Abstract: Disclosed are systems, methods and computer program products for detection of spam. In one example, a system receives electronic messages and attempts to classify the messages as legitimate or spam messages. For an unknown message, the system obtains its metadata including hash sum of the message and sender's IP address. The system then places the metadata of the unknown messages into one cluster of a plurality of clusters based on degree of similarity between hash sums of different unknown messages. The system then rates each unknown message in accordance with a rating of the cluster, wherein the rating of the cluster is based, at least, on a number of similar hash sums of unknown messages received from different addresses of message senders contained in said cluster. Finally, the system classifies unknown messages as legitimate or spam based on the message rating.

Abstract: A method, and computer program product for updating botnets are described. A statistical method for analyzing the hosts that send out SPAM and updating botnets is provided. The proposed method uses the fact that a computer in a botnet has to distribute content using the activity patterns closely resembling the distribution patterns of other computers in the same botnet over the same time period. The distribution statistical data obtained for different sources are compared using approximation of graphical data. Based on comparison it is determined whether the computer belongs to a botnet and the botnet is updated accordingly.

Abstract: A method, system and computer program product for tracking and isolating botnets are described. A statistical method for tracking botnets is provided. The proposed method uses the fact that a computer in a botnet has to distribute content which resembles to some degree the content distributed by the other computers in the same botnet over same time period. The size of the messages sent by a particular computer over particular period of time can be tracked. The resulting distribution of message numbers by size is, then, associated with that computer. The distribution statistical data obtained for different sources are then compared using approximation of graphical data. Based on comparison it is determined whether the computer belongs to a botnet.