail client coupled to the electronic-mail server, the electronic-mail server configured to receive electronic-mail not identified as unsolicited electronic-mail by one or more of the signatures from the database of signatures.

18. The system for diminishing false positive classifications of unsolicited electronic-mail as recited in claim 17 , wherein the set of message classifiers comprises at least one rule-based heuristic, at least one content filter used to identify non-essential and decoy information, and user-generated feedback.

19. A non-transitory computer-readable storage medium having embodied thereon at least one program, the at least one program being executable by a computer to perform a method for diminishing false positive message classification of unsolicited electronic-mail, the method comprising:

maintaining a database of signatures, each of the signatures associated with unsolicited electronic-mail to be excluded from an end-user mail client and based on at least a set of message classifiers used to identify distinguishing properties, at least a portion of the signatures generated based on one of the distinguishing properties using a transformation method;

applying a set of message classifiers to an electronic-mail message intercepted prior to receipt of the electronic-mail message by an electronic-mail server, the set of message classifiers comprising:

at least one rule-based heuristic,

at least one content filter used to identify non-essential and decoy information, and

user-generated feedback;

generating one or more signatures using the transformation method, wherein the one or more signatures are indicative of unsolicited electronic-mail based on at least the set of message classifiers applied to the electronic-mail message; and

applying the one or more signatures to subsequent incoming electronic-mail messages, wherein unsolicited electronic-mail may be identified and false positive identifications of normal electronic-mail messages are reduced.

Assignments (25)