Patent Description:
As the use of electronic devices (such as a computer, a mobile telephone, a smartphone, a tablet or the like) has grown, so too has the amount of unwanted electronic messages, in the form of SMS messages and emails from banks, health centers, insurance companies, beauty salons and other companies using telemarketing in their work, among many others. Additionally, "identity thieves" or "scammers" often attempt to illicitly obtain sensitive data (such as bank account numbers, credit card data, social insurance numbers, personal data or the like).

Advertising on the Internet is one of the cheapest forms of advertising. Spam is a mass mailing of advertising or other form of information to people who have not expressed a desire to receive it. Spam includes messages sent by electronic mail, instant messaging protocols, in social networks, blogs, dating sites, forums, and also SMA and MMS messages. Spam messages have become the main and most large-scale form of advertising in the modern world, since they already account for <NUM>-<NUM>% of the total volume of global mail traffic. Such large volumes of unwanted emails creates difficulties for the email user and disrupts the operation of mail servers. In particular, such large volumes of spam lead to a deterioration in network performance.

There are two main approaches to the detection of unwanted electronic messages. A first approach uses electronic signatures and a second approach uses machine learning methods.

In the first, electronic signature approach, a mass mailing of electronic messages is broken down into parts, and signatures are created from submultiples of these. The electronic signatures may be used for the unambiguous detection of unwanted electronic messages in an electronic message exchange system (in text messages, chat room messages, control messages, commands, e-mails, documents, audiovisual files, Short Message Service messages (SMSes), voice calls (i.e., VOIP), and video calls, for example). An advantage of this approach is a high detection rate and low false positive rate. In this case, a false positive is a non-SPAM message which is incorrectly identified as SPAM. A drawback of this approach is the throughput of unwanted electronic messages (i.e., the appearance of an error of the second kind).

Another known methodology for spam detection involves the use of neural networks and similar machine learning techniques (e.g., Bayesian networks, support vector machines). A collection of unwanted electronic messages and a collection of legitimate electronic messages are used in machine learning methods. Machine learning systems are sometimes trained to recognize spam and legitimate e-mail. These approaches require that the network be trained against both spam and non-spam. A classifier may be trained by extracting characteristics of both spam and non-spam messages. An advantage of this machine learning approach is the high generalization ability, enabling a minimum throughput of unwanted electronic messages to be achieved. On the other hand, this machine learning approach has the drawback of a large number of false positives, as well as a slow detection speed as compared to the signature approach.

Therefore, there is a need to perform the task of detecting unwanted electronic messages by generalizing a signature verdict with the aid of machine learning methods.

<CIT> and <CIT> are prior art examples addressing the same problem of detecting unwanted electronic messages.

Disclosed are systems and methods for generating a signature of a spam message.

Advantageously, the task of detecting unwanted electronic messages is performed by generalizing a signature verdict with the aid of machine learning methods.

In one aspect, a method is proposed for generating a signature of a spam message. One or more classification attributes and one or more clustering attributes contained in each of at least two successively intercepted electronic messages are determined. The at least two successfully intercepted electronic messages include a first electronic message and a second electronic message. The first electronic message is classified using a trained classification model for classifying electronic messages based on the one or more classification attributes. The first electronic message is classified as spam if a degree of similarity of the first electronic message to one or more spam messages is greater than a predetermined value. A determination is made whether the first electronic message and the second electronic message belong to a single cluster based on the determined one or more clustering attributes. A signature of a spam message is generated based on the the identified single cluster of electronic messages.

In one example, an intercepted electronic message is classified as spam when the intercepted electronic message is transmitted for at least one of: commission of fraud; unsanctioned receipt of confidential information; selling of goods and services.

In one example, the trained electronic message classification model utilizes at least one of: Bayesian classifiers, logistic regression, a Markov Random Field (MRF) classifier, a support vector method, a k-nearest neighbors method, a decision tree, a recurrent neural network.

In one example, the one or more clustering attributes comprise at least one of: a sequence of words extracted from a text of the corresponding electronic message, a fuzzy hash value calculated based on the sequence of words from the text of the corresponding electronic message, a vector characterizing the text of the corresponding electronic message.

In one example, the signature of the spam message is generated based on one of: a most common sequence of words in the text of one or more electronic messages contained in the identified single cluster of electronic messages; a most common sequence of characters in the fuzzy hash values calculated based on the text of the one or more electronic messages contained in the identified single cluster of electronic messages.

In one example, the signature of the spam message is generated based on a re-identified cluster of spam messages. More spam messages are identified by using the generated signature than by using a previously generated signature.

