TWI287720B - Junk mail filtering systems and methods based on abnormal features in e-mails - Google Patents

Abstract

A junk mail filtering method based on abnormal features in mails is provided. An e-mail is received. Multiple first abnormal feature strings are extracted from the e-mail by utilizing an abnormal feature extraction rule. Multiple groups associating with the first abnormal feature strings are located. It is determined whether the e-mail is a junk mail contingent upon the similar extent between the first abnormal feature strings and multiple second abnormal feature strings associated with each group.

Description

1287720 i, invention description (1) [Technical field to which the invention belongs] if outside:: A spam filtering technology, in particular, a kind of spam H system and method based on abnormality. [Prior Art] *瘅=着:ΓThe infrastructure is developed, and many convenient network services are derived. Relatively, many problems have also been created. Among them, the seller generates a large amount of spam (unsolicited Bulk Email or

ElDail) makes the user feel quite sleepy. Π Π ί ί ί 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般 一般In view of the troubles caused by spam, there are already many treatments, which can be divided into feeds and user-side mail filters. Tradition. Use TP W : ^ Consider '= for illegal vocabulary filtering. . Knowing the filter of IP filtering technology will first establish a large number of 1 {1 name=, according to the experience, the 1st address of the spam will be sent into the list, in the middle, there are some shortcomings. First, the advertiser usually Will use [====================================================================================================== Legitimate electricity will prevent email from being blocked. ‘Let the received

In order to avoid the above disadvantages, another use of non-, i μ A strains with illegal lexical filtering technology. Page 6 0213-A40531TW(N2); ACI93003TW; SNOWBALL.ptd

