Abstract: Systems and methods for filtering fraudulent email messages are described. In one embodiment, a method includes receiving an email message, determining whether the email message is indicative of fraud, and creating a fraud filter based on the email message if the email message is fraudulent.

Abstract: A method and system for creating bulk filters are described. In one embodiment, the method includes receiving probe email messages indicative of spam, grouping similar probe email messages, and creating a bulk filter for each group having at least a predefined number of probe email messages without human interaction. The method further includes distributing the resulting bulk filters to clients for detection of bulk email messages at the clients.

Abstract: A method and system to maintain lists of IP addresses for detection of email spam are described. In one embodiment, the method includes receiving email messages from senders associated with Internet Protocol (IP) addresses, filtering the email messages to identify spam, and sending statistics pertaining to the email messages and the identified spam to a server. The method further includes receiving, from the server, IP address lists generated based on the statistics, and filtering new email messages using the IP address lists. The IP address lists received from the server may include a list of safe IP addresses, a list of suspect IP addresses and a list of open proxy IP addresses.

Abstract: A similarity measurement manager uses n-gram analysis to identify spam email messages. The similarity measurement manager tokenizing an email message into a plurality of overlapping n-grams, wherein n is large enough to identify uniqueness of artifacts. The similarity measurement manager employs feature selection by comparing the created n-grams to n-grams of known artifacts which were created according to the same methodology. Created n-grams that match an n-gram of a known artifact are ignored. The similarity measurement manager compares the remaining created n-grams to pluralities of n-grams of known spam email messages, the n-grams of the known spam email messages being themselves created by executing the same steps. The similarity measurement manager determines whether the email message comprises spam based on whether or not the n-gram comparison indicates that it is substantially similar to a known spam email message.

Abstract: A method and system for grouping spam email messages are described. In one embodiment, the method includes receiving probe email messages indicative of spam and modifying the probe email messages to reduce noise. The method further includes comparing the probe email messages using fuzzy logic to identify similar email messages, and creating groups of similar email messages. Each of the created groups pertains to a distinct spam attack.

Abstract: A method and system to maintain lists of IP addresses for detection of email spam are described. In one embodiment, the method includes receiving email messages from senders associated with Internet Protocol (IP) addresses, filtering the email messages to identify spam, and sending statistics pertaining to the email messages and the identified spam to a server. The method further includes receiving, from the server, IP address lists generated based on the statistics, and filtering new email messages using the IP address lists. The IP address lists received from the server may include a list of safe IP addresses, a list of suspect IP addresses and a list of open proxy IP addresses.