US6732149B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for hindering undesired transmission or receipt of electronic messages
Assignee: Trend Micro Inc
•
Filing: 1999-04-09
•
Granted: 2004-05-04
•
Expires: 2019-04-09
Abstract
Abstract A system and method of hindering an undesirable transmission or receipt of electronic messages within a network of users includes the steps of determining that transmission or receipt of at least one specific electronic message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; and taking appropriate action, responsive to the scanning step.
Inventors
- 👤 Jeffrey Owen Kephart
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 21:00
CPC Classifications
G; G06; G06Q; G06Q10/00; G06Q10/10; G06Q10/107; H; H04; H04L; H04L51/00; H04L51/21; H04L51/212
Claims Analysis
Total Claims: 48
Claim 1
Independent Claim
138 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof, wherein said automatically extracting includes automatically ideniitifying and storing a text string signature contained within an undesirable electronic message, said text string signature being statistically unlikely to be found in desirable electronic messages; scanning one or more inbound and outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof wherein said scanning includes searching for said text string signature within said inbound and outbound messages; and taking appropriate action, responsive to the scanning step.
Claim 2
Independent Claim
138 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof, wherein said automatically extracting includes automatically ideniitifying and storing a text string signature contained within an undesirable electronic message, said text string signature being statistically unlikely to be found in desirable electronic messages; scanning one or more inbound and outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof wherein said scanning includes searching for said text string signature within said inbound and outbound messages; and taking appropriate action, responsive to the scanning step.
Claim 3
Dependent Claim
15 words
The method of claim 1 further comprising the step of storing the extracted detection data.
Claim 4
Dependent Claim
27 words
The method of claim 1 wherein the determining step comprises the step of receiving notification that proliferation of the at least one specific electronic message is undesirable.
Claim 5
Dependent Claim
32 words
The method of claim 3 wherein the receiving step comprises the step of receiving a signal from an alert user identifying the at least one specific electronic message as undesirable or confidential.
Claim 6
Dependent Claim
22 words
The method of claim 4 wherein the at least one specific electronic message is received in an inbox of the alert user.
Claim 7
Dependent Claim
33 words
The method of claim 4 wherein the receiving step comprises the step of providing an identifier for the alert user to indicate that the specific electronic message is to be flagged as undesirable.
Claim 8
Dependent Claim
26 words
The method of claim 6 wherein the providing step comprises the step of providing a generic detector to aid in identification of undesirability of electronic messages.
Claim 9
Dependent Claim
24 words
The method of claim 2 wherein the extracting step comprises the step of extracting, from the at least one specific electronic message, signature information.
Claim 10
Dependent Claim
33 words
The method of claim 8 wherein the storing step comprises the step of adding, responsive to the scanning step, information pertaining to the at least one specific electronic message to the signature information.
Claim 11
Dependent Claim
24 words
The method of claim 2 wherein the extracting step comprises the step of extracting a signature from the at least one specific electronic message.
Claim 12
Dependent Claim
22 words
The method of claim 10 wherein the storing step comprises the step of storing the signature in at least one signature database.
Claim 13
Dependent Claim
25 words
The method of claim 11 wherein the signature database comprises a plurality of signature clusters, each cluster including data corresponding to substantially similar electronic messages.
Claim 14
Dependent Claim
30 words
The method of claim 12 wherein each of the signature clusters comprises a character sequence component having scanning information and an archetype component having identification information about particular signature variants.
Claim 15
Independent Claim
264 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic the message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; taking appropriate action, responsive to the scanning step; and storing the extracted detection data, wherein the extracting step comprises the step of extracting a signature from the at least one specific electronic message; wherein the storing step comprises the step of storing the signature in at least one signature database; wherein the signature database comprises a plurality of signature clusters, each cluster including data corresponding to substantially similar electronic messages; wherein each of the signature clusters comprises a character sequence component having scanning information and an archetype component having identification information about particular signature variants; and wherein the scanning information includes a search character sequence for a particular electronic message and extended character sequence information for all the electronic messages represented in the cluster and wherein the identification information includes a pointer to a full text stored copy of an electronic message relating to a particular signature variant, a hashblock of the electronic message, and alert data corresponding to specific instances where a copy of the electronic message was received and the proliferation of which was reported as undesirable by an alert user.
