DETECTING UNWANTED ELECTRONIC MAIL MESSAGES BASED ON PROBABILISTIC ANALYSIS OF REFERENCED RESOURCES

摘要

In one embodiment, detecting unwanted electronic mail messages based onprobabilistic analysis of referenced resources comprises receiving a whitelistand a blocklist each having a plurality of network resource identifiers thathave appeared in prior messages; retrieving a particular network resourceidentifier; generating a list of properties for the particular networkresource identifier; training a probabilistic filter using the properties; andrepeating the retrieving, generating and training for all the network resourceidentifiers in the whitelist and blocklist. Thereafter, when an electronicmail message is received and contains a URL or other network resourceidentifier, a spam score or threat score can be generated for the message bytesting properties of the network resource identifier using the trainedprobabilistic filter.