Methods and apparatus for identifying spam email

摘要

Methods and apparatus of classifying received email are provided. At least one initial desirability scan is performed on a received email. When the received email passes the at least one initial desirability scan, it is determined if the received email comprises one or more browser-interpretable scripts. When the received email comprises one or more browser-interpretable scripts, a secondary desirability scan is performed on the received email as a function of the one or more browser-interpretable scripts. The received email is identified as undesirable email when the received email fails the at least one initial desirability scan, or the received email fails the secondary desirability scan. The received e-mail is identified as desirable email when the received email does not comprise one or more browser-interpretable scripts or the received email passes the secondary desirability scan.

主权项

1. A method of classifying received electronic mail (email) comprising the steps of:
performing at least one initial desirability scan on one or more uniform resource locators (URLs) in a received email, wherein the at least one initial desirability scan focuses on one or more domain names or one or more Internet Protocol addresses associated with the one or more URLs; determining if the received email comprises one or more non-HTML browser-interpretable scripts when the received email passes the at least one initial desirability scan, wherein any non-HTML browser-interpretable scripts contained in the received email are separate from the one or more URLs scanned in the at least one initial desirability scan; performing a secondary desirability scan on the received email as a function of the one or more non-HTML browser-interpretable scripts when the received email comprises one or more non-HTML browser-interpretable scripts, wherein the secondary desirability scan is adapted to emulate one or more end user actions via a simulated invocation of the one or more non-HTML browser-interpretable scripts contained in the received email, and wherein the simulated invocation of the one or more non-HTML browser-interpretable scripts is adapted to uncover at least one target domain camouflaged within the received email by inclusion of extraneous content within the received email; identifying the received email as undesirable email when the received email fails the at least one initial desirability scan, or the received email fails the secondary desirability scan; and identifying the received email as desirable email when the received email does not comprise one or more non-HTML browser-interpretable scripts or the received email passes the secondary desirability scan.