Method for reclassifying a spam-filtered email message

A method, implemented on server having one or more processors and memory storing programs to be executed by the one or more processors, for accessing message data for spam classification reevaluation based on new evidence including:

• receiving new evidence related to email data used for spam classification of email messages having an original classification or classifications;
• wherein receiving new evidence includes receiving one or a combination of new keywords and new return-path features extracted from email message bodies;
• wherein the new evidence is received after the original classification or classifications of the email messages and the original classification or classifications is one of a spam classification and a trusted classification;
• searching a data source of email data using the new evidence as search criteria;
• obtaining a data match of new evidence to email data stored in the data source;
• accessing a list of one or more message identifiers and one or more associated recipient identifiers from the data source, the list associated with the data match;
• locating, in accordance with the list, one or more allocated memory portions identified by recipient and message identifier;
• wherein at least a subset of the located memory portions correspond to first email messages having original classifications selected from the set consisting of the spam classification and the trusted classification;
• and
• retrieving data from those memory portions for use in reevaluating the original classification or classifications of the first email messages, wherein the original classification or classifications of the first email messages are re-evaluated based on the new evidence and one or more variables used to determine the original classification or classifications of the first email messages.

A non-transitory computer readable storage medium storing one or more programs, which when executed by one or more processors of a computer system, causes the computer system to perform a method comprising:

• receiving new evidence related to email data used for spam classification of email messages having an original classification or classifications;
• wherein the receiving new evidence includes receiving one or a combination of new keywords and new return-path features extracted from email message bodies;
• wherein the new evidence is received after the original classification or classifications of the email messages and the original classification or classifications is one of a spam classification and a trusted classification;
• searching a data source of email data using the new evidence as search criteria;
• obtaining a data match of new evidence to email data stored in the data source;
• accessing a list of one or more message identifiers and one or more associated recipient identifiers from the data source, the list associated with the data match;
• locating, in accordance with the list, one or more allocated memory portions identified by recipient and message identifier;
• wherein at least a subset of the located memory portions correspond to first email messages having original classifications selected from the set consisting of the spam classification and the trusted classification;
• and
• retrieving data from those memory portions for use in reevaluating the original classification or classifications of the first email messages, wherein the original classification or classifications of the first email messages are re-evaluated based on the new evidence and one or more variables used to determine the original classification or classifications of the first email messages.

A system comprising:

• a server computer, the server computer including:
• a message store to store incoming email messages;
• a storage means having instructions for a spam filter to filter the incoming email messages and to classify the incoming email messages, based at least on internal evidence, wherein an original classification for a first subset of email messages is one of a spam classification and a trusted classification;
• and
• a cluster cache to store filter result data resulting from the filtering;
• wherein upon receiving new evidence related to an email message stored in the message store, wherein the new evidence includes one or a combination of new keywords and new return-path features extracted from email message bodies, the new evidence being received after classifying the incoming email messages stored in the message store, the spam filter re-evaluates a respective email message from the first subset of email messages, wherein the re-evaluation includes one of validating and changing the original classification associated with the respective email message from the first subset of email messages, and updates the cluster cache storing the filter result data, and wherein the respective email message is re-evaluated based on the new evidence and one or more variables used to determine the original classification associated with the respective email message.

A method, implemented on server having one or more processors and memory storing programs to be executed by the one or more processors, for classifying email in a spam-filtering system, comprising:

• accessing email message data, the email message data having an associated original classification that is one of a spam classification and a trusted classification with respect to a first email message;
• accessing new evidence for use in classification, wherein the new evidence includes one or a combination of new keywords and new return-path features extracted from email message bodies and wherein the new evidence is received after the original classification of the email message data;
• and
• re-evaluating the original classification of the first email message using the new evidence, wherein the re-evaluation includes one of:
• validating the original classification and changing the original classification of the first email message, and wherein the original classification of the first email message is re-evaluated based on the new evidence and one or more variables used to determine the original classification of the first email message.

A non-transitory computer readable storage medium storing one or more programs, which when executed by one or more processors of a computer system, causes the computer system to perform a method including:

• storing email message data and associated original classification data in a data cache, wherein the original classification data is one of a spam classification and a trusted classification with respect to a first email message;
• receiving external evidence after the original classification of the stored email message data, wherein the receiving external evidence includes receiving one or a combination of new keywords and new return-path features extracted from email message bodies;
• and
• responsive to receiving external evidence, launching a reevaluation of the first email message stored in the data cache based on the external evidence, wherein the reevaluation includes one of validating and changing the associated original classification of the first email message, and wherein the first email message is re-evaluated based on the external evidence and one or more variables used to determine the associated original classification of the first email message.