System, method, and computer program product for identifying objects as at least potentially unwanted based on strings of symbols
View Patent ↗A system, method, and computer program product are provided for identifying objects as being at least potentially unwanted based on strings of symbols identified therein. In use, strings of symbols are identified in a plurality of sequential lines of an object. Further, the object is conditionally identified as being at least potentially unwanted, based on the strings of symbols.
1. A method, comprising:
receiving an electronic mail message at a client computing device that includes a processor and a memory;
parsing an object included in the electronic mail message to allow strings of symbols across lines of the object to be identified;
determining a ratio of symbols in a portion of the object to a total number of characters in the portion of the object;
comparing the ratio to a predetermined threshold to determine whether the object should be decoded;
decoding characters of the object based on a font size and associations of formation characters to determine decoded characters that extend across sequential lines of the object, wherein for a particular font and the font size, the strings of symbols are identified as formation characters based on corresponding width and line values associated with consecutive spaces in sequential lines;
comparing the decoded characters to known unwanted content; and
calculating a score associated with the object based on a predefined weight for decoded characters that match the known unwanted content.
2. The method of claim 1 , wherein the decoded characters represent letters.
3. The method of claim 2 , wherein the letters represent a word.
4. The method of claim 2 , wherein the letters represent unwanted content.
5. The method of claim 1 , wherein the decoded characters include alphanumeric characters.
6. The method of claim 1 , wherein the object is a file.
7. The method of claim 1 , wherein the font size is based on a font case of the decoded characters being represented by the strings of symbols.
8. The method of claim 1 , wherein the decoded characters are associated with the strings of symbols and are stored in a temporary object.
9. Non-transitory media that includes code for execution and when executed by one or more processors is operable to perform operations comprising:
receiving an electronic mail message at a client computing device that includes a processor and a memory;
parsing an object included in the electronic mail message to allow strings of symbols across lines of the object to be identified;
determining a ratio of symbols in a portion of the object to a total number of characters in the portion of the object;
comparing the ratio to a predetermined threshold to determine whether the object should be decoded;
decoding characters of the object based on a font size and associations of formation characters to determine decoded characters that extend across sequential lines of the object, wherein for a particular font and the font size, the strings of symbols are identified as formation characters based on corresponding width and line values associated with consecutive spaces in sequential lines;
comparing the decoded characters to known unwanted content; and
calculating a score associated with the object based on a predefined weight for decoded characters that match the known unwanted content.
10. The media of claim 9 , wherein the font size is based on a font case of the decoded characters represented by the strings of symbols.
11. The media of claim 9 , wherein the decoded characters represent letters.
12. The media of claim 11 , wherein the letters represent a word.
13. The media of claim 11 , wherein the letters represent unwanted content.
14. The media of claim 9 , wherein the decoded characters include alphanumeric characters.
15. An apparatus, comprising:
one or more processors operable to execute instructions such that the apparatus is configured for:
receiving an electronic mail message;
parsing an object included in the electronic mail message to allow strings of symbols across lines of the object to be identified;
determining a ratio of symbols in a portion of the object to a total number of characters in the portion of the object;
comparing the ratio to a predetermined threshold to determine whether the object should be decoded;
decoding characters of the object based on a font size and associations of formation characters to determine decoded characters that extend across sequential lines of the object, wherein for a particular font and the font size, the strings of symbols are identified as formation characters based on corresponding width and line values associated with consecutive spaces in sequential lines;
comparing the decoded characters to known unwanted content; and
calculating a score associated with the object based on a predefined weight for decoded characters that match the known unwanted content.
16. The apparatus of claim 15 , wherein the font size is based on a font case of the decoded characters represented by the strings of symbols.
17. The apparatus of claim 15 , wherein the decoded characters represent letters.
18. The apparatus of claim 17 , wherein the letters represent a word.
19. The apparatus of claim 17 , wherein the letters represent unwanted content.
20. The apparatus of claim 15 , wherein the decoded characters include alphanumeric characters.