(51) Int Cl.: H04L 12/58 ( )

Transcription

1 (19) TEPZZ Z 88Z6B_T (11) EP B1 (12) EUROPEAN PATENT SPECIFICATION (4) Date of publication and mention of the grant of the patent: Bulletin 14/1 (1) Int Cl.: H04L 12/8 (06.01) (21) Application number: (22) Date of filing: (4) Bayesian surety check to reduce false positives in filtering of content in non-trained languages Bayes-Sicherheitsüberprüfung zur Reduzierung falscher Positive bei der Filterung von Inhalt in nichtgeübten Sprachen Vérification de sécurité bayésienne pour réduire des faux positifs dans le filtrage de contenu dans des langues non formées (84) Designated Contracting States: DE FR GB () Priority: US (43) Date of publication of application: Bulletin 09/09 (73) Proprietor: Symantec Corporation Mountain View, CA 943 (US) (72) Inventor: Cooley, Shaun El Segundo CA 9024 (US) (74) Representative: Zimmermann, Tankred Klaus et al Schoppe, Zimmermann Stöckeler & Zinkler & Partner Patentanwälte Postfach Pullach bei München (DE) (6) References cited: US-A US-B GUOQING MO ET AL: "Multi-agent Interaction Based Collaborative P2P System for Fighting Spam" INTELLIGENT AGENT TECHNOLOGY, 06. IAT 06. IEEE/WIC/ACM INTERNA TIONAL CONFERENCE ON, IEEE, PI, 1 December 06 ( ), pages , XP0293 ISBN: VIVEK CHANDRA ET AL: "Ways to Evade Spam Filters and Machine Learning as a Potential Solution" COMMUNICATIONS AND INFORMATION TECHNOLOGIES, 06. ISCIT 06. INT ERNATIONAL SYMPOSIUM ON, IEEE, PI, 1 October 06 (06--01), pages , XP ISBN: CARPINTER ET AL: "Tightening the net: A review of current and next generation spam filtering tools" COMPUTERS & SECURITY, ELSEVIER SCIENCE PUBLISHERS. AMSTERDAM, NL, vol. 2, no. 8, 21 November 06 ( ), pages 66-78, XP ISSN: EP B1 Note: Within nine months of the publication of the mention of the grant of the European patent in the European Patent Bulletin, any person may give notice to the European Patent Office of opposition to that patent, in accordance with the Implementing Regulations. Notice of opposition shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention). Printed by Jouve, 7001 PARIS (FR)

2 Description Technical Field [0001] This invention pertains generally to Bayesian filtering of electronic content, and more specifically to utilizing a surety check in Bayesian spam filtering to reduce false positives when processing s in non-trained languages. Background Art [0002] Current statistical spam detection techniques rely heavily on their ability to find known words during classification of electronic messages. The authors of spam s have become aware of this, and often include nonsense words in their messages. The use of nonsense words to spoof spam detection takes two primary forms. The first is the insertion of a small number (e.g., one or two) of nonsense words into s. This is used to thwart simple hash detection of duplicate copies of a single message being sent to many users at one internet service provider. By inserting different nonsense words into each copy of the message, simple hash detection routines are not able to determine that the messages are duplicates. This form of nonsense word insertion is referred to as a "hash buster." The second form consists of inserting a larger number of nonsense words into s, where the words as a group cause misclassification of the overall message. [0003] Spam classification engines analyze the content of messages and attempt to determine which s are spam based on various statistical techniques, such as Bayesian analysis. Bayesian spam filtering is based on established probabilities of specific words appearing in spam or legitimate . For example, the nonsense words described above, as well as certain words such as "Viagra", "Refinance", "Mortgage" etc, frequently appear in spam, and yet rarely or less frequently appear in legitimate . Thus, the presence of such terms increases the probability of an being spam. A Bayesian spam classification engine has no inherent knowledge of these probabilities, but instead establishes them by being trained on a set of messages. [0004] When classifying documents using a statistical method, such as the Bayesian method, the classifications output is only as good as the input. This leads to a problem when a statistical classifier is presented with a message in a language in which the classifier was not trained (for example, when a classifier trained in English is attempting to classify a German document). More specifically, it has become common for spammers to insert words or phrases in foreign languages in spam s, as opposed to or in addition to nonsense words. This often results in certain common foreign language words (e.g., "el", "los", "der", "die", "und", etc.) becoming associated with spam by classification engines. Because these words appear in many spam s but virtually no legitimate s written in English, a Bayesian classification engine trained on an English language data set will interpret their presence in an message is a strong indication of the message comprising spam. [000] In the past, the issue of content in a non-trained language has been addressed in two different ways. One solution is to use a secondary classifier that is capable of determining the language of a document. The input to the Bayesian spam filter is then limited to content in languages on which it has been trained. The second solution is for the Bayesian filter to attempt to classify every document, regardless of language. [0006] The first solution is expensive, both in terms of dollars and computing efficiency. In order to classify each