1287720 i, invention description (2) _____ filter, not for the IP address, but according to the mail. First, a large number of training emails will be created first. The emails will be classified as normal or spam. Each incoming email will be judged using a judgment method or rule, such as a new one (bayesian classifieatiQn). According to this new class ^ normal and the degree of similarity of junk e-mail to determine this electronic:: Bo: practice one of the spam. However, there are a lot of junk e-mails available at the moment. If you don’t add a lot of strange methods to the e-mail, you can avoid being classified as a rally to affect them. Therefore, you need to The anomaly feature is based on the garbage system and method to improve the correctness of mail filtering. SUMMARY OF THE INVENTION In view of the above, it is an object of the present invention to provide a basic spam filtering system and method, characterized in that the characteristics are based. According to the above-mentioned purpose, the embodiment of the present invention discloses a basic spam filtering method, which includes: receiving a Duchen feature as an abnormal feature extraction rule to retrieve an electronic mail, using the postal code I according to the first An abnormal feature string-a plurality of groups of abnormal feature strings; and determining a plurality of groups according to a plurality of second different values and a plurality of group degrees associated with the parent in the s^-th in the abnormal group Whether the mail is similar to the spam string in some cases, in the decision e-mail 'may include: get the per-group associated; step 0213-Α40531TW (Ν2); ACI93003TW; SNOWBALL.ptd page 7 P87720 Pingping, invention description (3) According to whether the phase between the first heterostrings exceeds the first characteristic feature word, when the first initial setting value is initially set, when the similarity value exceeds the first first initial amount, the cumulative number is represented. The cumulative quantity plus and when the tired processing program string is similar to each calculation; the decision is made that the initial setting value is not more than the second user can be connected to some collision processing party. In the case of using the initial setting to receive e-mail, the method is to find the value that determines the cumulative number over the second group; and when the electronic value is received, whether the associated quantity in the group exceeds the initial setting reception Performing a spam mail when the number of similarity messages of the second parameter of the normal association is one of the two processes of the normal association is the spam mail, and the number of the emails of the accumulated number of the associated numbers is over the second initial setting value; When the tired mail handler often has a feature value value that exceeds the piece. In order to obtain its phasor, its purpose, the value will be fixed, and the amount of spam count will be used to match the first exception table, the hash function, and the plurality of groups of feature strings. The storage medium stores a computer program for obscuring the use of the stored thunder brain system, and the anti-aliasing-based spam t invention embodiment discloses an abnormal feature. For the filtering system, including the communication device and the processing device, the receiving device receives the meta-following rules through the communication device to retrieve the plurality of abnormal features in the email according to the first-abnormal feature string. , looking for a string. The number is associated with the first anomaly feature 0213 - A40531TW( N2); ACI93003TW; SNOWBALL. p t d Page 8 1287720 i, invention description (4) Multiple groups of strings. Each of the breakout groups can determine whether the email is a feature between the feature strings based on the first-abnormal feature string and the multiple similarities; 4;:= =Basic spam has been associated with multiple previously received ones: Medium: The second exception that is owned by Qiao Group e-mails is n ^ and that each of the associated features is associated with Come to phase: I substring will be the second exception for other emails: J:::: The first abnormal feature string associated with a group associated with each group and each *value' is determined by ::::=:=; simiency; Ϊ If the similarly received e-mail is the default value of the initial value of the spam J when the initial value is 5, the cumulative number associated with the group with the similarity value is obtained. If the number exceeds the first value, it will be the same as the number of times. The program is executed such that when the user initially sets the value, and moreover, when the similarity value exceeds the predetermined value, normal mail processing is performed; The user can receive the e-mail, and the mail can include the name of the mailing device, the sender's e-mail, page 9, 0213-A4053mV (N2); ACI93003nV; SN〇WBALL.ptd 1287720 ping, invention description (5 ) 2 boxes, recipient email address, copy recipient email address, male, copy recipient email address, and mail article. The mail abnormal feature extraction rule may be at least one of the following rules: (1) extracting a string corresponding to the sender's email address as the first abnormal feature string, (2) correspondingly The string of the recipient/copy recipient/bcc copy recipient email address is treated as the first abnormal feature string; (3) the string corresponding to the sender server name is taken as the first An abnormal feature string; Λ (4) Capture the message in the text corresponding to the hyperlink, and report an abnormal feature string; the color of the field (word 5) string to take the piece / text with the background color Substring of the same foreground color, as the first abnormal feature string; (6) Shelving the mail in the article 〇 a. ^ ^ also r (can not find the string in the 'library, as the first Abnormal feature string; sub-a (7) retrieved mail in this article is not the Chinese first abnormal feature string; flying sub-string of the text, as (8) the fetched mail contained in this text corresponds to the text attribute The string of values, in the mark of the not-shaped beta (9), the mail in this article has a special one... abnormal feature string ; as the first abnormal feature string; and the string of the text effect, when (10) the mail in the text corresponds to the first abnormal feature string, the spam semantic string, each group can Associated with multiple previously received emails,

0213·A40531TW(N2); ACI93003TW; SNOWBALL.ptd Page 10 The second exception feature string will be similar to other strings. 1287720 ·

Abnormal features possessed by e-mails owned by each e-mail room [Embodiment] FIG. 1 is a diagram showing a hardware structure of a spam filtering system 10 based on anomalous features according to an embodiment of the present invention, including processing The unit ^, the storage device 13, the output device ”, the input device ΐ5, the communication device 16, and the bus bar 17 are used to connect them together. In addition, those skilled in the art can also implement the system on other computers. System configuration, for example, hand-heid devices, multiprocessor systems, microprocessor-based or programmable consumer electronics (micr〇pr〇cessc) r-based Programmabler programmable consumer electronics), network computers, minicomputers, mainframes, and the like. The processing unit n can include a single central processing unit (cpu) or a parallel computing environment (parallel pr〇) Multiple parallel processing units of cessing environment. Memory 12 contains read-only memory (R〇M), flash memory lash R〇M) and/or rm〇m access mem〇ry (RAM), 4 is used to store program modules and data that can be executed by the processing unit. Generally, the program module contains Routines, programs, objects, components, etc., are used to perform spam filtering functions based on email features. The present invention can also be implemented in a distributed computing environment. Executed by a remote processing device connected to the communication network. In a decentralized environment, the message anomaly is based on

