Systems and methods for generating signatures for electronic communication classification

A computer-implemented method comprising:

• assigning messages of a spam message corpus to a plurality of spam message clusters, the plurality of spam message clusters including a first and a second spam message cluster, wherein assigning messages of the spam message corpus to the plurality of spam message clusters comprises computing a hyperspace representation of a message of the spam message corpus, and assigning the message to a selected cluster according to a hyperspace distance between the hyperspace representation and a center of the selected cluster;
• in response to assigning the messages to the plurality of spam message clusters, extracting a first set of cluster-specific spam identification text patterns from members of the first spam message cluster;
• and
• combining a first subset of the first set of cluster-specific spam identification text patterns into a first set of spam identification signatures for the first spam message cluster, wherein each spam identification signature of the first set of spam identification signatures includes a predetermined conjunction of at least two spam identification text patterns of the first subset of the first set of cluster-specific spam identification text patterns.

A computer-implemented spam-filtering method comprising:

• receiving a set of cluster-specific spam identification signatures, wherein the cluster-specific spam identification signatures are generated by:
• assigning messages of a spam message corpus to a plurality of spam message clusters including a first and second spam message cluster, wherein assigning messages of the spam message corpus to the plurality of spam message clusters comprises computing a hyperspace representation of a message of the spam message corpus, and assigning the message to a selected cluster according to a hyperspace distance between the hyperspace representation and a center of the selected cluster;
• in response to assigning the messages to the plurality of spam message clusters, extracting a set of cluster-specific spam identification text patterns from members of the first spam message cluster;
• and combining a subset of the set of cluster-specific spam identification text patterns into a set of cluster-specific spam identification signatures for the first spam message cluster, wherein each spam identification signature includes a predetermined conjunction of at least two spam identification text patterns;
• and deciding whether an incoming message is spam or non-spam according to the cluster-specific spam identification signatures.

A non-transitory computer-readable storage medium encoding instructions which, when executed on a computer system, cause the computer system to perform the steps of:

• assigning messages of a spam message corpus to a plurality of spam message clusters, the plurality of spam message clusters including a first and a second spam message cluster, wherein assigning messages of the spam message corpus to the plurality of spam message clusters comprises computing a hyperspace representation of a message of the spam message corpus, and assigning the message to a selected cluster according to a hyperspace distance between the hyperspace representation and a center of the selected cluster;
• in response to assigning the messages to the plurality of spam message clusters, extracting a set of cluster-specific spam identification text patterns from members of the first spam message cluster;
• and
• combining a subset of the set of cluster-specific spam identification text patterns into a set of spam identification signatures for the first spam message cluster, wherein each spam identification signature of the set of spam identification signatures includes a predetermined conjunction of at least two spam identification text patterns of the subset of the set of cluster-specific spam identification text patterns.

A non-transitory computer-readable storage medium encoding instructions which, when executed on a computer system, cause the computer system to perform the steps of:

• receiving a set of cluster-specific spam identification signatures, wherein the cluster-specific spam identification signatures are generated by:
• assigning messages of a spam message corpus to a plurality of spam message clusters including a first and second spam message cluster, wherein assigning messages of the spam message corpus to the plurality of spam message clusters comprises computing a hyperspace representation of a message of the spam message corpus, and assigning the message to a selected cluster according to a hyperspace distance between the hyperspace representation and a center of the selected cluster;
• in response to assigning the messages to the plurality of spam message clusters, extracting a set of cluster-specific spam identification text patterns from members of the first spam message cluster;
• and
• combining a subset of the set of cluster-specific spam identification text patterns into a set of cluster-specific spam identification signatures for the first spam message cluster, wherein each spam identification signature includes a predetermined conjunction of at least two spam identification text patterns;
• and deciding whether an incoming message is spam or non-spam according to the cluster-specific spam identification signatures.