document by language, expensive language classification engines must be licensed or built simply to determine if a spam engine should inspect an incoming message. Furthermore, classifying each incoming with an additional engine is time consuming, and slows down the spam filtering process. [0007] In the context of spam, the later solution typically leads to extremely high false positive rates when filtering s in languages on which the Bayesian filter has not been trained. As noted above, very common words in nontrained foreign languages were likely prevalent in the training data in spam only. For example, when training on an English set, words like "und" and "der" appear frequently in spam and almost never in legitimate . However, when processing German , these words appear in almost every message, whether spam or legitimate. Thus, a classifier trained in English but not German would classify all or most German messages as spam. [0008] It would be desirable to be able to avoid such an excessive false positive rate when processing content in a language on which the Bayesian filter has not been trained, without having to use an expensive secondary classifier that is capable of determining the language of a document. US 0/ A1 describe a method for analyzing an electronic communication. The method includes detecting one or more regions of imagery in a received electronic communication and applying pre-processing techniques to locate regions (e.g., blocks or lines) of text in the imagery that may be distorted. The method then analyzes the regions of text to determine whether the content of the text indicates that the electronic communication is spam. [0009] US 7,089,241 B1 describes a probabilistic classifier used to classify data items in a data stream. The probabilistic classifier is trained, and an initial classification threshold is set, using unique training and evaluation data sets. Unique data sets are used for training and in setting the initial classification threshold so as to prevent the classifier from being 2

3 improperly biased as a result of similarity rates in the training and evaluation data sets that do nct reflect similarity rates encountered during operation. [00] GUOQING MO ET AL: "Multi-agent Interaction Based Collaborative P2P System for Fighting Spam" INTELLI- GENT AGENT TECHNOLOGY, 06. IAT 06. IEEE/WIC/ACM INTERNATIONAL CONFERENCE ON, IEEE, PI, 1 December 06 ( ), pages , and VIVEK CHANDRA ET AL: "Ways to Evade Spam Filters and Machine Learning as a Potential Solution" COMMUNICATIONS AND INFORMATION TECHNOLOGIES, 06. ISCIT 06. IN- TERNATIONAL SYMPOSIUM ON, IEEE, PI, 1 October 06 (06--01), pages , describe further approaches for realizing spam filter. Summary 1 [0011] It is an object of the invention to provide an improved approach for reducing false classifications during Bayesian filtering. [0012] This object is achieved by a method of claim 1, a computer program product of claim 7, and a system of claim 13. [0013] Special processing allows vastly improved Bayesian spam filtering of messages in foreign languages. A Bayesian spam filter determines an amount of content in incoming messages that it knows from training. If the filter is familiar with a threshold amount of the content, then the filter proceeds to classify the message as being spam or legitimate. On the other hand, if not enough of the words in the are known to the filter from training, then the filter cannot accurately determine whether or not the message is spam. This will generally be the case when the message is written in a language for which the filter was not trained. In this case, the filter classifies the message as being of type unknown. Different threshold metrics can be used as desired, such as the percentage of words in an that are known, and the percentage of a maximum correction value that was used during Bayesian processing of an . 2 Brief Description of the Drawings [0014] Figure 1 is a block diagram illustrating a system in which a surety check is utilized in Bayesian spam filtering to reduce false positives when processing s in non-trained languages, according to some embodiments of the present invention. Detailed Description [001] Figure 1 illustrates a system 0 in which a surety check is utilized in Bayesian spam filtering to reduce false positives when processing s in non-trained languages, according to some embodiments of the present invention. It is to be understood that although various components are illustrated in Figure 1 as separate entities, each illustrated component represents a collection of functionalities which can be implemented as software, hardware, firmware or any combination of these. Where a component is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, as a kernel loadable module, as one or more device drivers or as one or more statically or dynamically linked libraries. [0016] As illustrated in Figure 1, a Bayesian spam filter 1 receives incoming messages 3. The implementation mechanics of a standard Bayesian spam filter 1 are known to those of ordinary skill in the relevant art, and the usage thereof within the context of the present invention will be readily apparent to one of such a skill level in light of this specification. During the process of utilizing Bayesian methodology to review incoming s 3, the Bayesian spam filter 1 analyzes the content of these messages 3. Above and beyond standard Bayesian processing, the Bayesian spam filter 1 performs a surety check on the incoming s 3. A surety check herein refers to an analysis to