1287720 ‘Different, invention description (7) spam; consider the function of system 1 – computer system is completed together. Storage = 13 scoops = local and multi-port remote, optical disc or flash drive, dribble device, floppy disk loaded with three-disc stored program modules and / or hard disk floppy, light Can be wired network card or GPRS, 8 〇 2 times Berg shake. The communication device 16 person's email address includes the name of the mailing device, the mailing address of the mail box, the copy of the recipient: the mailing list and the entrainment case, etc. + 炊 匕 匕 各 各 lang lang lang lang HTML HTML HTML HTML HTML HTML HTML HTML HTML HTML HTML HTML HTML HTML HTML HTML HTML HTML HTML HTML And the text of the method for providing a spam filtering method based on anomalous features according to an embodiment of the present invention. First, in step S21, an e-mail can be obtained through the communication device 16. In step S23, the mail abnormal feature extraction rule is used to retrieve a plurality of first abnormal feature strings in the e-mail, and the detailed rules of the mail abnormal feature extraction can be referred to the following paragraphs. In step S25, a plurality of groups associated with the first abnormal feature string are searched for according to the first abnormal feature string. In step S27, it is determined whether the email is spam based on the similarity between the first abnormal feature string and the second abnormal feature string associated with each of the plurality of groups. Figure 3 is a flow chart showing a method of a spam filtering method based on anomalous features in accordance with an embodiment of the present invention. 0213-A40531TW(N2); ACI93003TW; SNOWBALL.ptd Page 12 .1287720 · _ V. Invention Description (8) First, in step S311, the mail can be transmitted. In step S3 13, the electronic mailing device 16 is obtained to obtain all the strings of the electronic capturing rule (in the case of the mail abnormal feature regular character string). The message is different from the above-mentioned string. The step in the rule can be used to extract the abnormal feature string: 2 - 1 - corresponding to the sender email abnormal feature string;祁< in the field of the rule 2 - draw the string corresponding to the recipient / copy recipient / secret copy recipient email mailbox, as an exception feature string; rule 3 - draw corresponding to the mail The string of the server is treated as an abnormal feature string; , ^ Rule 4 - Pick up the message in the text corresponding to the hyperlink, in the case of the exception feature string; Rule 5 - Capture the message with the background Substrings of the same color of the previous color 'This string can also be called invisible ink, as an abnormal feature string; Rule 6 - Pick up the message in this article can not be found in the thesaurus _ 丨 string Such a string may also be referred to as a word salad as an abnormal feature string; Rule 7 - Extracting a string in the text that is not Chinese or English, as an abnormal feature string; Rule 8 - Capture the message in this article is included in the HTML markup of the display graphic Should be a string of text attribute values, for example, a display graphic

0213-A40531TlV(N2); ACI93003TlV; SNOWBALL.ptd Page 13 1287720 V. Description of invention (9) The HTML tag is "<img scr =, 'imagel.gifn text = "advertise"/>", which corresponds to The string of the text attribute value is "advertisement", which is treated as an exception character string; Rule 9 - Capture the string with special text effect in the text, for example, amplify the font, have a flashing function, etc. Making an abnormal feature string; and the rule 1 0 - extracting the message corresponding to the string in the text, as the abnormal feature string step S321 to S3 25 is a repeated execution loop for obtaining the abnormal feature of the f extract The group to which the string corresponds. The storage device 13 stores ^ groups, each of which contains a plurality of abnormal feature strings, and the $ abnormal feature string is obtained by at least one similar email, so that the same group belongs to the same group. The email in it will have a similar set of anomalous signature strings than ^3 in other groups. In addition, I has a constant count value, and the table has received a similar number of emails similar to the one in the group. This loop details the example, and, in step S321, the next extraction exception S323 is obtained, and the detection phase is performed. All groups of exception feature strings that are accelerated by step. For the table) and the hash function (h + ·, seven raise table (hash, ^ double, nasJl function) to go to her, the watch is stored in the storage device 13, the water into the search. Hashing area) and collision 】·. 矣 矣 fe(hash LCco11!s!on area ), including multiple 筌 笔 笔 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己 己The abnormal feature has a specific abnormal feature string stored in the hash area.

