← Back to Patent Explorer
US6732149B1 Expired / Lapsed US ⏱️ 0.0 years remaining

System and method for hindering undesired transmission or receipt of electronic messages

Assignee: Trend Micro Inc
•
Filing: 1999-04-09
•
Granted: 2004-05-04
•
Expires: 2019-04-09
📄 Original PDF 🌐 Google Patents 🔄 Sync Now

Abstract

Abstract A system and method of hindering an undesirable transmission or receipt of electronic messages within a network of users includes the steps of determining that transmission or receipt of at least one specific electronic message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; and taking appropriate action, responsive to the scanning step.

Inventors

  • 👤 Jeffrey Owen Kephart

Bibliographic Details

Application Number —
Jurisdiction US
Data Source google_patents
Last Synchronized 2026-10-24 21:00
CPC Classifications
G; G06; G06Q; G06Q10/00; G06Q10/10; G06Q10/107; H; H04; H04L; H04L51/00; H04L51/21; H04L51/212

Claims Analysis

Total Claims: 48
Claim 1
Independent Claim 138 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof, wherein said automatically extracting includes automatically ideniitifying and storing a text string signature contained within an undesirable electronic message, said text string signature being statistically unlikely to be found in desirable electronic messages; scanning one or more inbound and outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof wherein said scanning includes searching for said text string signature within said inbound and outbound messages; and taking appropriate action, responsive to the scanning step.
Claim 2
Independent Claim 138 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof, wherein said automatically extracting includes automatically ideniitifying and storing a text string signature contained within an undesirable electronic message, said text string signature being statistically unlikely to be found in desirable electronic messages; scanning one or more inbound and outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof wherein said scanning includes searching for said text string signature within said inbound and outbound messages; and taking appropriate action, responsive to the scanning step.
Claim 3
Dependent Claim 15 words
The method of claim 1 further comprising the step of storing the extracted detection data.
Claim 4
Dependent Claim 27 words
The method of claim 1 wherein the determining step comprises the step of receiving notification that proliferation of the at least one specific electronic message is undesirable.
Claim 5
Dependent Claim 32 words
The method of claim 3 wherein the receiving step comprises the step of receiving a signal from an alert user identifying the at least one specific electronic message as undesirable or confidential.
Claim 6
Dependent Claim 22 words
The method of claim 4 wherein the at least one specific electronic message is received in an inbox of the alert user.
Claim 7
Dependent Claim 33 words
The method of claim 4 wherein the receiving step comprises the step of providing an identifier for the alert user to indicate that the specific electronic message is to be flagged as undesirable.
Claim 8
Dependent Claim 26 words
The method of claim 6 wherein the providing step comprises the step of providing a generic detector to aid in identification of undesirability of electronic messages.
Claim 9
Dependent Claim 24 words
The method of claim 2 wherein the extracting step comprises the step of extracting, from the at least one specific electronic message, signature information.
Claim 10
Dependent Claim 33 words
The method of claim 8 wherein the storing step comprises the step of adding, responsive to the scanning step, information pertaining to the at least one specific electronic message to the signature information.
Claim 11
Dependent Claim 24 words
The method of claim 2 wherein the extracting step comprises the step of extracting a signature from the at least one specific electronic message.
Claim 12
Dependent Claim 22 words
The method of claim 10 wherein the storing step comprises the step of storing the signature in at least one signature database.
Claim 13
Dependent Claim 25 words
The method of claim 11 wherein the signature database comprises a plurality of signature clusters, each cluster including data corresponding to substantially similar electronic messages.
Claim 14
Dependent Claim 30 words
The method of claim 12 wherein each of the signature clusters comprises a character sequence component having scanning information and an archetype component having identification information about particular signature variants.
Claim 15
Independent Claim 264 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic the message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; taking appropriate action, responsive to the scanning step; and storing the extracted detection data, wherein the extracting step comprises the step of extracting a signature from the at least one specific electronic message; wherein the storing step comprises the step of storing the signature in at least one signature database; wherein the signature database comprises a plurality of signature clusters, each cluster including data corresponding to substantially similar electronic messages; wherein each of the signature clusters comprises a character sequence component having scanning information and an archetype component having identification information about particular signature variants; and wherein the scanning information includes a search character sequence for a particular electronic message and extended character sequence information for all the electronic messages represented in the cluster and wherein the identification information includes a pointer to a full text stored copy of an electronic message relating to a particular signature variant, a hashblock of the electronic message, and alert data corresponding to specific instances where a copy of the electronic message was received and the proliferation of which was reported as undesirable by an alert user.
Claim 16
