Spam Message Signature Generation Through Classification And Clustering

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing spam detection methods face challenges with high false positive rates and slow detection speeds, particularly in machine learning approaches, while electronic signature methods struggle with throughput errors.

Innovation Solution

A system and method that combines machine learning with electronic signatures by determining classification and clustering attributes in intercepted messages to generate a spam message signature, using trained models like Bayesian classifiers and neural networks to improve detection accuracy and efficiency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If electronic signature methods are used for spam detection, then detection accuracy is improved, but throughput and detection speed deteriorate

Engineering Contradiction:
Improvedetection accuracyVSAvoidthroughput
Core Design Contradiction:
Measurement precisionVSProductivity

Solution Approach 1:

The patent segments spam detection into two stages: first using machine learning for fast initial classification, then using electronic signature verification for confirmed spam messages. This segmentation allows the system to achieve high detection accuracy through signature matching while maintaining high throughput by using the faster machine learning approach for the majority of messages.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent merges machine learning methods and electronic signature approaches into a unified spam detection system. The machine learning component provides fast initial filtering and generalization, while the electronic signature component provides precise detection for known spam patterns, combining the advantages of both methods to resolve the contradiction between accuracy and throughput.

Inventive Principle:
Principle #5Merging (Combining)

2Adaptability or versatility

If machine learning methods are used for spam detection, then generalization ability is improved, but false positive rate and detection time worsen

Engineering Contradiction:
Improvegeneralization abilityVSAvoidfalse positive rate
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The patent uses electronic signature verification as an intermediary mechanism to validate machine learning classifications. When the machine learning model identifies a message as spam, the system performs signature verification to confirm the classification, reducing false positives while preserving the generalization ability of machine learning for adapting to new spam patterns.

Inventive Principle:
Principle #24Intermediary (Mediator)

3Adaptability or versatility

If machine learning methods are used for spam detection, then generalization ability is improved, but detection speed worsens

Engineering Contradiction:
Improvegeneralization abilityVSAvoiddetection speed
Core Design Contradiction:
Adaptability or versatilityVSSpeed

Solution Approach 1:

The patent segments the detection process into fast machine learning classification followed by selective signature verification. This segmentation enables the system to maintain high detection speed through rapid machine learning evaluation while achieving high accuracy through signature verification only when needed, thus preserving generalization ability without sacrificing speed.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentEP4060962B1System and method for creating a signature of a SPAM message
Publication Date: 2025.07.02 AO KASPERSKY LAB
  • EP4060962B1 patent drawingFigure 1
  • EP4060962B1 patent drawingFigure 2
  • EP4060962B1 patent drawingFigure 3

AI summary

A method for generating a signature of a spam message includes determining one or more classification attributes and one or more clustering attributes contained in successively intercepted first and second electronic messages. The first electronic message is classified using a trained classification model for classifying electronic messages based on the one or more classification attributes. The first electronic message is classified as spam if a degree of similarity of the first electronic message to one or more spam messages is greater than a predetermined value. A determination is made whether the first electronic message and the second electronic message belong to a single cluster based on the determined one or more clustering attributes. A signature of a spam message is generated based on the the identified single cluster of electronic messages.