# US 8,572,184 B1 · Systems and methods for dynamically integrating heterogeneous anti-spam filters

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,572,184 B1
- Document ID: US8572184B1
- Status: Granted
- Kind: B1
- Application number: 11/867,547
- Filed: 2007-10-04
- Granted: 2013-10-29
- Earliest claimed: 2007-10-04
- Assignees: Bitdefender IPR Management Ltd.
- Applicants: Catalin A. Cosoi
- Inventors: Catalin A. Cosoi
- Web page: https://patentgrep.com/patent/US8572184B1

## CPC

- H04L 51/212: using filtering or selective blocking
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In some embodiments, a spam filtering method includes computing the relevance of each of a plurality of anti-spam filters according to a relevance parameter set, and deciding whether an electronic message is spam or non-spam according to the relevancies and individual classification scores generated by the anti-spam filters. The relevance of an anti-spam filter indicates the degree to which a classification score produced by that particular filter determines the final classification of a given message. The relevance parameter set of each anti-spam filter may include, among others, a training maturity indicative of the degree of training of the filter, a filter update age indicative of the time elapsed since the latest update of the filter, a false-positive classification indicator, and a false-negative classification indicator of the anti-spam filter.

## Claims

### Claim 1

A spam filtering method comprising employing at least one processor to perform the steps of:
computing a relevance of a first anti-spam filter according to a relationship R=M−T×f(N,P), wherein M represents a training maturity of the first filter, T is an update age of the first filter indicative of a time period since a latest update of the first filter, wherein P is a false positive classification indicator of the first filter, N is a false negative classification indicator of the first filter, and wherein ƒ is a function of N and P;
computing a relevance of a second anti-spam filter according to a training maturity of the second filter, an update age of the second filter indicative of a time period since the latest update of the second filter, a false positive classification indicator of the second filter, and a false negative classification indicator of the second filter; and
determining whether an electronic communication is spam or non-spam according to a first result generated by applying the first anti-spam filter to the electronic communication, a second result generated by applying the second anti-spam filter to the electronic communication, the relevance of the first filter, and the relevance of the second filter.

### Claim 2 (depends on 1)

The method of claim 1, wherein computing the relevance of the first filter comprises setting the relevance of the first filter to a value substantially equal to
R
=
M
-
T
⁡
[
A
+
C
⁡
(
N
+
P
)
+
2
⁢
NP
C
2
+
C
⁡
(
N
+
P
)
+
NP
]
wherein A is an aging speed indicator of the first filter, and C is a filter confidence indicative of a spam-identification confidence level of the first filter.

### Claim 3 (depends on 1)

The method of claim 1, wherein computing the relevance of the first filter comprises setting the relevance of the first filter to a value substantially equal to
R
=
M
-
T
⁡
[
A
+
P
C
+
P
+
N
C
+
N
]
,
wherein A is an aging speed indicator of the first filter, and C is a filter confidence indicative of a spam-identification confidence level of the first filter.

### Claim 4 (depends on 1)

The method of claim 1, comprising computing the relevance of the first filter at a recipient client connected to an electronic communications server, the recipient client receiving the electronic communication from the electronic communications server, the recipient client including an electronic communication display application for displaying the electronic communication to a user.

### Claim 5 (depends on 1)

The method of claim 1, wherein determining whether the electronic communication is spam or non-spam comprises determining a combined classification score substantially equal to S=S1R1+S2R2, wherein S1 and S2 are the first and second classification scores, respectively, and wherein R1 and R2 are the relevance of the first filter and the relevance of the second filter, respectively.

### Claim 6 (depends on 1)

The method of claim 1, wherein the electronic communication is an email message.

