TW201224789A - A method for sorting the spam mail - Google Patents

Abstract

The present invention discloses a method for sorting a spam mail. A mail can be determined if it is a spam mail in accordance with the amount of keywords presented in a plurality of mails of the database and the distance between the keywords. Unlike the prior art, the present invention first capture a plurality of keywords in accordance with the database, then calculate a correlation coefficient and obtain a plurality of eigen-terms in accordance with the database, then calculate a standard probability by Naive Bayes algorithms in accordance with the correlation coefficient; then obtain an amended probability by multiplying the correlation coefficient and standard probability and, at last, determine if the mail is a spam mail in accordance with the amended probability and a first threshold. By utilizing the present invention, the user can determine if the incoming mails are spam mails and should be filtered quickly and preciously with limited resources.

Description

201224789 VI. Description of the invention: [Technical field of invention] The root and the rfi identify the branch of the mail «, the number of occurrences of the system and a key word in the plurality of mails of the data set is determined by the error to determine whether the marked mail is Spam of spam [previous technology] The life of 2 netizens occurs, and the habit of living is therefore the biggest advantage of the network is that it is cheap, convenient, and fast. Therefore, the use of the Internet-based e-mail system (Ele;; tronic two tai) has long replaced the way in which miscellaneous writing and postal messages are transmitted. When the cattle were generally accepted and used by people, the flood of spam and the issue of Ξ it were also widely watched and discussed by _#. Most of the junk is a commercial advertisement, but there are also many spam messages that are spread by other computers. The former only causes the increase of network traffic and the user is not harmless, but then it may cause the mail server to smash or roll the machine, and even give the hacker more opportunities to invade the host. 'Tian Xiaguan's automatic e-mail over the system, the system mainly uses word industry ratio, law, N-gram word phrasing, eigenvalue selection method, word frequency, word frequency-reverse = i (= IDF) 'card _ (Chi_S- and Markov feature extraction method: analysis by different methods, statistics to identify whether the email is spam. Circumventing the above various methods, the spammers instead hide the advertisement in the picture_, use shortened The URL replaces the real website URL ϋ the content of the email' or the corresponding paragraphs in the actual context of the text is randomly inserted into a certain number of non-meaningful texts and other means to respond accordingly. 4 201224789 The above description, how to quickly in a limited resource And accurate spam and filtering thereof, which is the invention to be solved by the present invention. In view of the above, the present invention is to provide a method for distinguishing spam based on the frequency of the present. (4) The method of providing the piece's one-off-standard_piece-shirt; the method of distinguishing ^= includes the following steps: (S1) according to a data set = Ming: Zhongyu complex keywords; (S2) according to The keyword ^ the i material ΐ: The postal method calculates a standard probability; (9) the correlation: obtains a correction probability; (10) according to the correction machine , value, to determine whether the subject mail is spam. The step of making a fortune method 2) can be: (S21) statistics of the plurality of keywords in the U step of the two pieces == 3⁄4 number of correlation coefficients according to the plurality of related Z to the post = the complex is less than a second door The stick value, if the number of people in the second matrix = the number of the relationship, whether the threshold value, the second threshold value is set to zero, if the U = less than the second correlation coefficient is not small _ two _, the financial difference

S 201224789 The key word, set to - to form the complex correlation coefficient of the first Si matrix, "calculate the correlation step contains ί ΐ , , , , , , , , , , , , , , , , , , ) can enter a distance of 4 and the maximum distance between the two, the maximum

, the levy words, whether the mutual distance is less than the maximum interval, if y, the mutual distance between the maximum intervals, to obtain - the distance weight coefficient to ^ the correction probability without the distance health factor to update the odd probability. (In addition, in the actual application, the step (S8) further includes: : 5 == whether the rate is greater than the first threshold value. If yes, the target mail is not spam, and if not, the target mail is spam. According to the prior art, the present invention discloses a method for distinguishing spam, which is based on the number of occurrences of keywords in a plurality of emails of a data set, and ^ key words, the distance between keywords Determine whether the underlying email is spam' to improve the system's ability to discriminate against spam.

