Probabilistic Spam Detection via URL Resource Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current threat detection systems struggle to accurately identify unwanted electronic mail messages, as they often appear legitimate and contain hidden hyperlinks or URLs associated with spam, viruses, or other threats, making it difficult to determine their intent.

Innovation Solution

A method using probabilistic analysis of network resource identifiers, where a whitelist and blocklist are trained to generate properties for URLs, and a probabilistic filter is used to determine the likelihood of a URL being associated with threats, with reputation scores from DNS records aiding in decision-making, and a blacklist is created to filter out harmful messages.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If typical analysis of message content is used, then the analysis process is simple and fast, but the accuracy of determining whether a message is spam or associated with threats is insufficient

Engineering Contradiction:
Improveaccuracy of threat detectionVSAvoidcomplexity of analysis system
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The system segments the analysis into multiple independent components: extracting network resource identifiers from messages, analyzing each identifier separately through probabilistic filtering, checking against blocklists and whitelists, and combining results to determine overall message safety. This segmentation allows complex analysis to be performed systematically without overwhelming complexity.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces network resource identifiers (URLs, domains, IP addresses) as intermediary elements between the message content and the threat detection system. Instead of analyzing the entire message directly, the system extracts these identifiers as intermediaries, analyzes them separately through probabilistic filters and blocklists, and uses their safety status to determine message authenticity. This intermediary approach significantly improves detection accuracy.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Measurement precision

If probabilistic analysis of network resource identifiers is performed, then the accuracy of identifying spam and threats is improved, but the processing time and computational resources increase

Engineering Contradiction:
Improveaccuracy of spam detectionVSAvoidmessage processing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary actions by maintaining pre-populated blocklists and whitelists of network resource identifiers that are already known to be malicious or safe. When a message is analyzed, these pre-existing lists provide immediate reference points, allowing the probabilistic filter to quickly determine message safety without extensive real-time computation. The blocklists and whitelists are built in advance through continuous monitoring and analysis.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms where the results of probabilistic analysis are continuously fed back into updating the blocklists and whitelists. When new spam patterns or threats are detected through probabilistic filtering, this information is used to refine future analysis, improving accuracy over time while maintaining efficient processing through learned patterns.

Inventive Principle:
Principle #23Feedback

3Reliability

If network resource identifiers are extracted and analyzed, then the ability to detect hidden threats is improved, but the complexity of message processing increases

Engineering Contradiction:
Improvereliability of threat detectionVSAvoidcomplexity of processing system
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system applies a universal probabilistic filtering mechanism that works across multiple types of network resource identifiers (URLs, domain names, IP addresses, email addresses) using the same analysis framework. This multi-functional approach improves reliability by consistently applying the same rigorous analysis to all identifier types, while the universality of the method actually reduces overall system complexity compared to having separate specialized analyzers for each identifier type.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP1877904B1Detecting unwanted electronic mail messages based on probabilistic analysis of referenced resources
Publication Date: 2015.12.30 CISCO IRONPORT SYSTEMS LLC
  • EP1877904B1 patent drawingFigure 1
  • EP1877904B1 patent drawingFigure 2A
  • EP1877904B1 patent drawingFigure 2B

AI summary

In one embodiment, detecting unwanted electronic mail messages based on probabilistic analysis of referenced resources comprises receiving a whitelist and a blocklist each having a plurality of network resource identifiers that have appeared in prior messages; retrieving a particular network resource identifier; generating a list of properties for the particular network resource identifier; training a probabilistic filter using the properties; and repeating the retrieving, generating and training for all the network resource identifiers in the whitelist and blocklist. Thereafter, when an electronic mail message is received and contains a URL or other network resource identifier, a spam score or threat score can be generated for the message by testing properties of the network resource identifier using the trained probabilistic filter.