1287720 V. Inventive Note (10) The inter-storage address is determined by the hash function based on the abnormal feature code (for example, ASCII code, ΒΙ5, GB2313 code, etc.), and step S323 is based on the exception obtained first. If the match is met, the storage address is obtained:::::2:: special: advance (four) processing (c〇llisio...cess), to the group touch: area - no (collision) storage space to find the match Abnormal feature

Rational, you can make moderate modifications and apply the miscellaneous:: Yes, then proceed with the step, otherwise proceed to step S32=J check fortunate Ϊ:?? 'Retrieve the unusual character string of this email with each one The feature string in the group is compared with the similarity, ID table! The similarity value between the t-mail and the retrieved group. If the abnormal feature string of the email is given in step 1 is similar to the abnormality group in the basin: the abnormal feature string 'is the step 1 is performed in the processing of the step S343. Regarding step S33es341, in the present example, a Bayesian classification (Bayesian's different '^2:10:) method can be used. The Bayesian Λ* method enters the conditional probability value of the group taken from this message, and calculates the generation 2 1 page 15 0213-A40531TW(N2); ACI93003TW; SNOWBALL, t 1287720 V. Description of the invention (U) The similarity value of the group of I. Then, comparing the similarity values of the respective groups, obtaining a group that satisfies the initial setting condition and having the greatest similarity ^:, the similar group 'if the similarity values of all the groups cannot satisfy the initial setting condition' This email is not similar to all groups. Familiar with this, the art knows that, in terms of comparative similarity, in addition to using the Bayesian classification method, a variety of similarity analysis methods can be used together with the criterion for judging similarity to implement step S331 and S343. In step S343, a normal email processing program is executed. In this step, you can leave this email on the receiving server = sub-mail, or you can send the e-mail directly to the user through a variety of == for example, SMS, IM, etc.). = step S351', the cumulative number of groups similar to this email is added to determine whether the cumulative number of similar groups exceeds - an initial sigh value, and the process proceeds to step S355, S3 43. For example, if you want to subscribe to the order, then the order is as follows: + = Execute the junk e-mail handler. Receive this email. The user can't use the system according to the embodiment of the present invention to store the computer-based program (4), which is based on the abnormal feature of the storage medium. Throughout the above-mentioned or 'specific type or its riding, you can use: month, method and system media, such as floppy disk, CD, hard disk, or:, the type is included in the actual (such as computer Readable) storage medium, where other machine-readable fields are coded by the machine, such as

.1287720 - V. INSTRUCTIONS (12) When the computer is loaded and executed, the machine becomes the method and device of the present invention, and can also be used as a body, such as a wire or cable, an optical fiber, or a device in which the code is used, such as The computer machine becomes a device for participating in the present invention. The general-purpose processing of the present invention provides an operation similar to that of the application. Although the invention has been defined by the preferred embodiments, any one skilled in the art and the scope A number of changes and scopes may be made to participate in the device of the present invention as disclosed in the appended claims. The zebra pattern is transmitted, received, loaded and executed by some transmission type, as in general. The uniqueness of the specific logic circuit of the program code 70 is as described above, but it is not intended to be used without departing from the spirit of the invention. 0213-A40531TW(N2); ACI93003TW;SNOWBALL.ptd Page 17 1287720

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a hardware structural diagram of a spam filtering system according to an embodiment of the present invention; and ten features are based on the second and third figures showing spam according to an embodiment of the present invention. Method flow chart of filtering method; common hanging feature is based on Fig. 4 is a diagram showing the special desire of computer readable storage medium based on the spam filtering of the embodiment of the present invention. [Main component symbol description] , map. 1 0 ~ spam based on abnormal features: 虔 11 ~ processing unit; 'system 1 2 ~ memory; 13 ~ storage device 14 ~ output device 1 5 ~ input device 16 ~ communication device 1 7 ~ bus; S21, S23, S25, S27~ operation steps; ~ operation steps; mail filtering computer programs S311, S313.....S353, S355

