公开(公告)号：US20090231998A1

公开(公告)日：2009-09-17

申请号：US12050162

申请日：2008-03-17

申请人： Manjunath Bharadwaj ,  Nathan Howell ,  Wei Jiang

发明人： Manjunath Bharadwaj ,  Nathan Howell ,  Wei Jiang

IPC分类号： G08C15/00

CPC分类号： H04L41/0803 ,  H04L63/0227

摘要： Several approaches to selectively filtering network traffic are described. One approach involves a system for selectively filtering network traffic. The system includes a helper application, which is coupled to a networking program, and is used to identify a user-initiated request. A network filter driver is coupled to the networking program, for intercepting the user-initiated request. A filtering service is coupled to both the helper application and the network filter driver, and is used to determine if the user-initiated request is allowable. If the request is allowable, the filtering service is configured to generate a special identifier, which the helper application is configured to include in a subsequent request. The filtering service is configured to allow a subsequent request which includes the special identifier, and the network filter driver's configured to strip a special identifier from subsequent requests.

摘要翻译： 描述了选择性地过滤网络流量的几种方法。 一种方法涉及用于选择性地过滤网络流量的系统。 该系统包括一个辅助应用程序，该应用程序耦合到一个联网程序，用于识别用户发起的请求。 网络过滤器驱动器耦合到网络程序，用于拦截用户发起的请求。 过滤服务耦合到辅助应用程序和网络过滤器驱动程序，并且用于确定用户发起的请求是否被允许。 如果请求是可允许的，则过滤服务被配置为生成特殊标识符，辅助应用被配置为包括在随后的请求中。 过滤服务被配置为允许包括特殊标识符的后续请求和被配置为从后续请求中剥离特殊标识符的网络过滤器驱动程序。

公开(公告)号：US20070208856A1

公开(公告)日：2007-09-06

申请号：US11743466

申请日：2007-05-02

申请人： Robert Rounthwaite ,  Joshua Goodman ,  David Heckerman ,  John Mehr ,  Nathan Howell ,  Micah Rupersburg ,  Dean Slawson

发明人： Robert Rounthwaite ,  Joshua Goodman ,  David Heckerman ,  John Mehr ,  Nathan Howell ,  Micah Rupersburg ,  Dean Slawson

IPC分类号： G06F15/173

CPC分类号： H04L51/12 ,  G06Q10/107

摘要： The subject invention provides for a feedback loop system and method that facilitate classifying items in connection with spam prevention in server and/or client-based architectures. The invention makes uses of a machine-learning approach as applied to spam filters, and in particular, randomly samples incoming email messages so that examples of both legitimate and junk/spam mail are obtained to generate sets of training data. Users which are identified as spam-fighters are asked to vote on whether a selection of their incoming email messages is individually either legitimate mail or junk mail. A database stores the properties for each mail and voting transaction such as user information, message properties and content summary, and polling results for each message to generate training data for machine learning systems. The machine learning systems facilitate creating improved spam filter(s) that are trained to recognize both legitimate mail and spam mail and to distinguish between them.

摘要翻译： 本发明提供了一种反馈循环系统和方法，其有助于在服务器和/或基于客户端的体系结构中与垃圾邮件防止相关联的项目进行分类。 本发明将机器学习方法应用于垃圾邮件过滤器，特别是随机抽取传入的电子邮件消息，以便获得合法和垃圾/垃圾邮件的示例以生成训练数据集。 被要求被识别为垃圾邮件战士的用户被要求投票选择他们的收到的电子邮件的选择是单独的合法邮件还是垃圾邮件。 数据库存储每个邮件和投票交易的属性，例如用户信息，消息属性和内容摘要，以及每个消息的轮询结果，以生成机器学习系统的训练数据。 机器学习系统便于创建改进的垃圾邮件过滤器，该过滤器被训练以识别合法邮件和垃圾邮件并区分它们。

