Similar email spam detection
Disclosed herein is a system and method for identifying a spam email message. To identify a spam message a similarity measurement hash and a sender hash is generated for each email message. Two or more previously received email messages are compared with an incoming email message. The incoming email message is identified as a spam message when the similarity measurement hash between incoming message and one of the received messages matches and the corresponding sender hash does not match. The system may integrate with other email servers through a DNS to identify spam emails across different organizations and locations. The system and method may further apply rules to particular match to whitelist a potential spam email.
1. A method for determining if an email is a spam email, the method comprising:
receiving a first email at a first mail server;
creating a first sender hash of the first email;
creating one or more similarity measurement hashes of the first email including a first similarity measurement hash, wherein the first similarity measurement hash further comprises:
gathering one or more properties of the first email;
combining one or more of the properties of the first email into the first similarity measurement hash of the first email;
wherein the one or more properties are selected from the group consisting of header entries, email structure, normalized plain text, normalized uniform resource locators, and attachments; and
wherein the first sender hash and first similarity measurement hash are a combined hash of a 32-character fixed length hash;
querying a centralized storage system for one or more similarity measurement hashes of one or more emails, wherein the centralized storage is a domain name system;
connecting one or more mail servers to the domain name system;
querying the domain name system from a first mail server of the one or mail servers to retrieve a second sender hash and a second similarity measurement hash that was developed in a second mail server of the one or more mail servers
comparing the first similarity measurement hash and the first sender hash of the first email to the second similarity hash and the second sender hash of a second email stored within the centralized storage system;
determining, in response to comparing, that the first similarity measurement hash of the first email matches the second similarity measurement hash of the second email;
determining, in response to comparing, that the first sender hash of the first email is different from the second sender hash of the second email;
marking, in response to determining that the first similarity measurement hash matches the second similarity measurement hash and the first sender hash is different from the second sender hash, the first email as a spam email;
determining that the second email has been received by the mail server; and
marking the second email as a spam email, in response to marking the first email as spam email.