Abstract: Translation of text or messages provides a message that is more reliably or efficiently analyzed for purposes as, for example, to detect spam in email messages. One translation process takes into account statistics of erroneous and intentional misspellings. Another process identifies and removes characters or character codes that do not generate visible symbols in a message displayed to a user. Another process detects symbols such as periods, commas, dashes, etc., interspersed in text such that the symbols do not unduly interfere with, or prevent, a user from perceiving a spam message. Another process can detect use of foreign language symbols and terms. Still other processes and techniques are presented to counter obfuscating spammer tactics and to provide for efficient and accurate analysis of message content. Groups of similar content items (e.g., words, phrases, images, ASCII text, etc.

Abstract: Methods and systems for analyzing email messages are provided. In an embodiment, a method includes determining whether a received email message is considered to be the same as one or more prior email messages already classified into one of a plurality of different categories. If the received message is not considered to be the same as one of the prior email messages already classified into one of the categories, then the received message is classified into one of the categories by performing a set of computations. If the received message is considered to be the same as one of the prior email messages already classified into one of the categories, then the received message is classified into one of the categories without performing the computations, by classifying the received message into the same category as a prior email message that the received message is considered to be the same as.

Abstract: Provided herein are systems and methods for suppressing delivery of undesirable messages through vulnerable systems. In an embodiment, a system include an emulator emulates one or more vulnerable systems that can be used by spammers to relay, forward or otherwise send undesirable email messages to target systems. The system also includes one or more modules associated with the emulator and configured to automatically identifying, as being undesirable, email messages that are to be relayed, forwarded or otherwise sent to target systems via at least one of the one or more vulnerable systems emulated by the emulator.

Abstract: Methods and systems for analyzing email messages are provided. In an embodiment, a method includes determining whether a received email message is considered to be the same as one or more prior email messages already classified into one of a plurality of different categories. If the received message is not considered to be the same as one of the prior email messages already classified into one of the categories, then the received message is classified into one of the categories by performing a set of computations. If the received message is considered to be the same as one of the prior email messages already classified into one of the categories, then the received message is classified into one of the categories without performing the computations, by classifying the received message into the same category as a prior email message that the received message is considered to be the same as.

Abstract: Provided herein are systems and methods for suppressing delivery of undesirable messages through vulnerable systems. In an embodiment, a system include an emulator emulates one or more vulnerable systems that can be used by spammers to relay, forward or otherwise send undesirable email messages to target systems. The system also includes one or more modules associated with the emulator and configured to automatically identifying, as being undesirable, email messages that are to be relayed, forwarded or otherwise sent to target systems via at least one of the one or more vulnerable systems emulated by the emulator.

Abstract: Multiple modules are provided, each one of which is configured to analyze email messages in a different manner than other ones of the modules. For a received email message, a plurality of the modules are used to determine one or more module outputs indicative of a level of sameness of the received email message with one or more prior email messages. At least two of the modules being used are each assigned a non-zero weight indicative of the performance level of the module. An overall level of sameness of the received email message with one or more prior email messages is determined by combining the module outputs of at least two of the plurality of modules using the non-zero weights assigned to the modules.

Abstract: A system for suppressing delivery of undesirable messages through vulnerable systems. The system includes an emulator that emulates one or more of the vulnerable systems. A module associated with the emulator intercepts undesirable messages, which were originally intended to be sent through a vulnerable system. One embodiment includes plural emulators, which include one or more servers that are part of a network of servers. A controller communicates with one or more servers. In this embodiment, the controller includes a database capable of storing statistics pertaining to undesirable messages blocked by one or more of the servers. The statistics may include information pertaining to the sender(s) of the undesirable messages. Undesirable messages intercepted by the network of servers include email spam.

Abstract: Translation of text or messages provides a message that is more reliably or efficiently analyzed for purposes as, for example, to detect spam in email messages. One translation process takes into account statistics of erroneous and intentional misspellings. Another process identifies and removes characters or character codes that do not generate visible symbols in a message displayed to a user. Another process detects symbols such as periods, commas, dashes, etc., interspersed in text such that the symbols do not unduly interfere with, or prevent, a user from perceiving a spam message. Another process can detect use of foreign language symbols and terms. Still other processes and techniques are presented to counter obfuscating spammer tactics and to provide for efficient and accurate analysis of message content. Groups of similar content items (e.g., words, phrases, images, ASCII text, etc.

Abstract: A system for suppressing delivery of undesirable messages through vulnerable systems. The system includes an emulator that emulates one or more of the vulnerable systems. A module associated with the emulator intercepts undesirable messages, which were originally intended to be sent through a vulnerable system. One embodiment includes plural emulators, which include one or more servers that are part of a network of servers. A controller communicates with one or more servers. In this embodiment, the controller includes a database capable of storing statistics pertaining to undesirable messages blocked by one or more of the servers. The statistics may include information pertaining to the sender(s) of the undesirable messages. Undesirable messages intercepted by the network of servers include email spam.

Abstract: Multiple modules are provided, each one of which is configured to analyze email messages in a different manner than other ones of the modules. For a received email message, a plurality of the modules are used to determine one or more module outputs indicative of a level of sameness of the received email message with one or more prior email messages. At least two of the modules being used are each assigned a non-zero weight indicative of the performance level of the module. An overall level of sameness of the received email message with one or more prior email messages is determined by combining the module outputs of at least two of the plurality of modules using the non-zero weights assigned to the modules.

Abstract: Translation of text or messages provides a message that is more reliably or efficiently analyzed for purposes as, for example, to detect spam in email messages. One translation process takes into account statistics of erroneous and intentional misspellings. Another process identifies and removes characters or character codes that do not generate visible symbols in a message displayed to a user. Another process detects symbols such as periods, commas, dashes, etc., interspersed in text such that the symbols do not unduly interfere with, or prevent, a user from perceiving a spam message. Another process can detect use of foreign language symbols and terms. Still other processes and techniques are presented to counter obfuscating spammer tactics and to provide for efficient and accurate analysis of message content. Groups of similar content items (e.g., words, phrases, images, ASCII text, etc.

Abstract: A system for suppressing delivery of undesirable messages through vulnerable systems. The system includes an emulator that emulates one or more of the vulnerable systems. A module associated with the emulator intercepts undesirable messages, which were originally intended to be sent through a vulnerable system. One embodiment includes plural emulators, which include one or more servers that are part of a network of servers. A controller communicates with one or more servers. In this embodiment, the controller includes a database capable of storing statistics pertaining to undesirable messages blocked by one or more of the servers. The statistics may include information pertaining to the sender(s) of the undesirable messages. Undesirable messages intercepted by the network of servers include email spam.

Abstract: Similarity of email message characteristics is used to detect bulk and spam email. A determination of “sameness” for purposes of both bulk and spam classifications can use any number and type of evaluation modules. Each module can include one or more rules, tests, processes, algorithms, or other functionality. For example, one type of module may be a word count of email message text. Another module can use a weighting factor based on groups of multiple words and their perceived meanings. In general, any type of module that performs a similarity analysis can be used. A preferred embodiment of the invention uses statistical analysis, such as Bayesian analysis, to measure the performance of different modules against a known standard, such as human manual matching. Modules that are performing worse than other modules can be valued less than modules having better performance. In this manner, a high degree of reliability can be achieved.