公开(公告)号：US20070011324A1

公开(公告)日：2007-01-11

申请号：US11174843

申请日：2005-07-05

申请人： John Mehr ,  Nathan Howell

发明人： John Mehr ,  Nathan Howell

IPC分类号： G06F15/173

CPC分类号： H04L51/12 ,  G06Q10/107

摘要： Message header spam filtering is described. In an embodiment, a message is received that includes header entries arranged in an ordered sequence which indicates a path by which the message was communicated. The header entries are parsed to categorize each header entry as a header type where the header types are listed in the ordered sequence. A quantity of each different header type is determined, and a determination is made as to whether the message is likely a spam message based at least in part on the quantity corresponding to a particular header type. In another embodiment, a numeric representation of the ordered sequence is created where the numeric representation includes unique integers assigned to each different header type. A determination is made as to whether the message is likely a spam message based at least in part on the numeric representation of the ordered sequence of header types.

摘要翻译： 描述消息头垃圾邮件过滤。 在一个实施例中，接收到包括以有序序列排列的报头条目的消息，其指示消息被传送的路径。 解析标题条目以将每个标题条目分类为标题类型，其中标题类型在有序序列中列出。 确定每个不同报头类型的数量，并且至少部分地基于对应于特定报头类型的数量来确定该消息是否可能是垃圾邮件消息。 在另一个实施例中，创建有序序列的数字表示，其中数字表示包括分配给每个不同头类型的唯一整数。 至少部分地基于标题类型的有序序列的数字表示来确定消息是否可能是垃圾邮件消息。

公开(公告)号：US20050193073A1

公开(公告)日：2005-09-01

申请号：US10790574

申请日：2004-03-01

申请人： John Mehr ,  Nathan Howell ,  Micah Rupersburg

发明人： John Mehr ,  Nathan Howell ,  Micah Rupersburg

IPC分类号： G06F15/16 ,  G06F15/173 ,  H04L12/58

CPC分类号： H04L51/12

摘要： The present invention involves a system and method that facilitate extracting data from messages for spam filtering. The extracted data can be in the form of features, which can be employed in connection with machine learning systems to build improved filters. Data associated with the subject line, timestamps, and the message body can be extracted and employed to generate one or more features. In particular, subject lines and message bodies can be examined for consecutive, repeating characters, blobs, the association or distance between such characters, blobs and non-blob portions of the message. The values or counts obtained can be broken down into one or more ranges corresponding to a degree of spaminess. Presence and type of attachments to messages, percentage of non-white-space and non-numeric characters of a message, and determining message delivery times can be used to identify spam. A time-based delta can be computed to facilitate determining the delivery time.

摘要翻译： 本发明涉及一种便于从垃圾邮件过滤的消息中提取数据的系统和方法。 提取的数据可以是特征的形式，其可以与机器学习系统结合使用以构建改进的过滤器。 可以提取和使用与主题行，时间戳和消息体相关联的数据来生成一个或多个特征。 特别地，可以检查主题行和消息体，以连续，重复的字符，blob，消息的这些字符，blob和非blob部分之间的关​​联或距离。 获得的值或计数可以分解成对应于垃圾邮件的程度的一个或多个范围。 消息的附件的存在和类型，消息的非白色空格和非数字字符的百分比以及确定消息传递时间可用于识别垃圾邮件。 可以计算基于时间的增量，以便于确定交付时间。

公开(公告)号：US20050022008A1

公开(公告)日：2005-01-27

申请号：US10454168

申请日：2003-06-04

申请人： Joshua Goodman ,  Robert Rounthwaite ,  Daniel Gwozdz ,  John Mehr ,  Nathan Howell ,  Micah Rupersburg ,  Bryan Starbuck

发明人： Joshua Goodman ,  Robert Rounthwaite ,  Daniel Gwozdz ,  John Mehr ,  Nathan Howell ,  Micah Rupersburg ,  Bryan Starbuck