In one example, the second electronic message identified as spam message, in reponse to determining that the one or more clustering attributes of the second electronic message contain the generated signature.

The accompanying drawings, which are incorporated into and constitute a part of this specification, illustrate one or more examples of the present disclosure and, together with the detailed description, serve to explain their principles and implementations.

Exemplary aspects are described herein in the context of a system, method, and computer program product for creating a signature of a SPAM message. Those of ordinary skill in the art will realize that the following description is illustrative only and is not intended to be in any way limiting. Other aspects will readily suggest themselves to those skilled in the art having the benefit of this disclosure. Reference will now be made in detail to implementations of the example aspects as illustrated in the accompanying drawings. The same reference indicators will be used to the extent possible throughout the drawings and the following description to refer to the same or like items.

<FIG> illustrates an example environment in which a system for electronic message exchange may interact with other devices.

As shown in <FIG> a system for electronic message exchange <NUM> may interact with a user device <NUM> via an electronic message <NUM>, which may be intercepted by an agent <NUM>. In turn, the agent <NUM> may interact with a data storage device <NUM> to store classification attributes <NUM> which may be used for training of a classification model <NUM>.

The electronic message exchange system <NUM> may comprise a multichannel communication system that may include either hardware, a combination of hardware and software, or software. In an example, the electronic message exchange system <NUM> may implement a protocol for transmitting an electronic message <NUM> between user devices <NUM>.

Examples of the electronic message exchange system <NUM> may include, but are not limited to:.

In an example, the electronic message <NUM> may have a specific structure. In addition to the message body, the electronic message <NUM> may include headers consisting of service information. The service information may include information about the route followed by the electronic message <NUM>. The headers may show details identifying timing and an originator of the electronic message <NUM>. The header portions may further identify a route by which the electronic message <NUM> has arrived, along with information added to said electronic message <NUM> by various service programs. Each header is identified by its own name and value. The value of a header may be information presented in a predetermined form. For example, if the electronic message <NUM> is an email, a header may comprise information about the sender of the electronic message <NUM>, where the "from" field constitutes the sender's name, while the value field takes the form of the sender's email address (for example, username@domain.

The user of the device <NUM> may create an electronic message <NUM> and may transmit the electronic message <NUM> to the electronic message exchange system <NUM>. Furthermore, the user of the device <NUM> may also receive an electronic message <NUM> from other devices <NUM>.

The agent <NUM> may be configured to intercept the electronic message <NUM> by at least one of:.

For example, the agent <NUM> may be implemented as a security add-on module (program component) produced by AO Kaspersky Lab (e.g., Kaspersky Internet Security).

In an example, the agent <NUM> may determine the classification attributes <NUM> contained in the intercepted electronic message <NUM>, and may transmit the determined classification attributes <NUM> to the data storage device <NUM>.

For example, the classification attributes <NUM> of an email may include, but are not limited to: header values relating to information about the message transmission route, as well as service information created by email clients, namely:.

In another example, the agent <NUM> may be configured to determine the classification attributes <NUM> of an electronic message <NUM> on the basis of an event associated with said electronic message <NUM>. For example, the classification attributes <NUM> of an instant message may include, but are not limited to:.

The data storage device <NUM> may be configured to store and process the classification attributes <NUM>. For example, the classification attributes <NUM> may be used for training the classification model <NUM>.

In an example, the data storage device <NUM> may store the classification attributes <NUM> and may be implemented as a cloud storage. Cloud storage provides an abstraction for physical storage devices. Cloud storage generally involves delivering data storage as a service, often billed on a usage basis. That is, cloud storage allows users to store and access the classification attributes <NUM> somewhere in "the cloud," without knowing the details of where files are stored or having to manage physical storage devices. In cloud storage, capacity can be available on demand and stored data can be made available on a global basis.

For example, the data storage device <NUM> may be implemented as Kaspersky Security Network (KSN) system produced by AO Kaspersky Lab.

<FIG> illustrates an example architecture of a system providing a method for creating a signature of a SPAM message.

The system providing a method for creating a signature of a SPAM message <NUM> may include an electronic message <NUM> (including 111a, 111b, 111c), an agent <NUM>, a data storage device <NUM>, classification attributes <NUM>, clustering attributes <NUM> (including 210a, 210b, 210c), a classification model <NUM>, classification module <NUM>, similarity determination module <NUM>, a signature creation module <NUM>, a signature <NUM>, and a cluster of SPAM messages <NUM>.

In one example, the classification module <NUM>, the similarity determination module <NUM> and the signature creation module <NUM> may be components of the data storage device <NUM>.