[Embodiment] The present invention will be more readily understood by the following detailed description of the invention and the examples thereof. The description is only for the essential elements of the present invention, and the description is only for explaining one of the possible embodiments of the present invention, and the description of the specification should not limit the scope of the technical nature of the claimed invention. The present invention is not limited to the specific methods, procedures, functions, or means unless the invention is specifically excluded. It should also be understood that the presently described embodiments are merely possible embodiments of the present invention. In this 201224789=test, the materials described in this specification may be used similarly or equivalent to 10,000 processes, processes, functions or means. All technical and scientific methods and material clocks in the specification, which can be used in the description of the specification, are only for the implementation of the methods and means, but the current values of the present specification and the numerical values above or below are Included in this should be understood, ϋΐ 魏 魏 魏 魏 魏 之 之 魏 之 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏 魏A flow chart showing a method for distinguishing spam according to the present invention. As shown in Figure 1-2, the method of =^^, which is used to judge the postal mail (4) f, contains the following steps: (si) according to the data set to retrieve the standard (s? special beta different take a related Sex weight coefficient and plural characteristics are not (S3) «The correlation weight coefficient is (4) f: Calculate a standard probability (10) The correlation weight coefficient "The sputum gets 正 positive probability; (S8) according to the correction probability and one The first threshold value is used to determine whether the mail of the S Hai mark is spam. The subject mail described in the step (S1) of the method of the present invention can be of the same kind of article 'and the article has a plurality of caps or no fine sentences: 201224789 t言 'Because of the source of text content and the method of input, text = square t :: contains some noise and the noise mainly comes from the title, page number, row code, font size, font color, etc. In order to prevent unnecessary interpretation errors, the influence of the ''month' and 'amplitude' first use the program or other methods, ^ ==== standard r to let the place be done]: The article will be fresh Into the lake =, in the case of Chi Na, the key of the target t 之 in the standard A number of smoke analysis methods (also known as the fineness analysis method), which contain the method, which is touch-sensitive, analyzes the string of the Guxiang string and the predetermined length of the string, in order to combine the above texts. Predict the λ degree of the string. Consider the Chinese word with two characters, Gan II α /, ° ° forbearance, more than one word or more words, in fact, the local unit 'the length of the string is greater than the scale In the case of 2^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'In the subject of the subject, and the continuation of the description of the 3 "two side: into __ take the string. There are many friends in the moon.", because the length of the character is two, 201224789, so the last sentence can be Disassemble into the following friends and friends. If you have a small child, a small, a clear, a lot, a statistical analysis, and select a string, then use the knowledge of the data set. The collection of the cost of the application of the choice '= 容 = postal:,: the _ class of the device over; t, for the English _ = inside: the day into the domain to change the sigh mail Write the letter 〇", "number;" and the package f "^字0" and "big foreign, in the main content article before entering other languages is a common technique, but also set the meaningless text through the mail classifier遽, 窜 的 的 的 的 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾 垃圾After the tampering of the spam caused by the tampering of the classifier, the present invention proceeds to ', (S2). According to the _(d) in the mail of the data set, after the plural keywords in the mail are effectively avoided. - obtaining a correlation weight coefficient and a plurality of feature words, and the step: substep (10)) counting the plurality of keywords in the target dice step (S22) according to the plurality of keywords appearing in the target post ί Ϊ 侧 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _f collection of other mail The frequency ^ clever, array. Referring to Figure 2, Figure 2 depicts a schematic diagram of a matrix according to the present invention. As depicted in Figure 2, the first, second, and ith keywords of the 4th to the vv?, the first, second, and ith keywords, 忒(2) = one 'Xm,i represents the mth message. i key = substep (S23), substep yang) is based on the first moment beam ===== coefficient - the above s

the amount. The Nd of the towel represents the calculation method of the number of the (4) e-mails. For the calculation of the correlation coefficient, refer to the conventional technique. If the formula is calculated, then the sub-second L car is calculated. , i = s-24) i root ί the plurality of correlation coefficients to form a second moment car array: two matrix value of the touch of the moment t first ί, a second _, then the value, then "k change, phase Mrt The complex correlation coefficient is not less than - the second threshold - the keyword corresponding to the feature word i number is set as the first matrix. μ refers to FIG. 4, and FIG. 4 depicts a schematic diagram of the second matrix according to the specific example of this 201224789. The nth material value described above can be freely set according to the user's need for the mail filtering level. After the third matrix is completed, the sub-step (S26) + 3 the plurality of correlation coefficients of the third matrix are performed to calculate the phase-to-life two, and before the plurality of correlation coefficients are all replaced by ^ Coefficient j

Among the coefficients, according to the correlation weight coefficient, two related N characteristic words are arranged. Then, according to the selected N, the number of correlation weights is obtained. (4) The following formulas of the H generation