determine whether more than a threshold 7 amount of the content is known. For example, to perform a surety check on an incoming message 3, the Bayesian spam filter 1 analyzes the content of that message 3, and determines which words therein are known to the Bayesian spam filter 1, from the data on which it has been trained. In other words, if a specific word was encountered by the Bayesian spam filter 1 during its training and associated with a categorization probability, then that word is known. If a word has not been encountered by the Bayesian spam filter 1 during training and is thus not associated with given probabilities, that word is not known. As described in greater detail below, the amount of unknown content in an 3 assists the Bayesian spam filter 1 in categorizing that 3. [0017] More specifically, if more than a threshold 7 amount of the content of the 3 is not known, the Bayesian spam filter 1 classifies the document as being of an unknown 6 type. In other words, because too much of the content is not known to the filter 1, it cannot reliably categorize the 3 as being spam 2 or legitimate 4. Since the filter 1 has not been trained on enough of the words in the 3, it cannot draw reliable conclusions 3

4 1 2 as to the nature of the 3 based on its probability data concerning the words it does know. On the other hand, if Bayesian spam filter 1 determines that less than a threshold 7 amount of the content of the 3 is known, then the filter 1 has enough information to perform a standard Bayesian probability classification of the document. [0018] For example, if a Bayesian spam filter 1 has been trained on an English set but not a German one, the filter 1 will falsely classify all or most German 3 as spam 2, because most German words are unknown to the filter 1, whereas a few common German words (e.g., the definite article and common conjunctions) are associated with a high probability of spam 2, as they were present only in spam 2 in the English language training data. The surety check will flag the fact that the filter 1 does not know most of the words in the German language , and thus that rather than comprising spam 2 it comprises unknown content, about which the filter 1 cannot draw a conclusion. On the other hand, English language spam 2 containing a few German words will still be flagged as spam 2, because the filter 1 will know most of the (English) words in the 3, and hence substantively categorize the 3. [0019] Various forms of surety checks can be performed according to different embodiments of the present invention. In one embodiment, the filter 1 simply calculates the percentage of words in an incoming message 3 that are known from Bayesian filter training. In that embodiment, the filter 1 proceeds to substantively categorize the 3 only if a requisite amount of the content is known. It is of course to be understood that the threshold 7 to use is a variable design parameter. In one embodiment, 8% is used as a known word threshold 7, although other values are used in other embodiments (e.g., 80%, 90%, 9% etc.) [00] In some embodiments, the surety check used for an message 3 is the percentage of a maximum correction value 111 utilized during the Bayesian filtering of the message 3. In order to understand correction generally and maximum correction specifically, note first that in Bayesian filtering, a special probability value is used by the filter 1 for words which were not encountered during training. Without adjustment, the presence of one or more words in an 3 not encountered during training would disproportionately influence the Bayesian classification of that 1. For this reason, Bayesian processing can use a default probability for such a word. Such a default probability is used in many embodiments of the present invention, including but not limited to those which employ a percentage of maximum correction 111 used as a surety check. [0021] The default probability to use during Bayesian processing for words not encountered in training is referred to herein as the zero count 9. The zero count 9 can be calculated in different ways in different embodiments of the present invention as desired. In one embodiment, the zero count 9 is calculated according to the formula in Table 1 below, wherein TotalWords represents the number of words from the training set: 3 4 [0022] Continuing with the explanation of correction, note that in Bayesian classification generally, when classifying a list of words (e.g., the words in an 3) each category (e.g., spam 2 and legitimate 4) is given a raw score by calculating the sum of P(Category 1 Word) (that is, the probability that the document is of Category given the occurrence of Word) for each word in the list. During this step, an error (correction) value 113 can also be calculated which can be used to prevent a single word from overpowering the rest of the words in the document (e.g., the message 3). Such a correction value 113 is used in many embodiments of the present invention. [0023] The correction value 113 can be calculated in different ways as desired. In some embodiments of the present invention, the correction value is calculated according to the mathematics in Table 2 below: 0 4