Independent Claim 264 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic the message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; taking appropriate action, responsive to the scanning step; and storing the extracted detection data, wherein the extracting step comprises the step of extracting a signature from the at least one specific electronic message; wherein the storing step comprises the step of storing the signature in at least one signature database; wherein the signature database comprises a plurality of signature clusters, each cluster including data corresponding to substantially similar electronic messages; wherein each of the signature clusters comprises a character sequence component having scanning information and an archetype component having identification information about particular signature variants; and wherein the scanning information includes a search character sequence for a particular electronic message and extended character sequence information for all the electronic messages represented in the cluster and wherein the identification information includes a pointer to a full text stored copy of an electronic message relating to a particular signature variant, a hashblock of the electronic message, and alert data corresponding to specific instances where a copy of the electronic message was received and the proliferation of which was reported as undesirable by an alert user.
Claim 17
Dependent Claim 22 words
The method of claim 2 wherein the extracting step and the scanning step occur simultaneously and asynchronously across the network of users.
Claim 18
Dependent Claim 25 words
The method of claim 4 further comprising the step of confirming, before the scanning step, the undesirability of the at least one specific electronic message.
Claim 19
Dependent Claim 29 words
The method of claim 16 wherein the confirming step comprises the step of confirming, with a generic detection technique, the undesirability of the at least one specific electronic message.
Claim 20
Dependent Claim 32 words
The method of claim 16 wherein the confirming step comprises the step of requiring that a predetermined threshold number of users signal that the at least one specific electronic message is undesirable.
Claim 21
Dependent Claim 51 words
The method of claim 14 wherein the extracting step comprises the steps of: scanning the specific electronic message for any signatures in the at least one signature database; and comparing, responsive to finding a matching signature in the scanning step, the matching signature to each message variant in a matching cluster.
Claim 22
Dependent Claim 37 words
The method of claim 19 wherein the comparing step comprises the steps of: computing a hashblock for the specific electronic message; and comparing the computed hashblock with variant hashblocks in the identification information of each archetype component.
Claim 23
Dependent Claim 179 words
The method of claim 20 further comprising the steps of: if an exact variant hashblock match is found, retrieving the full text stored copy of the variant match using the pointer, and if the full text stored copy of the variant match and the full text of the specific electronic message are deemed sufficiently similar to regard the specific electronic message as an instance of the variant, extracting alert data from the specific electronic message and adding it to the alert data for the variant match; else if an exact variant hashblock match is not found or the full text of the specific electronic message is found to be insufficiently similar to any of the variants in the database, determining whether the specific electronic message is sufficiently similar to any existing cluster; if the specific electronic message is sufficiently similar to an existing cluster, computing new identification information associated with specific electronic message; else if the specific electronic message is not determined to be sufficiently similar to an existing cluster, creating a new cluster for the specific electronic message.
Claim 24
Dependent Claim 52 words
The method of claim 21 wherein the determining step comprises the steps of: computing a checksum of a region of the specific electronic message indicated in the extended character sequence information for each cluster; and comparing the computed checksum with a stored checksum in the extended character sequence information of each cluster.
Claim 25
Dependent Claim 25 words
The method of claim 19 further comprising the step of creating, if no signature match is found, a new cluster for the specific electronic message.
Claim 26
Dependent Claim 78 words
The method of claim 22 wherein the extended character sequence information includes a beginoffset field, a regionlength field and a CRC field, the method further comprising the steps of: determining, for each cluster, a matching region with a longest regionlength; and identifying, if the longest regionlength among all the clusters is at least equal to a specified threshold length, a longest regionlength cluster as an archetype cluster to which the specific electronic message archetype is to be added.
Claim 27
Dependent Claim 18 words
The method of claim 23 further comprising the step of recomputing the scanning information of the identified cluster.
Claim 28
Dependent Claim 69 words
The method of claim 14 wherein the alert data includes a receivetime field having a time at which a copy was originally received and wherein the method further comprises the steps of: periodically comparing the receivetime field of all variants of each signature cluster with the current time; and removing a signature cluster in which none of the receivetime fields are more recent than a predetermined date and time.
Claim 29
Dependent Claim 47 words
The method of claim 1 wherein the scanning step comprises the steps of: extracting a message body; transforming the message body into an invariant form; scanning the invariant form for exact or near matches to the detection data; and determining, for each match, a level of match.
Claim 30
Dependent Claim 31 words
The method of claim 1 wherein the taking step comprises the step of taking appropriate action, upon discovering the presence of the at least one specific electronic message or variants thereof.
Claim 31
Dependent Claim 28 words
The method of claim 28 wherein the taking step comprises the step of labeling the at least one specific electronic message or variants thereof as undesirable or confidential.
Claim 32
Dependent Claim 24 words
The method of claim 28 wherein the taking step comprises the step of removing the at least one specific electronic message or variants thereof.
Claim 33
Dependent Claim 29 words
The method of claim 27 wherein the taking step comprises the step of taking appropriate action for each determined level of match, responsive to one or more user preferences.
