Hash-based systems and methods for detecting and preventing transmission of unwanted e-mail

A system for detecting transmission of potentially unwanted e-mails, comprising:

• means for observing a plurality of e-mails;
• means for hashing one or more portions of the plurality of e-mails to generate hash values, as generated hash values;
• means for determining whether the generated hash values match hash values associated with prior e-mails;
• and
• means for determining that the plurality of e-mails are potentially unwanted e-mails when one or more of the generated hash values match one or more of the hash values associated with the prior e-mails.

A mail server, comprising:

• one or more hash memories configured to store count values associated with a plurality of hash values;
• and
• a hash processor configured to:
• receive an e-mail message,
• hash one or more portions of the e-mail message to generate hash values, as generated hash values,
• increment the count values corresponding to the generated hash values, as incremented count values, and
• determine whether the e-mail message is a potentially unwanted e-mail message based on the incremented count values.

A method for detecting transmission of potentially unwanted e-mail messages, comprising:

• receiving an e-mail message;
• generating a plurality of hash values, as generated hash values, over blocks of the received e-mail message, the blocks including at least two of a main text portion, an attachment portion, and a header portion of the received e-mail message;
• determining whether the generated hash values match hash values associated with prior e-mail messages;
• and
• determining that the received e-mail message is a potentially unwanted e-mail message when one or more of the generated hash values associated with the received e-mail message match one or more of the hash values associated with the prior e-mail messages.

In a network of cooperating mail servers, one of the mail servers comprising:

• one or more hash memories configured to store information relating to hash values corresponding to previously-observed e-mails;
• and
• a hash processor configured to:
• receive at least some of the hash values from another one or more of the cooperating mail servers,
• store information relating to the at least some of the hash values in at least one of the one or more hash memories,
• receive an e-mail message,
• hash one or more portions of the received e-mail message to generate hash values, as generated hash values,
• determine whether the generated hash values match the hash values corresponding to previously-observed e-mails, and
• identify the received e-mail message as a potentially unwanted e-mail message when one or more of the generated hash values associated with the received e-mail message match one or more of the hash values corresponding to previously-observed e-mails.

A mail server, comprising:

• one or more hash memories configured to store count values associated with a plurality of hash values;
• and
• a hash processor configured to:
• receive e-mail messages,
• hash one or more portions of the received e-mail messages to generate hash values, as generated hash values,
• increment the count values corresponding to the generated hash values, as incremented count values, and
• generate suspicion scores for the received e-mail messages based on the incremented count values.

A method for preventing transmission of unwanted e-mail messages, comprising:

• receiving an e-mail message;
• generating a plurality of hash values, as generated hash values, over portions of the e-mail message as the e-mail message is being received;
• incrementally determining whether the generated hash values match hash values associated with prior e-mail messages;
• generating a suspicion score for the e-mail message based on the incremental determining;
• and
• rejecting the e-mail message when the suspicion score of the e-mail message is above a threshold.