Pc=nf_ + Rffia) Once pc in the above formula is the correlation weight coefficient, : ' and Rrrm is the nth keyword in gm messages; off, then the smoke (10) weight coefficient and the complex scale sign word. ',, number H t financial method riding surface (s3) method t standard probability. In order to count the entire capital "concentrated 屮V::S for the above multiple characteristic words, the subject mail is attributed to the junk postmark; the quasi-opportunity rate means that there is a score in the junk mail. This multi-plus il ve Bayes algorithm is a well-known skill, so it is not a word, according to the invention - the characteristic rate of the specific embodiment (PW is about the next. For example, its standard machine ρ _0.4^0.2 ^0.6 ▲ spam------------=A 1 0.4*0,2»*0.6+〇.6»〇19*〇,4''υ*^ ', take %·' Machine H' then proceeds to step (S4) to multiply the correlation 201224789 by the standard probability to obtain - correction machine "", PSpan / = Pspam * pc to obtain the above-mentioned correction probability, then step according to The plurality of special occurrences in the subject mail is '4(S5) is the maximum spacing, the maximum spacing is the two; the maximum spacing between the two; and the proceeding proceeds to step f ~ a plurality of characteristic word characteristic words Whether the mutual distance between them is less than 兮 most, do not judge the plurality of mutually smaller than the maximum interval: set ====, distance weight coefficient: fly 乂 ° ten nose and take one

Pd = ΠΓ Πι(1 + 2 Gu-lDm-DT'丨Dmax The weight of the line is the most rectified and the distance is expressed in the distance δ month. See Figure 6. Figure 6 is based on the word >, words, The occurrence of the data in the data set = into the above formula, the data set in Figure 6

Pd= 1 The distance weight is described as the weight, and Jing S7), the probability of the step, the calculation formula is as shown in the figure, the axis is heavy, and the new correction is given.

Pspam'-Pspam* Pc* Pd quasi-upper phase = weight and probability, revision = after the correction of the probability, then proceed to step (4) to determine that the correction is greater than a first threshold, and if so, the target email Not for spam

1P 201224789 pieces of 'right=' job mail are city mail. The above is freely set according to the needs of the user_pieces. The value of the value can be μ, not necessary for the above steps (S5), (S6) and (S7), including the estimation of the accuracy of the mail, the user can also directly in the step = step (S8) According to the judgment of whether the subject of the mail is spam) & 4 Please refer to Figure 7A and Figure 7B for details. Figure 7A will be the method of identifying spam, and other Chinese-speaking companies will be compared with the other tables. Figure 7B _ The invention is a kind of distinguishing the paper. The title is, the paper of the base table, fo/Anti l^A StUdy 〇'Wtier FiItCri^ Sch-es rate one, the aspect of the table It mail = the body of the body ^ shape of the gods and the lack of a clear description of the hair system. On the contrary, the purpose of the invention is to intend to cover the scope of the invention, and to cover the various changes and the equivalent of the most comprehensive solution. 2 broadly rotated so that it covers all possible changes and equivalences 13 201224789 [Schematic Description] FIG. 1 is a flow chart of a method for distinguishing spam according to an embodiment of the present invention. A schematic diagram of a first matrix in accordance with an embodiment of the present invention is depicted. Figure 3 depicts a schematic diagram of a second matrix in accordance with an embodiment of the present invention.

Figure 4 depicts a schematic diagram of a third matrix in accordance with an embodiment of the present invention. Figure 5 is a diagram showing the frequency of occurrence of feature words in a data set in accordance with an embodiment of the present invention. Figure 6 is a diagram showing the appearance of feature words in a data set in accordance with an embodiment of the present invention. ",, I know the method of narration and other methods, and the other is a comparison table of the effect of the invention of spam. [Main component symbol description] S1 S4, S8: Process step 14

Claims (1)

201224789 Seven patent application scope: The garbage is used to judge whether the -standard mail is the calculation-relevance weight coefficient and the number of plural m's to calculate the H-weight coefficient -^ algorithm, to calculate H. ^:Qingmuer _ 目 细 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Appears in H, which is now in the dataset (Τι* ̄ ̄ ̄ ̄ ̄ ̄ ̄ ̄ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ Second, the second 槛: the number of correlation coefficients in the number = is not less than the crypto-J array; r "keys set 15 201224789 matrix of the weaving side wire to calculate the phase 3, such as Shen The method described in the first item of the patent range may further comprise the following steps: wherein the sth step (S4) and the step (S8) t the number of the towel (4) is the positional distance from the plurality of features; I: Da Gina Each of the espresso's mails should be ruined by the plural scales. Whether the mutual distance is smaller than the maximum interval, and if so, the distance weight coefficient is taken according to the mutual distances smaller than the maximum interval; and the machine=7.) multiplying the correction probability by the distance weight coefficient to The method of claim 1, wherein the step (S8) further includes the following substeps: (S81) determining whether the correction probability is greater than the first threshold, and if so, The target email is not spam, if not, the email is spam" 16