Patent Document ID: 9083556
Application ID: 11850340
Patent Status: 1

Claim One:
1. A system for detecting malicious e-mails from spam sources, the system comprising: a processor operable to implement a first layer of spam filtering, the first layer of spam filtering comprising the steps of processing a sending server identification value of a sending source by separating the sending server identification value into one or more domain level terms to allow each unique term to be tokenized with an index value and applying the one or more tokenized values as a learning feature in a learning algorithm trained to identify spam sources; the processor further being operable to perform a second layer of spam filtering, on any emails that are not identified as spam by the first layer of spam filtering, the second layer of spam filtering comprising the steps of implementing a reverse DNS lookup based on an IP address of the sending source to determine a domain name associated with the IP address of the sending source, and comparing the domain name associated with the IP address of the sending source with the sending server identification value to determine if the domain name associated with the IP address of the sending source matches the sending server identification value; and the processor further being operable to perform a third layer of spam filtering, on any emails that are not identified as spam by the first and second layers of spam filtering, the third layer of spam filtering comprising the steps of implementing content filtering to detect spam based on email content; and providing feedback from the second and third layers of spam filtering to the learning algorithm of the first layer of spam filtering to enable the learning algorithm of the first layer of spam filtering to learn sending server identification values of sources that are sending spam; wherein the first, second, and third layers of spam filtering are applied sequentially such that the first layer of spam filtering is applied first, only email not identified by the first layer as spam is filtered by the second layer of spam filtering, and then only email not identified as spam by the second layer is filtered by the third layer of spam filtering, to minimize the number of email messages which are processed by the content filtering layer of spam filtering.