Claim 16
Independent Claim
264 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic the message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; taking appropriate action, responsive to the scanning step; and storing the extracted detection data, wherein the extracting step comprises the step of extracting a signature from the at least one specific electronic message; wherein the storing step comprises the step of storing the signature in at least one signature database; wherein the signature database comprises a plurality of signature clusters, each cluster including data corresponding to substantially similar electronic messages; wherein each of the signature clusters comprises a character sequence component having scanning information and an archetype component having identification information about particular signature variants; and wherein the scanning information includes a search character sequence for a particular electronic message and extended character sequence information for all the electronic messages represented in the cluster and wherein the identification information includes a pointer to a full text stored copy of an electronic message relating to a particular signature variant, a hashblock of the electronic message, and alert data corresponding to specific instances where a copy of the electronic message was received and the proliferation of which was reported as undesirable by an alert user.
Claim 17
Dependent Claim
22 words
The method of claim 2 wherein the extracting step and the scanning step occur simultaneously and asynchronously across the network of users.
Claim 18
Dependent Claim
25 words
The method of claim 4 further comprising the step of confirming, before the scanning step, the undesirability of the at least one specific electronic message.
Claim 19
Dependent Claim
29 words
The method of claim 16 wherein the confirming step comprises the step of confirming, with a generic detection technique, the undesirability of the at least one specific electronic message.
Claim 20
Dependent Claim
32 words
The method of claim 16 wherein the confirming step comprises the step of requiring that a predetermined threshold number of users signal that the at least one specific electronic message is undesirable.
Claim 21
Dependent Claim
51 words
The method of claim 14 wherein the extracting step comprises the steps of: scanning the specific electronic message for any signatures in the at least one signature database; and comparing, responsive to finding a matching signature in the scanning step, the matching signature to each message variant in a matching cluster.
Claim 22
Dependent Claim
37 words
The method of claim 19 wherein the comparing step comprises the steps of: computing a hashblock for the specific electronic message; and comparing the computed hashblock with variant hashblocks in the identification information of each archetype component.
Claim 23
Dependent Claim
179 words
The method of claim 20 further comprising the steps of: if an exact variant hashblock match is found, retrieving the full text stored copy of the variant match using the pointer, and if the full text stored copy of the variant match and the full text of the specific electronic message are deemed sufficiently similar to regard the specific electronic message as an instance of the variant, extracting alert data from the specific electronic message and adding it to the alert data for the variant match; else if an exact variant hashblock match is not found or the full text of the specific electronic message is found to be insufficiently similar to any of the variants in the database, determining whether the specific electronic message is sufficiently similar to any existing cluster; if the specific electronic message is sufficiently similar to an existing cluster, computing new identification information associated with specific electronic message; else if the specific electronic message is not determined to be sufficiently similar to an existing cluster, creating a new cluster for the specific electronic message.
Claim 24
Dependent Claim
52 words
The method of claim 21 wherein the determining step comprises the steps of: computing a checksum of a region of the specific electronic message indicated in the extended character sequence information for each cluster; and comparing the computed checksum with a stored checksum in the extended character sequence information of each cluster.
Claim 25
Dependent Claim
25 words
The method of claim 19 further comprising the step of creating, if no signature match is found, a new cluster for the specific electronic message.
Claim 26
Dependent Claim
78 words
The method of claim 22 wherein the extended character sequence information includes a beginoffset field, a regionlength field and a CRC field, the method further comprising the steps of: determining, for each cluster, a matching region with a longest regionlength; and identifying, if the longest regionlength among all the clusters is at least equal to a specified threshold length, a longest regionlength cluster as an archetype cluster to which the specific electronic message archetype is to be added.
Claim 27
Dependent Claim
18 words
The method of claim 23 further comprising the step of recomputing the scanning information of the identified cluster.
Claim 28
Dependent Claim
69 words
The method of claim 14 wherein the alert data includes a receivetime field having a time at which a copy was originally received and wherein the method further comprises the steps of: periodically comparing the receivetime field of all variants of each signature cluster with the current time; and removing a signature cluster in which none of the receivetime fields are more recent than a predetermined date and time.
Claim 29
Dependent Claim
47 words
The method of claim 1 wherein the scanning step comprises the steps of: extracting a message body; transforming the message body into an invariant form; scanning the invariant form for exact or near matches to the detection data; and determining, for each match, a level of match.
Claim 30
Dependent Claim
31 words
The method of claim 1 wherein the taking step comprises the step of taking appropriate action, upon discovering the presence of the at least one specific electronic message or variants thereof.
Claim 31
Dependent Claim
28 words
The method of claim 28 wherein the taking step comprises the step of labeling the at least one specific electronic message or variants thereof as undesirable or confidential.
Claim 32
Dependent Claim
24 words
The method of claim 28 wherein the taking step comprises the step of removing the at least one specific electronic message or variants thereof.
Claim 33
Dependent Claim
29 words
The method of claim 27 wherein the taking step comprises the step of taking appropriate action for each determined level of match, responsive to one or more user preferences.