40~ storage media; 420~ garbage based on abnormal features

0213-A40531TW(N2); ACI93003TW; SN〇WBALL.ptd第18页

Claims (1)

1287720 VI. Patent application scope 1. An electronic device with a central processor based on an abnormal feature: a filtering method, which is executed by a device, and the method includes the following steps: receiving an email; a plurality of first abnormal feature strings captured by the mail anomaly feature; % of the plurality of groups in the thousands of emails according to the first abnormal feature string constant feature string; and the inch _ chatting on the first cover Depending on whether the above-mentioned e-mail is based on the similarity between the strings, whether the above-mentioned e-mails are related to the similarity between the strings, etc.笫1 spam filtering method, the name of the top-of-the-line feature based on the different ten features, the sender's e-mail; nti material contains a copy of the server name, the recipient's e-mail address, the destination = A person's e-mail address, a box, and a mail Γ = 3 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻 翻Φ ^ β An abnormal feature string sender email address... 'takes the string corresponding to the above recipient/3丨 email address as the upper "recipient/bcc copy recipient Corresponding to the above-mentioned mail feeding abnormal characteristic string; an abnormal characteristic string; a string of words, as the above-mentioned first drawing of the above-mentioned mail corresponding to the hyperlink in the text, as 〇213-A4053m(N2); ACI93003TW;SNOWBALL.ptd Page 19 1287720 The first abnormal feature string is described; $ takes the sub-string of the above-mentioned mail with the same background color as the first abnormal feature string; the above-mentioned mail is not found in the vocabulary. The string is treated as the first abnormal feature string; = the string of the non-Chinese or English in the above mail is taken as the first abnormal feature string; the hourly message is included in the article. In the HTML mark of the display graphic; ... in the string of the text attribute value, as the first abnormal feature word, the string having the special text effect in the mail message is taken as the first abnormal feature string. And the sub-field of the political fruit is treated as: the string corresponding to the spam semantics in the text, the first abnormal feature string. 3. If the method of applying for the spam is as described in the scope of the patent application, the receiving of the above-mentioned group is related to the plurality of previously described second anomalous features. The electricity and the #甘母Email room have the same substrings. The abnormal features possessed by the device. 4. The third step of the spam filtering method in the patent application scope, in the steps based on the decision of the bu, +, and anomalous features, including whether the email is spam or not. The association is based on the first abnormal feature string and the abnormal feature string; a parent-the group associated with the 20th page 0213.A4053lIW(N2); ACI93003TW; SNOWBALL.ptd 1287720 • I 6. Patent application scope ϊ ;;: The similarity between the regular f-strings, the calculation-similarity value; when the above-mentioned first initial setting is exceeded, the e-mail of the sigh is determined to be spam.疋上5 ·If applying for patent spam filtering and methods, when Λ=the initial set value based on abnormal features, including ··, Tian Shu similarity value exceeds the above first, the similarity value exceeds the sincerity —, the cumulative number of one of the associations, the number of emails in the group of one of the upper = u set values; , β 1 represents the associated number in the specific group plus one of the above cumulative quantities; whether the quantity exceeds a second initial set value; And garbage; ΐίίΙΓ super! When the second initial setting value is used, the sequence of ΐ 6 , 2 is executed, so that the user cannot receive the above email. 6. If you apply for patent coverage number 5 in the mail. The spam filtering method, wherein the initial setting value is based on νΛ: ,, if the similarity value exceeds the above-mentioned first positive ϊ ϊΐ ϊΐ 不 不 不 不 不 不 不 不 不 不 理 理 理 理 理 理Use 纟 to receive the above email. Spam worker; 2 Fan: ί1 item based on the abnormal feature based on the filtering method, in the above-mentioned group step, including:: the above-mentioned first special = cum function and collision processing method to find the corresponding side The above plurality of groups of an abnormal feature string. 