Steve A Lewis

US Patent:

8112484, Feb 7, 2012

Filed:

May 31, 2006

Appl. No.:

11/444593

Inventors:

Vipul Sharma - Sunnyvale CA, US
Steve Lewis - San Jose CA, US

Assignee:

Proofpoint, Inc. - Sunnyvale CA

International Classification:

G06E 1/00
G06E 3/00
H04L 9/00
H04L 29/00

US Classification:

709206, 726 13, 713154, 706 20

Abstract:

A computer-implemented system and method are described for integrating a series of auxiliary spam detection models with a base spam detection model, thereby improving the accuracy and efficiency of the overall spam detection engine. For example, a system according to one embodiment of the invention comprises: a base spam filter feature extractor to detect a first set of features from incoming email messages; one or more auxiliary model feature extractors, each of the auxiliary model feature extractors to detect a different set of features from the incoming email messages; one or more auxiliary detection modules, each of the auxiliary detection modules to receive an indication of the different sets of features detected by a corresponding one of the auxiliary model feature extractor modules and to apply weights to the detected features; and a base spam filter module to receive an indication of the first set of features from the base spam filter feature extractor and the weights generated by the auxiliary detection modules, the base spam filter module to assign base spam filter weights to the first set of features and to determine whether an email message is spam based on the weights of the first set of features and the weights of the different set of features identified by the auxiliary model feature extractors.

US Patent:

8417783, Apr 9, 2013

Filed:

May 31, 2006

Appl. No.:

11/444731

Inventors:

Vipul Sharma - Sunnyvale CA, US
John Gardiner Myers - Santa Clara CA, US
Steve Lewis - San Jose CA, US

Assignee:

Proofpoint, Inc. - Sunnyvale CA

International Classification:

G06F 15/16
G06F 17/00

US Classification:

709206, 709224

Abstract:

A system and method for removing ineffective features from a spam feature set. In particular, in one embodiment of the invention, the an entropy value is calculated for the feature set based on the effectiveness of the feature set at differentiating between ham and spam. Features are then removed one at a time and the entropy is recalculated. Features which increase the overall entropy are removed and features which decrease the overall entropy are retained. In another embodiment of the invention, the value of certain type of time consuming features (e. g. , rules) is determined based on both the information gain associated with the features and the time consumed implementing the features. Those features which have relatively low information gain and which consume a significant amount of time to implement are removed from the feature set.

US Patent:

8489689, Jul 16, 2013

Filed:

May 31, 2006

Appl. No.:

11/444543

Inventors:

Vipul Sharma - Sunnyvale CA, US
Steve Lewis - San Jose CA, US

Assignee:

Proofpoint, Inc. - Sunnyvale CA

International Classification:

G06F 15/16

US Classification:

709206

Abstract:

A computer-implemented system and method are described for detecting obfuscated words in email messages and using this information to determine whether each email message is spam or valid email (ham). For example, a method according to one embodiment of the invention comprises: providing an obfuscation feature set for detecting obfuscation within email messages, the obfuscation feature set build from a group of obfuscation parameters including a similarity metric, the similarity metric using a set using a set of frequently obfuscated words (FOW) selected from a larger set of obfuscated words; analyzing an email message to detect whether the email message contains features within the obfuscation feature set, wherein the analysis includes determining the similarity of one or more words in the email message with each of the FOWs; generating the similarity metric based on the analysis, the similarity metric providing a relative likelihood that each of the one or more words is obfuscated; firing one or more of the obfuscation detection features based, at least in part, on the value of the similarity metric; analyzing the email message to detect whether the email contains one or more additional spam features unrelated to obfuscation; and determining whether the email message is spam based on the combined obfuscation detection features and the additional spam features.