Claim 34
Independent Claim
188 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic the message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; and taking appropriate action, responsive to the scanning step; wherein the scanning step comprises the steps of: extracting a message body; transforming the message body into an invariant form; scanning the invariant form for exact or near matches to the detection data; and determining, for each match, a level of match, and wherein the determining step comprises the steps of: finding the longest regional matches for each match; computing hashblock similarities between a hashblock of the scanned message and hashblocks of each of the extracted detection data; receiving one or more user preferences; and determining a level of match responsive to the finding, computing and receiving steps.
Claim 35
Independent Claim
188 words
A method of hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising the steps of: determining that transmission or receipt of at least one specific electronic the message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; and taking appropriate action, responsive to the scanning step; wherein the scanning step comprises the steps of: extracting a message body; transforming the message body into an invariant form; scanning the invariant form for exact or near matches to the detection data; and determining, for each match, a level of match, and wherein the determining step comprises the steps of: finding the longest regional matches for each match; computing hashblock similarities between a hashblock of the scanned message and hashblocks of each of the extracted detection data; receiving one or more user preferences; and determining a level of match responsive to the finding, computing and receiving steps.
Claim 36
Dependent Claim
160 words
A program storage device, readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for hindering an undesirable transmission or receipt of electronic messages within a network of users, the method comprising the steps of: determining that transmission or receipt of at least one specific electronic message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof, wherein said automatically extracting includes automatically identifying and storing a text string signature contained within an undesirable electronic message, said text string signature being statistically unlikely to be found in desirable electronic messages; scanning one or more inbound and outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof wherein said scanning includes searching for said text string signature within said inbound and outbound messages; and taking appropriate action, responsive to the scanning step.
Claim 37
Dependent Claim
160 words
A program storage device, readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for hindering an undesirable transmission or receipt of electronic messages within a network of users, the method comprising the steps of: determining that transmission or receipt of at least one specific electronic message is undesirable; automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof, wherein said automatically extracting includes automatically identifying and storing a text string signature contained within an undesirable electronic message, said text string signature being statistically unlikely to be found in desirable electronic messages; scanning one or more inbound and outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof wherein said scanning includes searching for said text string signature within said inbound and outbound messages; and taking appropriate action, responsive to the scanning step.
Claim 38
Independent Claim
278 words
A system for hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising: means for determining that transmission or receipt of at least one specific electronic message is undesirable; means for automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; means for scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific, electronic message or variants thereof; means for taking appropriate action, responsive to the scanning means, further comprising a means for storing the extracted detection data; and means for storing the extracted detection data; wherein the extracting means comprise means for extracting a signature from the at least one specific electronic message; wherein the storing means comprise means for storing the signature in at least one signature database; wherein the signature database comprises a plurality of signature clusters, each cluster including data corresponding to substantially similar electronic messages; wherein each of the signature clusters comprises a character sequence component having scanning information and an archetype component having identification information about particular signature variants; and wherein the scanning information includes a search character sequence for a particular electronic message and extended character sequence information for all the electronic messages represented in the cluster and wherein the identification information includes a pointer to a full text stored copy of an electronic message relating to a particular signature variant, a hashblock of the electronic message, and alert data corresponding to specific instances where a copy of the electronic message was received and the proliferation of which was reported as undesirable by an alert user.
Claim 39
Independent Claim
278 words
A system for hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising: means for determining that transmission or receipt of at least one specific electronic message is undesirable; means for automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; means for scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific, electronic message or variants thereof; means for taking appropriate action, responsive to the scanning means, further comprising a means for storing the extracted detection data; and means for storing the extracted detection data; wherein the extracting means comprise means for extracting a signature from the at least one specific electronic message; wherein the storing means comprise means for storing the signature in at least one signature database; wherein the signature database comprises a plurality of signature clusters, each cluster including data corresponding to substantially similar electronic messages; wherein each of the signature clusters comprises a character sequence component having scanning information and an archetype component having identification information about particular signature variants; and wherein the scanning information includes a search character sequence for a particular electronic message and extended character sequence information for all the electronic messages represented in the cluster and wherein the identification information includes a pointer to a full text stored copy of an electronic message relating to a particular signature variant, a hashblock of the electronic message, and alert data corresponding to specific instances where a copy of the electronic message was received and the proliferation of which was reported as undesirable by an alert user.
Claim 40
Dependent Claim
52 words
The system of claim 34 wherein the extracting means comprise: means for scanning the specific electronic message for any signatures in the at least one signature database; and means for comparing, responsive to finding a matching signature by the scanning means, the matching signature to each message variant in a matching cluster.