### Claim 7

A non-transitory computer readable medium storing instructions, which, when executed by a computer system, cause the computer system to form:
a first anti-spam filter and a second anti-spam filter configured to input an electronic communication and to compute first and second spam classification scores, respectively, for the electronic communication;
a filter relevance calculator configured to compute a relevance of the first anti-spam filter and a relevance of the second anti-spam filter, wherein computing the relevance of the first filter comprises setting the relevance of the first filter to a value substantially equal to R=M−T×f(N,P), wherein M, T, N, P represent a training maturity of the first filter, an update age of the first filter indicative of a time period since a latest update of the first filter, a false negative classification indicator of the first filter, and a false positive classification indicator of the first filter, respectively, wherein ƒ represents a function of N and P, and wherein the second relevance is computed according to a training maturity of the second filter, an update age of the second filter indicative of a time period since a latest update of the second filter, a second false negative classification indicator of the second filter, and a second false positive classification indicator of the second filter; and
a decision module connected to the first and second anti-spam filters and to the filter relevance calculator, configured to determine whether an electronic communication is spam or non-spam according to the first and second spam classification scores, the relevance of the first filter, and the relevance of the second filter.

### Claim 8

A spam filtering method comprising employing at least one processor to perform the steps of:
computing a relevance of a first anti-spam filter according to a first relevance parameter set, the first relevance parameter set including a training maturity of the first filter, a false positive classification indicator of the first filter, and a false negative classification indicator of the first filter, and an update age of the first filter indicative of a time period since a latest update of the first filter;
computing a relevance of a second anti-spam filter according to a second relevance parameter set, the second relevance parameter set including an a training maturity of the second filter, a false positive classification indicator of the second filter, and a false negative classification indicator of the second filter, and an update age of the second filter, indicative of a time period since a latest update of the second filter; and
determining whether an electronic communication is spam or non-spam according to a first result generated by applying the first filter to the electronic communication, a second result generated by applying the second filter to the electronic communication, the relevance of the first filter, and the relevance of the second filter.

### Claim 9 (depends on 8)

The method of claim 8, wherein the first relevance parameter set comprises a filter confidence indicative of a spam-identification confidence level of the first filter.

### Claim 10 (depends on 8)

The method of claim 8, wherein computing the relevance of the first filter comprises setting the relevance of the first filter to a value substantially equal to
R
=
∑
i
=
1
p
⁢
w
i
⁢
x
i
,
wherein xi represent elements of the first relevance parameter set, wherein wi are weights, and wherein p is a positive integer.

### Claim 11 (depends on 10)

The method of claim 10, comprising determining wi using a neural network with supervised learning.

### Claim 12 (depends on 10)

The method of claim 10, wherein computing the relevance of the first filter comprises setting the relevance of the first filter to a value substantially equal to R=w1M+w2TA+w3TP+w4TN+w5TC, wherein M, T, P, N represent the training maturity of the first filter, the update age of the first filter, the false positive classification indicator of the first filter, and the false negative classification indicator of the first filter, wherein A is an aging speed indicator of the first filter, and wherein C is a filter confidence indicative of a spam-identification confidence level of the first filter.

### Claim 13 (depends on 8)

The method of claim 8, comprising computing the relevance of the first filter at a recipient client connected to an electronic communications server, the recipient client receiving the electronic communication from the electronic communications server, the recipient client including an electronic communication display application for displaying the electronic communication to a user.

### Claim 14 (depends on 8)

The method of claim 8, wherein determining whether the electronic communication is spam or non-spam comprises determining a combined classification score substantially equal to S=S1R1+S2R2, wherein S1 and S2 are the first and second classification scores, respectively, and wherein R1 and R2 are the relevance of the first filter and the relevance of the second filter, respectively.

### Claim 15 (depends on 8)

The method of claim 8, wherein the electronic communication is an email message.

### Claim 16

A non-transitory computer readable medium encoding instructions which, when executed by at least one processor, cause the at least one processor to perform the steps of:
computing a relevance of a first anti-spam filter according to a difference between i. a training maturity of the first filter and ii. a product of an update age of the first filter and a function of a false negative classification indicator and a false positive classification indicator of the first filter,
computing a relevance of a second anti-spam filter according to a training maturity of the second filter, an update age of the second filter indicative of a time period since a latest update of the second filter, a false negative classification indicator of the second filter, and a false positive classification indicator of the second filter; and
determining whether an electronic communication is spam or non-spam according to a first result generated by applying the first anti-spam filter to the electronic communication, a second result generated by applying the second anti-spam filter to the electronic communication, the relevance of the first filter, and the relevance of the second filter.