Patent ID: 11929969
Assignee: AO KASPERSKY LAB
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 12:
13. A non-transitory computer readable medium storing thereon computer executable instructions for identification of spam emails, including instructions for:
receiving an email at a client device;
determining a signature of the email;
comparing the determined signature with a plurality of spam signatures stored in a database; and
in response to determining that no match exists between the determined signature and the plurality of spam signatures:
placing the email in quarantine;
extracting a sequence of headers of the email;
determining a degree of similarity between known spam emails and the email, using a machine learning method configured to generate the degree of similarity based on the sequence of headers;
determining an amount of time to keep the email in quarantine, wherein the amount of time is proportional to the degree of similarity;
in response to determining that the degree of similarity between the spam emails and the email does not exceed a threshold, removing the email from the quarantine; and
in response to determining that the degree of similarity between the spam emails and the email exceeds the threshold and the amount of time to keep the email in quarantine has not expired, transferring the email from the quarantine to a spam repository such that the email is inaccessible to a user of the client device, wherein the spam repository is on a server different from the server being used for quarantining emails, and adding the signature of the email to the plurality of spam signatures stored in the database.