8· A computer readable storage medium for storing a computer program, page 21 〇213-A40531TW(N2); ACI93003TW; SNOWBAa.r 1287720 · , VI, patent application scope " brain program for loading to a computer system and causing the computer system to perform an abnormal feature-based spam filtering method, the method package receiving an email; using a mail anomaly feature capture rule to retrieve a plurality of the emails An abnormal feature string; searching for a plurality of groups associated with the first different feature string according to the first abnormal feature string; and, according to the first abnormal feature string and the plurality of groups Every == more! The subtraction between the second abnormal feature strings determines whether the above email is spam. Included······························································································· The extracting rule is used to retrieve the string according to the similarity between the plurality of strings of the first constant feature string and the plurality of group strings. The abnormal feature is based on one of the mail server name email addresses, and the processing unit is coupled to the above-mentioned device to receive an email, and uses a plurality of first abnormal abnormal feature strings in the email to search for Associated with the group, and determining whether the email is 1 0 according to a plurality of second degrees of heterogeneity associated with each of the first abnormalities, and the spam filtering system of claim 9 , the above postal name, a sender's email address, one 1287720 · VI. Apply for a copy of the patent scope to the recipient's electrical box and then to the first electronic mail, an abnormal statement of the first color is taken as the corresponding string of the above-mentioned third paragraph;撷 撷 上 上 上 上 上 上 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应 相应The first sub-mail ## This article, I,, +, uncle one copy of the recipient email letter: ^ mail anomaly feature extraction rules for the following rules: two: the sender's e-mail address, when Ϊ́ΐ 收 : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : Corresponding to the word of hyperlinks. 'As the first abnormal feature string with the background in the m text; 别豕颜:: The string in the t text that cannot be found in the lexicon, the abnormal feature string; A, the mail is not in this article Φ Let the ten π characteristic string be a string of Chinese or Central text, when 2 is included in the HTML mark of the *graphic, the string of values, as the first abnormal feature word as the first part of the article The special character effect string Wei character string; and the string corresponding to the spam semantics in this article, the different character string. , when 0213-A40531TW(N2) ; ACI93003TW; SNOWBALL. ptd Page 23 .1287720 The deposit based on the abnormal features described in item 9 of the garbage component includes: storage device*'s storage device stored in the above-mentioned storage device, and the above group is associated with multiple previously received two abnormal features. The above-mentioned first-come-like strings owned by each of the electronic materials will be compared with the abnormal feature strings owned by other e-mails. According to the anomaly feature, the above-mentioned processing unit obtains the first abnormal feature string for each of the above-mentioned group syndrome words. According to the above-mentioned first-exception special two groups; the upper two relations between the two abnormal feature strings are associated with the initial set value, and the #-the similarity value exceeds the mail. When the sub-tool starts & the value is determined, the above-mentioned received e-mail is determined to be garbage. The abnormal feature-based value is as described in item 12 of the patent application scope: the m-transfer system...the above processing unit is when the above similarity is 11, ' * When the first initial setting value is obtained, a cumulative quantity whose one of the similarity values exceeds one of the first initial setting values of the upper a is obtained, wherein the accumulated quantity represents the electronic postal number associated with the specific group, The upper count is incremented by one to determine whether the accumulated quantity exceeds a second: start "set value' and 'when the accumulated quantity exceeds the second initial set value, a spam processing program is executed, so that the user cannot receive The above email. η·Based on the abnormal characteristics as described in item 13 of the patent application scope 1287720 · Sixth, the application of the scope of the spam filtering system, in which the above processing, value exceeds the first initial set value, and the second two make # use ί, then hit a normal mail processing program, wait The user can receive the above email.斤1 5 · According to the abnormal feature-based spam filtering system described in claim 9 of the patent scope, the processing unit uses a hash table, a hash function, and a collision processing method to find two strings corresponding to the first abnormal feature. The above plurality of groups. Give 0213-A40531TW(N2); ACI93003TW;SNOWBALL.ptd第25页