Patent ID: 7555523

Claim:
A computer implemented method for detecting spam by extracting generalized Ngrams from a section of an e-mail, the method comprising the steps of: a spam manager extracting a sequence of characters from a section of an e-mail; the spam manager iterating subsequences within the sequence; the spam manager comparing the subsequences to collections of spam-distinguishing subsequences to identify spam e-mail messages, the collections comprising a spam dictionary of Ngrams that are commonly found in spam e-mail and a non-spam dictionary of Ngrams that are commonly found in non-spam e-mail, each Ngram in each dictionary having a weight value associated with it, the weight value in the spam dictionary representing the relative occurrence frequency of the Ngram in spam e-mail and the weight value in the non-spam dictionary representing the relative occurrence frequency of the Ngram in non-spam e-mail, wherein the comparing step comprises: the spam manager searching one or more of the dictionaries for Ngrams matching the subsequences; the spam manager retrieving the weight value for matching Ngrams that are found; and the spam manager combining the retrieved weight values using a discrimination function to measure the likelihood that an e-mail is spam; and the spam manager producing a spam detection decision, based on the comparison, regarding whether or not the e-mail is likely to be a spam e-mail message.