IPC分类号： G06F13/00 ,  G06F12/00 ,  G06F17/00 ,  G06Q10/10 ,  G06Q99/00 ,  H04L12/58 ,  H04L29/06 ,  H04L9/00

CPC分类号： H04L51/12 ,  G06Q10/107

摘要： The present invention involves a system and method that facilitate extracting data from messages for spam filtering. The extracted data can be in the form of features, which can be employed in connection with machine learning systems to build improved filters. Data associated with origination information as well as other information embedded in the body of the message that allows a recipient of the message to contact and/or respond to the sender of the message call be extracted as features. The features, or a subset thereof, can be normalized and/or deobfuscated prior to being employed as features of the machine learning systems. The (deobfuscated) features can be employed to populate a plurality of feature lists that facilitate spam detection and prevention. Exemplary features include an email address, an IP address, a URL, an embedded image pointing to a URL, and/or portions thereof.

摘要翻译： 本发明涉及一种便于从垃圾邮件过滤的消息中提取数据的系统和方法。 提取的数据可以是特征的形式，其可以与机器学习系统结合使用以构建改进的过滤器。 与源信息相关联的数据以及允许消息的接收者联系和/或响应消息呼叫的发送者的消息正文中嵌入的其他信息被提取为特征。 特征或其子集可以在被用作机器学习系统的特征之前被归一化和/或去混淆。 可以使用（去模糊化）功能来填充便于垃圾邮件检测和预防的多个特征列表。 示例性特征包括电子邮件地址，IP地址，URL，指向URL的嵌入图像和/或其部分。

公开(公告)号：US20070118904A1

公开(公告)日：2007-05-24

申请号：US11621363

申请日：2007-01-09

申请人： Joshua Goodman ,  Robert Rounthwaite ,  Daniel Gwozdz ,  John Mehr ,  Nathan Howell ,  Micah Rupersburg ,  Bryan Starbuck

发明人： Joshua Goodman ,  Robert Rounthwaite ,  Daniel Gwozdz ,  John Mehr ,  Nathan Howell ,  Micah Rupersburg ,  Bryan Starbuck

IPC分类号： G06F12/14

CPC分类号： H04L51/12 ,  G06Q10/107

摘要： The present invention involves a system and method that facilitate extracting data from messages for spam filtering. The extracted data can be in the form of features, which can be employed in connection with machine learning systems to build improved filters. Data associated with origination information as well as other information embedded in the body of the message that allows a recipient of the message to contact and/or respond to the sender of the message can be extracted as features. The features, or a subset thereof, can be normalized and/or deobfuscated prior to being employed as features of the machine learning systems. The (deobfuscated) features can be employed to populate a plurality of feature lists that facilitate spam detection and prevention. Exemplary features include an email address, an IP address, a URL, an embedded image pointing to a URL, and/or portions thereof.

摘要翻译： 本发明涉及一种便于从垃圾邮件过滤的消息中提取数据的系统和方法。 提取的数据可以是特征的形式，其可以与机器学习系统结合使用以构建改进的过滤器。 可以提取与发起信息相关联的数据以及嵌入在消息正文中的允许消息的接收者联系和/或响应消息的发送者的其他信息作为特征。 特征或其子集可以在被用作机器学习系统的特征之前被归一化和/或去混淆。 可以使用（去模糊化）功能来填充便于垃圾邮件检测和预防的多个特征列表。 示例性特征包括电子邮件地址，IP地址，URL，指向URL的嵌入图像和/或其部分。