Claim 34
Independent Claim 188 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic the message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; and taking appropriate action, responsive to the scanning step; wherein the scanning step comprises the steps of: extracting a message body; transforming the message body into an invariant form; scanning the invariant form for exact or near matches to the detection data; and determining, for each match, a level of match, and wherein the determining step comprises the steps of: finding the longest regional matches for each match; computing hashblock similarities between a hashblock of the scanned message and hashblocks of each of the extracted detection data; receiving one or more user preferences; and determining a level of match responsive to the finding, computing and receiving steps.
Claim 35
Independent Claim 188 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic the message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; and taking appropriate action, responsive to the scanning step; wherein the scanning step comprises the steps of: extracting a message body; transforming the message body into an invariant form; scanning the invariant form for exact or near matches to the detection data; and determining, for each match, a level of match, and wherein the determining step comprises the steps of: finding the longest regional matches for each match; computing hashblock similarities between a hashblock of the scanned message and hashblocks of each of the extracted detection data; receiving one or more user preferences; and determining a level of match responsive to the finding, computing and receiving steps.
Claim 36
Dependent Claim 160 words
A program storage device, readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for hindering an undesirable transmission or receipt of electronic messages within a network of users, the method comprising the steps of: determining that transmission or receipt of at least one specific electronic message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof, wherein said automatically extracting includes automatically identifying and storing a text string signature contained within an undesirable electronic message, said text string signature being statistically unlikely to be found in desirable electronic messages; scanning one or more inbound and outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof wherein said scanning includes searching for said text string signature within said inbound and outbound messages; and taking appropriate action, responsive to the scanning step.
Claim 37
Dependent Claim 160 words
A program storage device, readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for hindering an undesirable transmission or receipt of electronic messages within a network of users, the method comprising the steps of: determining that transmission or receipt of at least one specific electronic message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof, wherein said automatically extracting includes automatically identifying and storing a text string signature contained within an undesirable electronic message, said text string signature being statistically unlikely to be found in desirable electronic messages; scanning one or more inbound and outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof wherein said scanning includes searching for said text string signature within said inbound and outbound messages; and taking appropriate action, responsive to the scanning step.
Claim 38
Independent Claim 278 words
A system for hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising: means for determining that transmission or receipt of at least one specific electronic message is undesirable; means for automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; means for scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific, electronic message or variants thereof; means for taking appropriate action, responsive to the scanning means, further comprising a means for storing the extracted detection data; and means for storing the extracted detection data; wherein the extracting means comprise means for extracting a signature from the at least one specific electronic message; wherein the storing means comprise means for storing the signature in at least one signature database; wherein the signature database comprises a plurality of signature clusters, each cluster including data corresponding to substantially similar electronic messages; wherein each of the signature clusters comprises a character sequence component having scanning information and an archetype component having identification information about particular signature variants; and wherein the scanning information includes a search character sequence for a particular electronic message and extended character sequence information for all the electronic messages represented in the cluster and wherein the identification information includes a pointer to a full text stored copy of an electronic message relating to a particular signature variant, a hashblock of the electronic message, and alert data corresponding to specific instances where a copy of the electronic message was received and the proliferation of which was reported as undesirable by an alert user.
Claim 39
Independent Claim 278 words
A system for hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising: means for determining that transmission or receipt of at least one specific electronic message is undesirable; means for automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; means for scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific, electronic message or variants thereof; means for taking appropriate action, responsive to the scanning means, further comprising a means for storing the extracted detection data; and means for storing the extracted detection data; wherein the extracting means comprise means for extracting a signature from the at least one specific electronic message; wherein the storing means comprise means for storing the signature in at least one signature database; wherein the signature database comprises a plurality of signature clusters, each cluster including data corresponding to substantially similar electronic messages; wherein each of the signature clusters comprises a character sequence component having scanning information and an archetype component having identification information about particular signature variants; and wherein the scanning information includes a search character sequence for a particular electronic message and extended character sequence information for all the electronic messages represented in the cluster and wherein the identification information includes a pointer to a full text stored copy of an electronic message relating to a particular signature variant, a hashblock of the electronic message, and alert data corresponding to specific instances where a copy of the electronic message was received and the proliferation of which was reported as undesirable by an alert user.
