Patent ID: 8010614

Claim:
A computer system comprising a memory storing instructions which, when executed, cause the computer system to form: a message aggregator configured to assign messages of a spam message corpus to a plurality of spam message clusters, the plurality of spam message clusters including a first and a second spam message cluster, wherein the message aggregator is configured to compute a hyperspace representation of a message of the spam message corpus, and to assign the message to a selected cluster according to a hyperspace distance between the hyperspace representation and a center of the selected cluster; a pattern extractor connected to the message aggregator and configured to, in response to assigning the messages to the plurality of spam message clusters, extract a first set of cluster-specific spam identification text patterns from members of the first spam message cluster; and a spam identification signature builder connected to the pattern extractor and configured to combine a first subset of the first set of cluster-specific spam identification text patterns into a first set of spam identification signatures for the first spam message cluster, wherein each spam identification signature of the first set of spam identification signatures includes a predetermined conjunction of at least two spam identification text patterns of the first subset of the first set of cluster-specific spam identification text patterns.