US 12,143,358 B2
System and method for creating a signature of a spam message
Yury G. Slobodyanuk, Moscow (RU); Dmitry S. Golubev, Moscow (RU); Alexey S. Marchenko, Moscow (RU); and Alexey E. Utki-Otki, Moscow (RU)
Assigned to AO Kaspersky Lab, Moscow (RU)
Filed by AO Kaspersky Lab, Moscow (RU)
Filed on Dec. 30, 2021, as Appl. No. 17/565,570.
Claims priority of application No. RU2021106650 (RU), filed on Mar. 15, 2021.
Prior Publication US 2022/0294763 A1, Sep. 15, 2022
Int. Cl. H04L 9/40 (2022.01); G06F 18/20 (2023.01); G06F 18/2413 (2023.01); G06F 18/2415 (2023.01); G06N 3/08 (2023.01); G06N 7/02 (2006.01); H04L 51/212 (2022.01)
CPC H04L 63/0227 (2013.01) [G06F 18/24147 (2023.01); G06F 18/24155 (2023.01); G06F 18/295 (2023.01); G06N 3/08 (2013.01); G06N 7/02 (2013.01); H04L 51/212 (2022.05); H04L 63/1425 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for generating a signature of a spam message, the method comprising:
determining one or more classification attributes and one or more clustering attributes contained in intercepted first and second electronic messages;
classifying the intercepted first electronic message using a trained classification model for classifying electronic messages based on the one or more classification attributes, wherein the intercepted first electronic message is classified as spam based on a degree of similarity of the intercepted first electronic message to one or more spam messages is greater than a first predetermined value, wherein the trained classification model is trained using the one or more classification attributes to determine characteristics used for classification of electronic messages as a spam message with a given probability;
determining whether the intercepted first electronic message and the intercepted second electronic message belong to a single cluster identified based on the determined one or more clustering attributes;
generating a signature of a spam message based on the identified single cluster of electronic messages; and
in response to determining that the one or more clustering attributes of the intercepted second electronic message contain the generated signature, identifying the intercepted second electronic message as a spam message belonging to the single cluster of electronic messages.