Abstract: A system includes at least one router for routing email messages from a sender node to a destination node; a system memory; a network interface; a database; and a processor configured for: extracting the delivery path information from the email message; determining a network path for the email message using delivery path information; comparing the delivery path information with the plurality of prior delivery paths; determining a measure of similarity between the network path of the received email message and one or more of the plurality of prior email paths; and determining a spam score for the email received, based on the measure of similarity.

Abstract: A method includes steps of receiving an email message comprising a plurality of packets and delivery-path information; determining a path for the email using the delivery-path information; comparing the path with a plurality of prior email paths; determining a measure of similarity between the path of the email received and one or more of the plurality of prior email paths; and determining a spam score for the email received, based on the measure of similarity. Other embodiments include a computer readable medium comprising computer code for performing the above function and an information processing system including a processor configured (i.e., hard-wired or programmed) to perform the method.

Abstract: A method includes steps of receiving an email message comprising a plurality of packets and delivery-path information; determining a path for the email using the delivery-path information; comparing the path with a plurality of prior email paths; determining a measure of similarity between the path of the email received and one or more of the plurality of prior email paths; and determining a spam score for the email received, based on the measure of similarity. Other embodiments include a computer readable medium comprising computer code for performing the above function and an information processing system including a processor configured (i.e., hard-wired or programmed) to perform the method.

Abstract: A method for detecting undesirable e-mails is disclosed. The method includes collecting a plurality of undesirable e-mails, arranging the plurality of undesirable e-mails into a plurality of groups and generating, for each group, at least one token, thereby producing a plurality of tokens for the plurality of undesirable e-mails. The method further includes receiving a first e-mail and generating at least one token for the first e-mail. The method further includes causing a comparison of the at least one token for the first e-mail with at least one of the plurality of tokens for the plurality of undesirable e-mails and identifying the first e-mail as an undesirable e-mail if the at least one token for the first e-mail matches any of the plurality of tokens for the plurality of undesirable e-mails.