Claim 40
Dependent Claim 52 words
The system of claim 34 wherein the extracting means comprise: means for scanning the specific electronic message for any signatures in the at least one signature database; and means for comparing, responsive to finding a matching signature by the scanning means, the matching signature to each message variant in a matching cluster.
Claim 41
Dependent Claim 38 words
The system of claim 35 wherein the comparing means comprise: means for computing a hashblock for the specific electronic message; and means for comparing the computed hashblock with variant hashblocks in the identification information of each archetype component.
Claim 42
Dependent Claim 187 words
The system of claim 36 further comprising: means, if an exact variant hashblock match is found, for retrieving the full text stored copy of the variant match using the pointer, means, if the full text stored copy of the variant match and the full text of the specific electronic message are deemed sufficiently similar to regard the specific electronic message as an instance of the variant, for extracting alert data from the specific electronic message and adding it to the alert data for the variant match; and means, else if an exact variant hashblock match is not found or the full text of the specific electronic message is found to be insufficiently similar to any of the variants in the database, for determining whether the specific electronic message is sufficiently similar to any existing cluster; means, if the specific electronic message is sufficiently similar to an existing cluster, for computing new identification information associated with specific electronic message; and means, else if the specific electronic message is not determined to be sufficiently similar to an existing cluster, for creating a new cluster for the specific electronic message.
Claim 43
Dependent Claim 53 words
The system of claim 37 wherein the determining means comprise: means for computing a checksum of a region of the specific electronic message indicated in the extended character sequence information for each cluster; and means for comparing the computed checksum with a stored checksum in the extended character sequence information of each cluster.
Claim 44
Dependent Claim 24 words
The system of claim 35 further comprising means for creating, if no signature match is found, a new cluster for the specific electronic message.
Claim 45
Dependent Claim 79 words
The system of claim 38 wherein the extended character sequence information includes a beginoffset field, a regionlength field and a CRC field, the system further comprising: means for determining, for each cluster, a matching region with a longest regionlength; and means for identifying, if the longest regionlength among all the clusters is at least equal to a specified threshold length, a longest regionlength cluster as an archetype cluster to which the specific electronic message archetype is to be added.
Claim 46
Dependent Claim 17 words
The system of claim 39 further comprising means for recomputing the scanning information of the identified cluster.
Claim 47
Independent Claim 201 words
A system for hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising: means for determining that transmission or receipt of at least one specific electronic message is undesirable; means for automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; means for scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; means for taking appropriate action, responsive to the scanning means; wherein the scanning means comprise: means for extracting a message body; means for transforming the message body into an invariant form; means for scanning the invariant form for exact or near matches to the detection data; and means for determining, for each match, a level of match, and wherein the determining means comprise: means for finding the longest regional matches for each match; means for computing hashblock similarities between a hashblock of the scanned message and hashblocks of each of the extracted detection data; means for receiving one or more user preferences; and means for determining a level of match responsive to the finding, computing and receiving steps.
Claim 48
Independent Claim 201 words
A system for hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising: means for determining that transmission or receipt of at least one specific electronic message is undesirable; means for automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; means for scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; means for taking appropriate action, responsive to the scanning means; wherein the scanning means comprise: means for extracting a message body; means for transforming the message body into an invariant form; means for scanning the invariant form for exact or near matches to the detection data; and means for determining, for each match, a level of match, and wherein the determining means comprise: means for finding the longest regional matches for each match; means for computing hashblock similarities between a hashblock of the scanned message and hashblocks of each of the extracted detection data; means for receiving one or more user preferences; and means for determining a level of match responsive to the finding, computing and receiving steps.

USPTO Annuity & Maintenance Windows

Annuity Stage Window Opens Payment Deadline Surcharge Period Until Estimated Fee Status
3.5 Years (Year 4) 2007-05-04 2007-11-03 2008-05-04 $2000.00 Window Closed / Lapsed
7.5 Years (Year 8) 2011-05-04 2011-11-03 2012-05-04 $3760.00 Window Closed / Lapsed
11.5 Years (Year 12) 2015-05-04 2015-11-03 2016-05-04 $7700.00 Window Closed / Lapsed

Assigned Categories & Tags

No categories assigned to this patent yet.

Assign Category Tag