Using distinguishing properties to classify messages
A system and method are disclosed for classifying a message. The method includes receiving the message, identifying in the message a distinguishing property; generating a signature using the distinguishing property; and comparing the signature to a database of signatures generated by previously classified messages.
1. A method for classifying messages, the method comprising:
receiving an indication sent by a user over a communication network that an electronic message is spam;
executing instructions stored in memory, wherein execution of the instructions by a processor:
identifies one or more distinguishing features, wherein the identified distinguishing features include numerical URLs where domain names are hidden,
generates a plurality of signatures, each signature based on one or more distinguishing features of the electronic message,
compares the signatures to a list of known domains, wherein matching signatures are excluded, and
compares the remaining signatures for forbidden characters, wherein signature with forbidden characters are excluded; and
storing the remaining signatures in memory for comparison to subsequent electronic messages.
2. The method of claim 1 , wherein the numerical URLs include a binary number.
3. The method of claim 1 , wherein the numerical URLs include a single 32 bit number.
4. The method of claim 1 , wherein the obscure distinguishing features include a numerical IP address having integers between 0 and 255.
5. The method of claim 1 , further comprising detecting one or more e-mail addresses in the electronic message.
6. The method of claim 1 , wherein the matching signatures are associated with decoy e-mail addresses.
7. The method of claim 6 , wherein the list of known domains is a whitelist.
8. The method of claim 1 , further comprising verifying that the distinguishing properties meet one or more conditions before being used to generate the signatures.
9. The method of claim 7 , wherein the one or more conditions include a minimum byte requirement.
10. A system for classifying messages, the system comprising:
a database to store a list of known domains;
a processor to execute instructions; and
a spam blocking client stored in memory and executable by the processor to:
identifies one or more distinguishing features of an electronic message sent over a communication network by a user that indicates that the electronic message is spam, wherein the identified distinguishing features include numerical URLs where domain names are hidden,
generates a plurality of signatures, each signature based on one or more distinguishing features of the electronic message,
compares the signatures to a list of known domains, wherein matching signatures are excluded, and
compares the remaining signatures for forbidden characters, wherein signature with forbidden characters are excluded; and
storing the remaining signatures in memory for comparison to subsequent electronic messages.
11. The system of claim 10 , wherein the numerical URLs include a binary number.
12. The system of claim 10 , wherein the numerical URLs include a single 32 bit number.
13. The system of claim 10 , wherein the obscure distinguishing features include a numerical IP address having integers between 0 and 255.
14. The system of claim 10 , further comprising detecting one or more e-mail addresses in the electronic message.
15. The system of claim 10 , wherein the matching signatures are associated with decoy e-mail addresses.
16. The system of claim 15 , wherein the list of known domains is a whitelist.
17. The system of claim 10 , further comprising verifying that the distinguishing properties meet one or more conditions before being used to generate the signatures.
18. The system of claim 17 , wherein the one or more conditions include a minimum byte requirement.
19. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for classifying messages, the method comprising:
receiving an indication sent by a user that an electronic message is spam;
identifying one or more distinguishing features, wherein the identified distinguishing features include numerical URLs where domain names are hidden;
generating a plurality of signatures, each signature based on one or more distinguishing features of the electronic message;
comparing the signatures to a list of known domains, wherein matching signatures are excluded;
comparing the remaining signatures for forbidden characters, wherein signature with forbidden characters are excluded; and
storing the remaining signatures for comparison to subsequent electronic messages.