Unsolicited bulk email detection using URL tree hashes

A method for detecting unsolicited bulk emails (UBE), the method comprising:

• receiving an email having a plurality of uniform resource locators (URLs);
• identifying a uniform resource locator (URL) within the plurality of URLs contained in the received email, wherein the identified URL is not included in a whitelist of valid URLs;
• dividing the identified URL into a plurality of component parts;
• generating a tree structure having a plurality of nodes based on the plurality of component parts;
• determining a plurality of node attributes associated with the plurality of nodes, wherein the determined plurality of node attributes includes a generic attribute that indicates a component type associated with each component within the plurality of components, and wherein the determined plurality of node attributes includes a counter value indicating a number of times a component part appeared in the plurality of URLs contained in the received email;
• assigning the determined plurality of node attributes to the plurality of nodes;
• generating an input string based on the generated tree structure, wherein the generated input string comprises a plurality of characters representing the assigned plurality of node attributes;
• calculating a hash value based on the generated input string;
• determining if the calculated hash value matches a UBE hash value within a plurality of UBE hash values;
• responsive to determining that the calculated hash value matches the UBE hash value, determining if a first counter indicating a number of emails containing the UBE hash value within the plurality of UBE hash values has exceeded a predetermined first threshold value;
• responsive to determining that the first counter has exceeded the predetermined first threshold value, determining if the calculated hash value matches a valid email hash value within a valid email hash database;
• responsive to determining that the calculated hash value matches the valid email hash value, determining if a second counter indicating a number of valid emails containing the calculated hash has exceeded a predetermined second threshold value;
• and
• responsive to determining that the second counter has not exceeded the predetermined second threshold value, identifying the received email as a UBE based on determining that the calculated hash value matches the UBE hash value.