Patent ID: 7664812

Claim:
A method comprising: training an email system for determining spam, where training includes at least the following: retrieving a first email message; generating a phonetic equivalent of at least one word from a body portion of the email message; tokenizing the phonetic equivalent of the word to generate a token representative of the phonetic equivalent; tokenizing at least one word in a subject line of the first email message; tokenizing at least one simple mail transfer protocol (SMTP) email address associated with the first email message; tokenizing at least one domain name associated with the first email message; tokenizing at least one attachment of the first email message, wherein tokenizing the at least one attachment includes in generating a 128-bit MD5 hash of the attachment, appending a 32-bit length of the attachment to the, generated MD5 hash resulting in a 160-bit number, and UUencoding the resulting 160-bit number; determining a spam probability from the generated tokens; in response to a determination that the spam probability from the generated, tokens indicates that the first email message is likely spam: determining whether the, generated tokens are present in a database of tokens; in response to a determination that at least one of the generated tokens is not present in the database of tokens, assigning a probability value for each token as spam and adding the token and assigned probability value to the database of tokens; and in response to a determination that the token is present in the database of tokens, updating a probability value of the token; in response to a determination that the spam probability from the generated tokens indicates that the first email message is not likely spam; determining whether the generated tokens are present in a database of tokens; in response to a determination that at least one of the, generated tokens is not present in the database of tokens, assigning a probability value for each token indicative of non-spam and adding the token and assigned probability value to the database of tokens; and in response to a determination that the token is present in the database of tokens, updating a probability value of the token; sorting the generated tokens in accordance with the corresponding determined spam probability value; and filtering a second email message according to the training.