公开(公告)号：US08208375B2

公开(公告)日：2012-06-26

申请号：US12050162

申请日：2008-03-17

申请人： Manjunath Bharadwaj ,  Nathan Howell ,  Wei Jiang

发明人： Manjunath Bharadwaj ,  Nathan Howell ,  Wei Jiang

IPC分类号： G06F11/00

CPC分类号： H04L41/0803 ,  H04L63/0227

摘要： Several approaches to selectively filtering network traffic are described. One approach involves a system for selectively filtering network traffic. The system includes a helper application, which is coupled to a networking program, and is used to identify a user-initiated request. A network filter driver is coupled to the networking program, for intercepting the user-initiated request. A filtering service is coupled to both the helper application and the network filter driver, and is used to determine if the user-initiated request is allowable. If the request is allowable, the filtering service is configured to generate a special identifier, which the helper application is configured to include in a subsequent request. The filtering service is configured to allow a subsequent request which includes the special identifier, and the network filter driver's configured to strip a special identifier from subsequent requests.

摘要翻译： 描述了选择性地过滤网络流量的几种方法。 一种方法涉及用于选择性地过滤网络流量的系统。 该系统包括一个辅助应用程序，该应用程序耦合到一个联网程序，用于识别用户发起的请求。 网络过滤器驱动器耦合到网络程序，用于拦截用户发起的请求。 过滤服务耦合到辅助应用程序和网络过滤器驱动程序，并且用于确定用户发起的请求是否被允许。 如果请求是可允许的，则过滤服务被配置为生成特殊标识符，辅助应用被配置为包括在随后的请求中。 过滤服务被配置为允许包括特殊标识符的后续请求和被配置为从后续请求中剥离特殊标识符的网络过滤器驱动程序。

公开(公告)号：US20070061402A1

公开(公告)日：2007-03-15

申请号：US11228032

申请日：2005-09-15

申请人： John Mehr ,  Nathan Howell

发明人： John Mehr ,  Nathan Howell

IPC分类号： G06F15/16

CPC分类号： H04L51/12 ,  H04L63/1408

摘要： Techniques that are employable to perform multipurpose internet mail extension (MIME) analysis are presented herein.

摘要翻译： 本文介绍了可用于执行多用途互联网邮件扩展（MIME）分析的技术。

公开(公告)号：US20060168024A1

公开(公告)日：2006-07-27

申请号：US11011462

申请日：2004-12-13

申请人： John Mehr ,  Nathan Howell ,  Paul Rehfuss

发明人： John Mehr ,  Nathan Howell ,  Paul Rehfuss

IPC分类号： G06F15/16

CPC分类号： H04L67/306 ,  H04L51/12 ,  H04L63/14 ,  H04L63/1491 ,  H04L67/025

摘要： Techniques are presented for assigning reputations to email senders. In one implementation, real-time statistics and heuristics are constructed, stored, analyzed, and used to formulate a sender reputation level for use in evaluating and controlling a given sender's connection to an message transfer agent or email recipient. A sender with an unfavorable reputation may be denied a connection before resources are spent receiving and processing email messages from the sender. A sender with a favorable reputation may be rewarded by having safeguards removed from the connection, which also saves system resources. The statistics and heuristics may include real-time analysis of traffic patterns and delivery characteristics used by an email sender, analysis of content, and historical or time-sliced views of all of the above.

公开(公告)号：US20060277259A1

公开(公告)日：2006-12-07

申请号：US11146502

申请日：2005-06-07

申请人： Elissa Murphy ,  John Mehr ,  Nathan Howell ,  Paul Rehfuss

发明人： Elissa Murphy ,  John Mehr ,  Nathan Howell ,  Paul Rehfuss

IPC分类号： G06F15/16

CPC分类号： H04L51/12

摘要： Distributed sender reputations are described. In an implementation, a method includes evaluating multiple characteristics of message delivery to establish a reputation for a sender of the message by a mail transfer agent and sharing data which describes the evaluation with another mail transfer agent.

摘要翻译： 描述了分布式发信人的声誉。 在实现中，一种方法包括评估消息传递的多个特征，以通过邮件传输代理为消息的发送者建立信誉，并且与另一邮件传送代理共享描述评估的数据。