Message Augmentation for Spam Identification via Network Node Linking

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods are inadequate in effectively identifying and isolating spam messages across various networked communications, leading to unwanted traffic and annoyance for recipients and network operators.

Innovation Solution

A system that augments messages with network node attributes by linking from an original network node to additional nodes, generating message signatures to characterize the message, and evaluating these signatures to determine if the message is spam, using techniques such as DNS lookups and recursive linking to expand relationships and identify spam characteristics.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If current spam identification methods are used, then basic filtering is achieved, but spam identification accuracy is insufficient leading to unwanted traffic

Engineering Contradiction:
Improvespam identification accuracyVSAvoidunwanted traffic
Core Design Contradiction:
Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent segments the spam identification process into multiple independent components: extracting original network nodes from messages, augmenting with additional network node attributes through DNS lookups and recursive linking, generating separate message signatures for different attributes, and evaluating multiple signatures independently. This segmentation allows each component to be optimized separately, improving overall identification accuracy while maintaining efficient spam filtering.

Inventive Principle:
Principle #1Segmentation

2Reliability

If basic message filtering is applied, then processing speed is maintained, but identification reliability is insufficient

Engineering Contradiction:
Improvespam identification reliabilityVSAvoidfiltering system complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent performs preliminary actions by extracting and augmenting network node attributes before message evaluation. DNS lookups and recursive linking are conducted in advance to build a comprehensive profile of network nodes associated with the message. This preliminary augmentation ensures that when messages are evaluated, reliable identification can be made based on pre-computed network node attributes, improving reliability without significantly increasing real-time processing complexity.

Inventive Principle:
Principle #10Preliminary action

3Measurement precision

If network node attributes are augmented through DNS lookups and recursive linking, then message characterization is improved, but processing time increases

Engineering Contradiction:
Improvemessage characterization precisionVSAvoidprocessing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies partial action by selectively performing DNS lookups and recursive linking based on message characteristics and risk levels. Not all messages undergo the full augmentation process; instead, the system performs augmentation selectively to achieve sufficient message characterization precision while limiting the time loss to only those messages that require enhanced analysis. This partial application of the augmentation process optimizes the balance between precision and processing time.

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP2992446B1Apparatus and method for augmenting a message to facilitate spam identification
Publication Date: 2019.12.04 PROOFPOINT INC
  • EP2992446B1 patent drawingFigure 1
  • EP2992446B1 patent drawingFigure 2
  • EP2992446B1 patent drawingFigure 3

AI summary

A computer includes a processor and a memory connected to the processor. The memory stores instructions executed by the processor to augment a message with network node attributes derived by linking from an original network node specified in the message to additional network nodes associated with the original network node. Message signatures representing the network node attributes are generated. The message signatures are evaluated to characterize the message.