Claim 41
Dependent Claim
38 words
The system of claim 35 wherein the comparing means comprise: means for computing a hashblock for the specific electronic message; and means for comparing the computed hashblock with variant hashblocks in the identification information of each archetype component.
Claim 42
Dependent Claim
187 words
The system of claim 36 further comprising: means, if an exact variant hashblock match is found, for retrieving the full text stored copy of the variant match using the pointer, means, if the full text stored copy of the variant match and the full text of the specific electronic message are deemed sufficiently similar to regard the specific electronic message as an instance of the variant, for extracting alert data from the specific electronic message and adding it to the alert data for the variant match; and means, else if an exact variant hashblock match is not found or the full text of the specific electronic message is found to be insufficiently similar to any of the variants in the database, for determining whether the specific electronic message is sufficiently similar to any existing cluster; means, if the specific electronic message is sufficiently similar to an existing cluster, for computing new identification information associated with specific electronic message; and means, else if the specific electronic message is not determined to be sufficiently similar to an existing cluster, for creating a new cluster for the specific electronic message.
Claim 43
Dependent Claim
53 words
The system of claim 37 wherein the determining means comprise: means for computing a checksum of a region of the specific electronic message indicated in the extended character sequence information for each cluster; and means for comparing the computed checksum with a stored checksum in the extended character sequence information of each cluster.
Claim 44
Dependent Claim
24 words
The system of claim 35 further comprising means for creating, if no signature match is found, a new cluster for the specific electronic message.
Claim 45
Dependent Claim
79 words
The system of claim 38 wherein the extended character sequence information includes a beginoffset field, a regionlength field and a CRC field, the system further comprising: means for determining, for each cluster, a matching region with a longest regionlength; and means for identifying, if the longest regionlength among all the clusters is at least equal to a specified threshold length, a longest regionlength cluster as an archetype cluster to which the specific electronic message archetype is to be added.
Claim 46
Dependent Claim
17 words
The system of claim 39 further comprising means for recomputing the scanning information of the identified cluster.
Claim 47
Independent Claim
201 words
A system for hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising: means for determining that transmission or receipt of at least one specific electronic message is undesirable; means for automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; means for scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; means for taking appropriate action, responsive to the scanning means; wherein the scanning means comprise: means for extracting a message body; means for transforming the message body into an invariant form; means for scanning the invariant form for exact or near matches to the detection data; and means for determining, for each match, a level of match, and wherein the determining means comprise: means for finding the longest regional matches for each match; means for computing hashblock similarities between a hashblock of the scanned message and hashblocks of each of the extracted detection data; means for receiving one or more user preferences; and means for determining a level of match responsive to the finding, computing and receiving steps.
Claim 48
Independent Claim
201 words
A system for hindering an undesirable transmission or receipt of electronic messages within a network of users, comprising: means for determining that transmission or receipt of at least one specific electronic message is undesirable; means for automatically extracting detection data that permits detection of the at least one specific electronic message or variants thereof; means for scanning one or more inbound and/or outbound messages from at least one user for the presence of the at least one specific electronic message or variants thereof; means for taking appropriate action, responsive to the scanning means; wherein the scanning means comprise: means for extracting a message body; means for transforming the message body into an invariant form; means for scanning the invariant form for exact or near matches to the detection data; and means for determining, for each match, a level of match, and wherein the determining means comprise: means for finding the longest regional matches for each match; means for computing hashblock similarities between a hashblock of the scanned message and hashblocks of each of the extracted detection data; means for receiving one or more user preferences; and means for determining a level of match responsive to the finding, computing and receiving steps.
References Cited (Backward Citations)
EP0089918A2
Cited
EP0720333A2
Cited
US5619648A
Cited
US5826022A
Cited
JPH1074172A
Cited
EP0813162A2
Cited
US5883640A
Cited
US6144934A
Cited
US6173364B1
Cited
US6212525B1
Cited
US5877759A
Cited
JPH1115756A
Cited
US6249805B1
Cited
US5999967A
Cited
US6199102B1
Cited
US6023723A
Cited
US6052709A
Cited
WO1999033188A2
Cited
US5999932A
Cited
JPH11252158A
Cited
US6073167A
Cited
US6292795B1
Cited
US6161130A
Cited
US6167434A
Cited
US6240409B1
Cited
US6085321A
Cited
US6330590B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2007-05-04 | 2007-11-03 | 2008-05-04 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2011-05-04 | 2011-11-03 | 2012-05-04 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2015-05-04 | 2015-11-03 | 2016-05-04 | $7700.00 | Window Closed / Lapsed |