Spam mail judging system based on behavior analysis

Abstract

The invention discloses a spam mail judging system based on behavior analysis. The system comprises a system interface for human-machine interface operation and acquiring user behavior data in real time from an online mail system, a user behavior collection module responsible for acquiring various types of user behavior information from the system interface, performing preliminary analysis and statistics, and storing relevant results into a user behavior database through a database interface, a user creditworthiness model learning module for receiving various model parameters set by a user and the user behavior information from the user behavior database, learning user creditworthiness models and storing the learned user creditworthiness models into a user creditworthiness model base, and a user creditworthiness estimation module for estimating the creditworthiness of each user and updating an estimation result into a user creditworthiness database. In the spam mail judging system, the current mail sending behavior and historic mail sending behaviors are considered at the same time; and the manual examining quantity is reduced greatly.

Description

technical field [0001] The invention relates to the field of electronic mail systems, in particular to a spam judgment system based on behavior analysis. Background technique [0002] Spam generally refers to e-mails that include the following attributes: (1) promotional e-mails such as advertisements, electronic publications, and various forms of promotional materials that the recipient has not requested or agreed to receive in advance; (2) the recipient E-mails that cannot be rejected; (3) E-mails that hide the sender's identity, address, title and other information; (4) E-mails that contain false information sources, senders, routing and other information. [0003] Since the first spam was born, spam has become a difficult problem for mail users, and has also become an important consideration for mail operators to improve user experience and attract users. The task of anti-spam is to keep spam out of the mail system or user's inbox. The mainstream anti-spam technology i...

AI Technical Summary

Problems solved by technology

[0009] The existing anti-spam system mainly has the following deficiencies: 1) The anti-spam system based on mail content or sending behavior can only passively stop the spam that has been sent, but cannot stop the spam from the source Due to the outbreak of emails, the related systems have the disadvantages of low anti-spam efficiency and high maintenance cost. Anti-spam systems based on content or simple letter sending behavior have a large miss rate for some emails. From the point of view of the sending behavior of a single email, emails are very similar to normal emails, such as some illegal emails, etc. However, it is easy to find spam emails sent by this part of the account from the historical records of an account combined with the characteristics of the account; 2) Existing technologies such as IP blacklist and user blacklist require a large amount of manual review, and the lag is relatively serious. Currently, both IP blacklist and user blacklist are based on administrator review. This lagging review method not only requires a large number of Human resources, and for many spam accounts that are invalidated after sending a batch of spam, they cannot play the role of anti-spam, because these accounts have already completed the purpose of sending spam, and disabling the account can no longer play a role The role of anti-spam; 3) The reputation system of the source IP address has a large granularity, and it is inevitable that there will be misjudgment of some normal users of some large-traffic IPs, and due to the single source of IP feature information, etc., it cannot be timely Self-adjustment of this IP reputation; 4) the existing anti-spam technology based on image recognition technology is not strong in image deinterference, and when scanning large files such as images, it needs to consume more system resources and cannot effectively This type of spam is blocked

Images