Methods of generating signatures from groups of electronic messages and related methods and systems for identifying spam messages
A method of generating a signature for a group of electronic messages that each include a plurality of characters comprises extracting a plurality of blocks of characters from each of the electronic messages, mathematically processing each of the blocks of characters from each electronic message, and generating a signature for the group of electronic messages based at least in part on the mathematically processed blocks of characters. In some embodiments a counting Bloom filter may be used to generate the signature. The signatures generated by these methods may be used to identify spam.
1. A method of identifying a user account as a potential source of electronic spam, comprising:
receiving, by a server, short messaging service text messages transmitted via a cellular network from a device, the short messaging service text messages associated with the user account;
hashing, by the server, blocks of characters extracted from the short messaging service text messages according to a hash function to generate hash values;
generating, by the server, a Bloom filter output array from the hash values generated from the blocks of characters extracted from the short messaging service text messages;
determining, by the server, an entropy of the Bloom filter output array generated from the hash values;
identifying, by the server, the user account as a potential source of spam in response to non-zero positions in the entropy of the Bloom filter output array generated from the hash values.
2. The method of claim 1 , further comprising retrieving an entropy threshold.
3. The method of claim 2 , further comprising comparing the entropy to the entropy threshold.
4. The method of claim 3 , further comprising identifying the user account as the potential source of the spam in response to the entropy being less than the entropy threshold.
5. The method of claim 3 , further comprising incrementing the non-zero positions in the entropy of the Bloom filer output array according to a count of the short messaging service text messages.
6. A hardware system for identifying a short messaging service text message as spam, comprising:
a hardware processor; and
a memory device, the memory device storing instructions, the instructions when executed causing the hardware processor to perform operations, the operations comprising:
receiving short messaging service text messages transmitted via a cellular network from a device, the short messaging service text messages associated with a user account;
hashing blocks of characters extracted from the short messaging service text messages according to a hash function to generate hash values;
generating an entropy associated with a Bloom filter output array from the hash values generated from the blocks of characters extracted from the short messaging service text messages;
determining non-zero positions in the entropy associated with the Bloom filter output array generated from the hash values;
assigning the non-zero positions in the entropy associated with the Bloom filter output array to a signature representing the short messaging service text messages; and
identifying the short messaging service text messages as the spam in response to the entropy.
7. A memory device storing instruction that when executed cause a hardware processor to perform operations, the operations comprising:
receiving short messaging service text messages transmitted via a cellular network from a device, the short messaging service text messages associated with a user account;
hashing blocks of characters extracted from the short messaging service text messages according to a hash function to generate hash values;
generating an entropy associated with a Bloom filter output array from the hash values generated from the blocks of characters extracted from the short messaging service text messages;
determining non-zero positions in the entropy associated with the Bloom filter output array generated from the hash values;
assigning the non-zero positions in the entropy associated with the Bloom filter output array to a signature representing the short messaging service text messages; and
identifying the short messaging service text messages as the spam in response to the entropy.