Abstract: Identification of spam honeypot domains is performed automatically by a system. The system searches sources of Internet domains based on user input to identify Internet domains which are candidates for acting as a honeypot domain. The list of domains is refined by a determination unit to exclude domains which are unlikely to be useful. A domain indexer ranks the domains on the basis of a plurality of criteria which are indicative of the likelihood of a domain receiving spam communications.

Abstract: A method of detecting spam images in electronic objects such as emails includes compressing images extracted from the electronic object into a common representation using a lossy compression function and determining if the compressed forms of the extracted images are identical to the compressed form of any known spam image from a corpus of known spam images, which compressed forms are the known spam images compressed into the common representation using the lossy compression function. The electronic objects are signalled as embedding a spam image on the basis of a compressed form of an extracted image extracted from an electronic object being determined to be identical to the compressed form of a known spam image.

Abstract: Identification of spam honeypot domains is performed automatically by a system 1. The system 1 searches sources of Internet domains based on user input to identify Internet domains which are candidates for acting as a honeypot domain. The list 7 of domains is refined by a determination unit 8 to exclude domains which are unlikely to be useful.

Abstract: A system for identifying unknown email as spam. An extractor extracts components of email which contains pseudo-random data. This data is passed to the pattern generator which identifies the pattern descriptions found within the data. Pattern descriptions which are found to match components in a store of components from previously encountered spam emails and not in a store from previously encountered non-spam emails by the pattern generator are passed to the pattern matcher. The pattern matcher examines components of unknown email extracted by the extractor. If any component from an unknown email is found to match a pattern description known to the pattern matcher, the email is identified as spam and a signal sent to the spam output, otherwise the email is identified as non-spam and a signal sent to the non-spam output.

Abstract: A method of detecting spam images in electronic objects such as emails comprises compressing images extracted from the electronic object into a common representation using a lossy compression function and determining if the compressed forms of the extracted images are identical to the compressed form of any known spam image from a corpus of known spam images, which compressed forms are the known spam images compressed into said common representation using said lossy compression function. The electronic objects are signalled as embedding a spam image on the basis of a compressed form of an extracted image extracted from an electronic object being determined to be identical to the compressed form of a known spam image.

Abstract: A method of identifying personal names in an electronic file published on the WWW 2. The method comprises downloading the file to a computer 1, and parsing the file to divide it into individual words and identifying words or word sequences which represent candidate names. For each candidate name, the word or words making up that name are compared against a database of known false positive name entities. If the candidate name contains a known false positive name entity or entities, that name is flagged as an invalid personal name. If the candidate name does not contain a known false positive name entity or entities, the candidate name is either accepted as a personal name or further processed to check its validity.