In alternative example, the classification module <NUM>, the similarity determination module <NUM> and the signature creation module <NUM> may take the form of separate, independent, but interconnected hardware devices that may be implemented by separate computer systems.

In an example, the agent <NUM> may be configured to intercept an electronic message <NUM> (including 111a, 111b, 111c), to determine the classification attributes <NUM> and the clustering attributes <NUM> (including 210a, 210b, 210c), and to transmit the classification attributes <NUM> and the clustering attributes 210a and 210b to the data storage device <NUM>.

The clustering attributes 210may include, but are not limited to:.

In an example, the data storage device <NUM> may be configured to classify the electronic message 111a, to determine whether the electronic messages 111a and 111b belong to a single cluster, and configured to create the signature <NUM>.

As noted above, the classification module <NUM>, which may be a component of the data storage device <NUM>, may be configured to classify the electronic message 111a based on classification attributes <NUM> using the classification model <NUM>. The classification model <NUM> may classify the electronic message 111a as being, at least one of:.

For example, the SPAM message may include an unsolicited electronic message <NUM> transmitted, at least, for:.

According to the present invention, the classification model <NUM> is trained in advance, using the classification attributes <NUM> transmitted to the data storage device <NUM>, in such a way that the classification model <NUM> determines, based on said attributes, the characteristics which are used for the classification of the electronic message 111a as SPAM with a given probability.

The classification model <NUM> may employ any of the following machine learning algorithms (or a combination thereof):.

For example, the classification model <NUM> may employ deep learning methods. In particular, the classification attributes <NUM> may be provided in the form of a matrix where each symbol of a classification attribute <NUM> is encoded by a fixed-length vector of numbers and may be transformed using a neural network, which may calculate the degree of similarity of said attributes to the attributes of suspect messages. The characteristics may take the form of the classification attributes <NUM> transformed by a layer of the neural network.

The classification module <NUM> may identify the electronic message 111a as unwanted (SPAM) if the degree of similarity of the electronic message 111a to SPAM messages is greater than a predetermined value (for example, greater than <NUM>).

The similarity identification module <NUM>, which may be a component of the data storage device <NUM>, may be configured to determine whether the electronic messages 111a and 111b belong to a single cluster, based on the clustering attributes 210a and 210b.

For example, the agent <NUM> may transmit to the data storage device <NUM> the determined clustering attributes 210a and 210b of corresponding electronic messages 111a and 111b, using clustering attributes <NUM> that may comprise a fuzzy hash value calculated based on a sequence of words from the text of the electronic messages 111a and 111b. In an example, the similarity determination module <NUM> may calculate the Levenshtein distance. The Levenshtein distance operates between two input strings, and returns a number equivalent to the number of substitutions and deletions needed in order to transform one input string (e.g., the first electronic message 111a) into another (e.g., the second electronic message 111b. In an example, the similarity determination module <NUM> may be configured to determine that the electronic messages 111a and 111b relate to a single cluster if said metric (Levenshtein distance) does not exceed a predetermined value.

The data storage device <NUM> may determine that the electronic messages 111a and 111b relate to a cluster of SPAM messages <NUM> if the electronic message 111a has been classified by the classification module <NUM> as SPAM, and if the similarity determination module <NUM> has determined that the electronic messages 111a and 111b belong to a single cluster.

The signature creation module <NUM>, which may be a component of the data storage device <NUM>, may be configured to generate an electronic signature <NUM> of a SPAM message, based on the cluster of SPAM messages <NUM>.

The signature <NUM> of the cluster of SPAM messages <NUM> may be generated based on at least one of the following criteria:.

In one example, the signature of a SPAM message may be generated based on a re-identified cluster of SPAM messages, in such a way that more SPAM messages can be identified by using the generated signature than by using the current signature <NUM>.

The signature creation module <NUM> may also be configured to transmit the generated signature <NUM> to the agent <NUM>, which may determine whether the clustering attributes 210b of the electronic message 111b contain the signature <NUM>. If the clustering attributes 210b of the electronic message 111b contain the signature <NUM>, the agent <NUM> may identify the electronic message 111b as an electronic message belonging to the cluster of SPAM messages <NUM>, and may be configured to provide data security.

The provision of data security may include, but is not limited to at least:.

<FIG> illustrates a method for creating a signature of a SPAM message.

At step <NUM>, the agent <NUM> may determine the attributes <NUM> of two successively intercepted electronic messages <NUM>. The attributes may include the classification attributes <NUM> and the clustering attributes <NUM>. The clustering attributes 210may include, but are not limited to: a sequence of words extracted from the text of the electronic message <NUM>, a fuzzy hash value calculated based on the sequence of words from the text of the electronic message <NUM>, a vector characterizing the text of the electronic message <NUM>.