5 [0024] Continuing with the discussion of maximum correction, in some embodiments the Bayesian filter 1 calculates the greatest possible correction 111 that could occur for a given message 3. This can be calculated in different ways as desired. In some embodiments of the present invention, the maximum correction value 111 for an message 3 is calculated according to the formula in Table 3 below: [002] Finally, the amount of the maximum correction actually used 11 can then be calculated by dividing the Correction 113 (e.g., as calculated according to Table 2) by CorrectionMax 111 (e.g., as calculated according to Table 3). It is this result 11 that is used in some embodiments of the invention during the surety check as a threshold 7 metric. Of course, the specific threshold 7 to use is a variable design parameter. In some embodiments, if the correction used 11 in greater than 9% of the maximum, the filter 1 adjutacates the as being of type unknown 6. Other threshold 7 values are also possible (e.g., > 98%, > 90% etc.) [0026] In some embodiments of the present invention, multiple threshold 7 metrics are examined by the filter 1. For example, in one embodiment, the Bayesian filter 1 only adjudicates an as being of type unknown 6 if a) less than 1% of the words in the are known and b) the correction used 11 by the Bayesian filter 1 on the 3 was greater than 9% of the maximum 111. Other specific threshold 7 values and metrics can be used in other embodiments as desired. [0027] The use of a surety check within the context of a Bayesian spam filter 1 works very well. It also adapts very quickly to additional training executed at a deployment point, thus allowing a publisher to ship an anti-spam product after only training it on English language messages 3. As the product is used in an environment based on a non-trained language, the Bayesian filter 1 quickly becomes trained on that language (e.g., via auto outbound training and reclassification of inbound messages 3), and thus the surety check no longer declares s written in those language as being of type unknown 6. [0028] The present invention also allows anti-spam solutions to be rapidly deployed in regions for which training data is not available. In addition, the present invention allows a publisher of anti-spam software to save money by not licensing expensive language classification engines simply to determine if a spam engine should inspect a message 3. [0029] It is to be further understood that although this specification has been discussing classifying messages 3 as spam 2, legitimate 4 or unknown 6, the present invention is in no way so limited. Although spam classification is a great use for the present invention, it can be utilized within the context of the Bayesian classification of any document type into any number of appropriate categories. [00] As will be understood by those familiar with the art, the invention may be embodied in other specific forms. Likewise, the particular naming and division of the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Furthermore, as will be apparent to one of ordinary skill in the relevant art, the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects of the invention can be implemented as software, hardware, firmware or any combination of the three. Of course, wherever a component of the present invention is implemented as software, the component can be implemented as a script, as a standalone program, as part of a larger program, as a plurality of separate scripts and/or programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of skill in the art of computer programming. Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Furthermore, it will be readily apparent to those of ordinary skill in the relevant art that where the present invention is implemented in whole or in part in software, the software components thereof can be stored on computer readable media as computer program products. Any form of computer readable medium can be used in this context, such as magnetic or optical storage media. Additionally, software portions of the present invention can be instantiated (for example as object code or executable images) within the memory of any programmable computing device. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims. Claims 1. A computer implemented method for reducing false classifications as spam or legitimate during Bayesian filtering, the method characterized by the steps of:

6 training a Bayesian spam filter (1) with content from previously classified documents; performing a surety check on a current document, wherein the Bayesian spam filter (1) compares content of the current document against content of the previous documents to determine how much of the content is already known to the Bayesian spam filter (1); classifying the current document as being of an unknown type without classifying the current document as being of a spam type or a legitimate type, responsive to failing the surety check, due to less than a threshold (7) amount of the content the current document being already known to the Bayesian spam filter (1) from the training content; and classifying the current document as being of a spam type or a legitimate type, using Bayesian filtering, responsive to passing the surety check due to more than a threshold (7) amount of the content of the current document being already known to the Bayesian spam filter (1) from the training content The method of claim 1 wherein determining whether more than a threshold (7) amount of the content of the at least one document is already known to the Bayesian spam filter (1) further comprises: determining a percentage of words of the at least one document that are already known to the Bayesian spam filter (1) from prior training of the Bayesian spam filter (1). 