Systems and methods for creating text signatures for identifying spam messages
View Patent ↗A computer-implemented method for creating text signatures for identifying spam messages may include: 1) identifying a spam message, 2) tokenizing the text of the spam message, 3) identifying at least one incorrectly punctuated token within the tokenized text of the spam message, 4) identifying, within the tokenized text of the spam message, at least one token that is adjacent to the incorrectly punctuated token, and then 5) creating a candidate signature for identifying future instances and/or variations of the spam message that includes both the incorrectly punctuated token and the token that is adjacent to the incorrectly punctuated token. Corresponding systems and configured computer-readable media are also disclosed.
1. A computer-implemented method for creating text signatures for identifying spam messages, the method comprising:
identifying a spam message;
tokenizing the text of the spam message;
identifying at least one incorrectly punctuated token within the tokenized text of the spam message;
identifying, within the tokenized text of the spam message, at least two tokens that are adjacent to the incorrectly punctuated token by at least one of:
identifying a predetermined number of tokens preceding the incorrectly punctuated token that are suitable for inclusion in a candidate signature;
identifying a predetermined number of tokens following the incorrectly punctuated token that are suitable for inclusion in the candidate signature;
creating the candidate signature for identifying future spam messages that includes both the incorrectly punctuated token and the tokens that are adjacent to the incorrectly punctuated token;
wherein at least a portion of the method is performed by a computing device comprising at least one processor.
2. The method of claim 1 , wherein tokenizing the text of the spam message comprises:
identifying each line of text within the spam message;
tokenizing each line of text within the spam message.
3. The method of claim 1 , wherein:
identifying the predetermined number of tokens preceding the incorrectly punctuated token that are suitable for inclusion in the candidate signature comprises identifying three tokens preceding the incorrectly punctuated token that are suitable for inclusion in the candidate signature;
identifying the predetermined number of tokens following the incorrectly punctuated token that are suitable for inclusion in the candidate signature comprises identifying three tokens following the incorrectly punctuated token that are suitable for inclusion in the candidate signature.
4. The method of claim 1 , wherein the tokens that are suitable for inclusion in the candidate signature comprise tokens that do not include at least one of:
Uniform Resource Locators;
personal-name titles;
dates;
times.
5. The method of claim 1 , wherein identifying the tokens that are adjacent to the incorrectly punctuated token comprises:
determining that less than a predetermined number of suitable tokens precede the incorrectly punctuated token;
automatically compensating for a lack of suitable tokens preceding the incorrectly punctuated token by identifying an increased number of tokens following the incorrectly punctuated token that are suitable for inclusion in the candidate signature.
6. The method of claim 1 , wherein identifying the tokens that are adjacent to the incorrectly punctuated token comprises:
determining that less than a predetermined number of suitable tokens follow the incorrectly punctuated token;
automatically compensating for a lack of suitable tokens following the incorrectly punctuated token by identifying an increased number of tokens preceding the incorrectly punctuated token that are suitable for inclusion in the candidate signature.
7. The method of claim 1 , wherein identifying the tokens that are adjacent to the incorrectly punctuated token comprises disregarding superfluous whitespace characters.
8. The method of claim 1 , further comprising tokenizing the candidate signature.
9. The method of claim 8 , further comprising determining at least one of:
the number of misspelled words within the candidate signature;
the ratio of misspelled words to correctly spelled words within the candidate signature;
the ratio of whitespace to non-whitespace characters within the candidate signature;
whether all text within the candidate signature is capitalized;
the total number of tokens within the candidate signature.
10. The method of claim 9 , wherein determining the number of misspelled words within the candidate signature comprises determining the number of unique misspelled words within the candidate signature.
11. The method of claim 9 , further comprising creating metadata for the candidate signature that identifies at least one of:
the number of misspelled words within the candidate signature;
the ratio of misspelled words to correctly spelled words within the candidate signature;
the ratio of whitespace to non-whitespace characters within the candidate signature;
whether all text within the candidate signature is capitalized;
the total number of tokens within the candidate signature.
12. The method of claim 11 , further comprising using the metadata to rank the candidate signature relative to at least one additional candidate signature associated with the spam message.
13. The method of claim 12 , wherein using the metadata to rank the candidate signature relative to at least one additional candidate signature associated with the spam message comprises ranking the candidate signature based on at least one of:
the ratio of misspelled words to correctly spelled words within the candidate signature;
whether all text within the candidate signature is capitalized;
whether the ratio of whitespace to non-whitespace characters within the candidate signature exceeds a predetermined threshold;
whether the ratio of misspelled words to correctly spelled words within the candidate signature exceeds a predetermined threshold.
14. The method of claim 13 , further comprising:
determining that the candidate signature represents the n highest-ranked candidate signature associated with the spam message;
including the candidate signature in a spam-detection heuristic;
applying the spam-detection heuristic to at least one electronic message in an attempt to determine whether the electronic message represents a spam message.
15. The method of claim 14 , wherein applying the spam-detection heuristic comprises:
deploying the spam-detection heuristic on an endpoint computing device;
deploying the spam-detection heuristic on a backend computing device.
16. A system for creating signatures for identifying spam messages, the system comprising:
a spam-identification module programmed to identify a spam message;
a tokenization module programmed to tokenize the text of the spam message;
a token-identification module programmed to:
identify at least one incorrectly punctuated token within the tokenized text of the spam message;
identify, within the tokenized text of the spam message, at least two tokens that are adjacent to the incorrectly punctuated token by at least one of:
identifying a predetermined number of tokens preceding the incorrectly punctuated token that are suitable for inclusion in a candidate signature;
identifying a predetermined number of tokens following the incorrectly punctuated token that are suitable for inclusion in the candidate signature;
a signature-creation module programmed to create a candidate signature for identifying future spam messages that includes both the incorrectly punctuated token and the tokens that are adjacent to the incorrectly punctuated token;
at least one processor configured to execute the spam-identification module, the tokenization module, the token-identification module, and the signature-creation module.
17. The system of claim 16 , wherein the signature-creation module is further programmed to create metadata for the candidate signature that identifies at least one of:
the number of misspelled words within the candidate signature;
the ratio of misspelled words to correctly spelled words within the candidate signature;
the ratio of whitespace to non-whitespace characters within the candidate signature;
whether all text within the candidate signature is capitalized;
the total number of tokens within the candidate signature.
18. The system of claim 17 , wherein the signature-creation module is further programmed to use the metadata to rank the candidate signature relative to at least one additional candidate signature associated with the spam message based on at least one of:
the ratio of misspelled words to correctly spelled words within the candidate signature;
whether all text within the candidate signature is capitalized;
whether the ratio of whitespace to non-whitespace characters within the candidate signature exceeds a predetermined threshold;
whether the ratio of misspelled words to correctly spelled words within the candidate signature exceeds a predetermined threshold.
19. A non-transitory computer-readable medium comprising computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify a spam message;
tokenize the text of the spam message;
identify at least one incorrectly punctuated token within the tokenized text of the spam message;
identify, within the tokenized text of the spam message, at least two tokens that are adjacent to the incorrectly punctuated token by at least one of:
identifying a predetermined number of tokens preceding the incorrectly punctuated token that are suitable for inclusion in a candidate signature;
identifying a predetermined number of tokens following the incorrectly punctuated token that are suitable for inclusion in the candidate signature;
create the candidate signature for identifying future spam messages that includes both the incorrectly punctuated token and the tokens that are adjacent to the incorrectly punctuated token.