System and method for generating heuristic rules for identifying spam emails based on fields in headers of emails

A system for generating heuristic rules for identifying spam emails based on fields in headers of emails, comprising:

• at least one processor configured to:
• collect statistical data on contents of a plurality of emails;
• analyze the collected statistical data to identify different types of content of said emails, including one or more of headers or hyperlinks in said emails;
• group the plurality of emails into one or more clusters based on the different types of content identified in said emails, wherein at least one cluster includes one or more groups based on fields in headers of said emails;
• select at least one most frequent combination of groups of data in each cluster;
• generate a hash from the at least one most frequent combination of groups;
• formulate at least one regular expression based on an analysis of hyperlinks of the emails corresponding to the generated hashes;
• and
• generate at least one heuristic rule for identifying spam emails by combining at least one hash and the corresponding regular expression, wherein the at least one hash is generated based on fields in the headers of said emails.

A non-transitory computer readable medium storing thereon computer executable instructions for generating heuristic rules for identifying spam emails based on fields in headers of emails, including instructions for:

• collecting, by a processor, statistical data on contents of a plurality of emails;
• analyzing, by the processor, the collected statistical data to identify different types of content of said emails, including one or more of headers or hyperlinks in said emails;
• grouping, by a processor, the plurality of emails into one or more clusters based on the different types of content identified in said emails, wherein at least one cluster includes one or more groups based on fields in headers of said emails;
• selecting, by the processor, at least one most frequent combination of groups of data in each cluster;
• generating, by the processor, a hash from the at least one most frequent combination of groups;
• formulating, by the processor, at least one regular expression based on an analysis of hyperlinks of the emails corresponding to the generated hashes;
• and
• generating, by the processor, at least one heuristic rule for identifying spam emails by combining at least one hash and the corresponding regular expression, wherein the at least one hash is generated based on fields in the headers of said emails.