Detection of spam messages
AssigneeAT&T Intellectual Property I, L.P.
InventorsPaul Giura, Baris Coskun
Life of this patent
Estimating the term…
Abstract
A method of generating a signature for a group of electronic messages that each include a plurality of characters comprises extracting a plurality of blocks of characters from each of the electronic messages, mathematically processing each of the blocks of characters from each electronic message, and generating a signature for the group of electronic messages based at least in part on the mathematically processed blocks of characters. In some embodiments a counting Bloom filter may be used to generate the signature. The signatures generated by these methods may be used to identify spam.
Claims20
A system for identifying a spam message, comprising:
- a hardware processor;
- and
- a memory device storing instructions that, when executed by the hardware processor, perform operations, the operations comprising:
- receiving non-consecutive textual characters extracted from known spam messages;
- generating a first Bloom filter output array from hash values representing the non-consecutive textual characters extracted from the known spam messages by hashing digital representations of the non-consecutive textual characters according to a hash function, wherein the generating comprises generating the first Bloom filter output array using only non-consecutive textual characters common to all spam messages of the known spam messages;
- comparing a second Bloom filter output array according to a hash value representing a text message to the first Bloom filter output array according to the hash values representing the non-consecutive textual characters extracted from the known spam messages to obtain a comparison;
- in response to the comparison indicating a match between the first and second Bloom filter output arrays, identifying the text message as the spam message;
- and
- identifying a sender's address or a user account associated with the text message identified as the spam message.
A system for identifying a user account as a source of spam messages, comprising:
- a hardware processor;
- and
- a memory device storing instructions that, when executed by the hardware processor, perform operations, the operations comprising:
- receiving non-consecutive textual characters extracted from known spam messages;
- generating a Bloom filter output array from hash values representing the non-consecutive textual characters extracted from the known spam messages by hashing digital representations of the non-consecutive textual characters according to a hash function, wherein the generating comprises generating the Bloom filter output array using only non-consecutive textual characters common to all spam messages of the known spam messages;
- determining an entropy of the Bloom filter output array;
- comparing the entropy of the Bloom filter output array with an entropy threshold;
- and
- identifying a user account as a source of spam in response to the entropy of the Bloom filter output array being less than the entropy threshold.
A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising:
- receiving a plurality of electronic messages;
- extracting non-consecutive textual characters from the electronic messages;
- hashing digital representations of the non-consecutive textual characters according to a hash function, producing hash values representing the non-consecutive textual characters;
- generating a Bloom filter output array from the hash values, wherein the generating comprises generating the Bloom filter output array using only non-consecutive textual characters common to all electronic messages of the electronic messages;
- determining an entropy of the Bloom filter output array;
- comparing the entropy of the Bloom filter output array with an entropy threshold;
- and
- identifying a user account as a source of spam in response to the entropy of the Bloom filter output array being less than the entropy threshold, the entropy of the Bloom filter output providing an indication of how similar messages sent from the user account are to each other.
Dependencies are inferred from the claim text.