At step <NUM>, the classification module <NUM> may employ the classification model <NUM> to classify the first electronic message <NUM> based on classification attributes <NUM>. The classification model <NUM> may employ deep learning methods. The classification module <NUM> may identify the electronic message 111a as SPAM if the degree of similarity of the electronic message 111a to SPAM messages is greater than a predetermined value.

At step <NUM>, the similarity identification module <NUM> may determine whether the first and second electronic messages <NUM> belong to a single cluster <NUM> based on the clustering attributes 210a and 210b. In an example, the similarity determination module <NUM> may be configured to determine that the electronic messages 111a and 111b belong to a single cluster if Levenshtein distance does not exceed a predetermined value. The Levenshtein distance operates between two input strings, and returns a number equivalent to the number of substitutions and deletions needed in order to transform one input string (e.g., the first electronic message 111a) into another (e.g., the second electronic message 111b).

At step <NUM>, in response to determining that the first and second messages belong to a single cluster, the signature creation module <NUM> may generate the electronic signature <NUM> of the SPAM message <NUM> based on the cluster of SPAM messages <NUM>. The signature creation module <NUM> may also be configured to transmit the generated signature <NUM> to the agent <NUM>, which may determine whether the clustering attributes 210b of the electronic message 111b contain the signature <NUM>. If the clustering attributes 210b of the electronic message 111b contain the signature <NUM>, the agent <NUM> may identify the electronic message 111b as an electronic message belonging to the cluster of SPAM messages <NUM>, and may be configured to provide data security.

<FIG> shows an example of a computer system <NUM> on which variant examples of systems and methods disclosed herein may be implemented. The computer system <NUM> may represent the data storage device <NUM> of <FIG> and can be in the form of multiple computing devices, or in the form of a single computing device, for example, a desktop computer, a notebook computer, a laptop computer, a mobile computing device, a smart phone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

As shown, the computer system <NUM> includes a central processing unit (CPU) <NUM>, a system memory <NUM>, and a system bus <NUM> connecting the various system components, including the memory associated with the central processing unit <NUM>. The system bus <NUM> may comprise a bus memory or bus memory controller, a peripheral bus, and a local bus that is able to interact with any other bus architecture. Examples of the buses may include PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I2C, and other suitable interconnects. The central processing unit <NUM> (also referred to as a processor) can include a single or multiple sets of processors having single or multiple cores. The processor <NUM> may execute one or more computer-executable code implementing the techniques of the present disclosure. The system memory <NUM> may be any memory for storing data used herein and/or computer programs that are executable by the processor <NUM>. The system memory <NUM> may include volatile memory such as a random access memory (RAM) <NUM> and non-volatile memory such as a read only memory (ROM) <NUM>, flash memory, etc., or any combination thereof. The basic input/output system (BIOS) <NUM> may store the basic procedures for transfer of information between elements of the computer system <NUM>, such as those at the time of loading the operating system with the use of the ROM <NUM>.

Examples of the present disclosure may be a system, a method, and/or a computer program product.

Computer readable program instructions for carrying out operations of the present disclosure may be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language, and conventional procedural programming languages. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a LAN or WAN, or the connection may be made to an external computer (for example, through the Internet). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

In various aspects, the systems and methods described in the present disclosure can be addressed in terms of modules. The term "module" as used herein refers to a realworld device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or FPGA, for example, or as a combination of hardware and software, such as by a microprocessor system and a set of instructions to implement the module's functionality, which (while being executed) transform the microprocessor system into a special-purpose device. A module may also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software. In certain implementations, at least a portion, and in some cases, all, of a module may be executed on the processor of a computer system. Accordingly, each module may be realized in a variety of suitable configurations, and should not be limited to any particular implementation exemplified herein.

Claim 1:
A method for generating a signature of a spam message, the method comprising:
determining (<NUM>) one or more classification attributes and one or more clustering attributes contained in successively intercepted first and second electronic messages, wherein the one or more clustering attributes comprise: a sequence of words extracted from a text of the corresponding electronic message, a fuzzy hash value calculated based on the sequence of words from the text of the corresponding electronic message and a vector characterizing the text of the corresponding electronic message;
classifying (<NUM>) the first electronic message using a trained classification model for classifying electronic messages based on the one or more classification attributes, wherein the first electronic message is classified as spam if a degree of similarity of the first electronic message to one or more spam messages is greater than a predetermined value;
determining (<NUM>) whether the first electronic message and the second electronic message belong to a single cluster based on the determined one or more clustering attributes;
generating (<NUM>) a signature of a spam message based on the identified single cluster of electronic messages.