3. The method of claim 1 wherein determining whether more than a threshold (7) amount of the content of the at least one document is already known to the Bayesian spam filter (1) further comprises: determining a percentage (11) of a maximum correction value (111) utilized during the Bayesian filtering of the at least one document comprising: 2 calculating the maximum correction value (111) for the at least one document as a function of a zero count value (9) and a number of words in the at least one document, wherein the zero count value comprises a default probability to use during Bayesian processing for words not encountered in training; and calculating a percentage (11) of the maximum correction value (111) utilized during the Bayesian filtering of the at least one document as a function of a correction value (113) utilized during the Bayesian filtering of the at least one document and the maximum correction value (111) for the at least one document. 4. The method of claim 3 wherein the zero count value (9) further comprises a special value to use during the Bayesian filtering for words not encountered during Bayesian filter training, the method further comprising: 3 calculating the zero count value (9) as a natural logarithm of one divided by the number of words in the training data set multiplied by a constant.. The method of claim 3 wherein the correction value (113) utilized during Bayesian filtering of the at least one document further comprises: a special value calculated to prevent any individual word from unduly influencing classification of the at least one document The method of claim 1 wherein the at least one document comprises at least one message (3) and the Bayesian filtering classifies the at least one message (3) as belonging to a single category from a group of categories consisting of: 0 spam (2); legitimate (4); and unknown (6). 7. A computer program product for reducing false classifications as spam or legitimate during Bayesian filtering, the computer program product characterized by: program code for training a Bayesian spam filter (1) with content from previously classified documents; program code for performing a surety check on a current document, wherein the Bayesian spam filter (1) compares content of the current document against content of the previous documents to determine how much of the content is already known to the Bayesian spam filter (1); 6

7 program code for classifying the current document as being of an unknown type without classifying the current document as being of a spam type or a legitimate type, responsive to failing the surety check, due to less than a threshold (7) amount of the content of the current document being already known to the Bayesian spam filter (1) from the training content; and program code for classifying the current document as being of a spam type or a legitimate type, using Bayesian filtering, responsive to passing the surety check due to more than a threshold (7) amount of the content of the current document being already known to the Bayesian spam filter (1) from the training content; and at least one computer readable medium on which the program codes are stored. 8. The computer program product of claim 7 wherein the program code for determining whether more than a threshold (7) amount of the content of the at least one document is already known to the Bayesian spam filter (1) further comprises: 1 program code for determining a percentage of words of the at least one document that are already known to the Bayesian spam filter (1) from prior training of the Bayesian spam filter training (1). 9. The computer program product of claim 8 wherein the program code for determining whether more than a threshold (7) amount of the content of the at least one document is already known to the Bayesian spam filter (1) further comprises: program code for determining a percentage (11) of a maximum correction value utilized during Bayesian filtering of the at least one document comprises: 2 3 calculating the maximum correction value (111) for the at least one document as a function of a zero count value (9) and a number of words in the at least one document, wherein the zero count value comprises a default probability to use during Bayesian processing for words not encountered in training; and calculating a percentage (11) of the maximum correction value (111) utilized during the Bayesian filtering of the at least one document as a function of a correction value (113) utilized during the Bayesian filtering of the at least one document and the maximum correction (111) value for the at least one document.. The computer program product of claim 9 wherein the zero count value (9) further comprises a special value to use during the Bayesian filtering for words not encountered during Bayesian filter training, the computer program product further comprising: program code for calculating the zero count value (9) as a natural logarithm of one divided by the number of words in the training data set multiplied by a constant. 11. The computer program product of claim 9 wherein the correction value (113) utilized during the Bayesian filtering of the at least one document further comprises: a special value calculated to prevent any individual word from unduly influencing classification of the at least one document The computer program product of claim 7 further comprising program code for classifying at least one message (3) as belonging to a single category from a group of categories consisting of: 0 spam (2); legitimate (4); and unknown (6). 13. A computer system for reducing false classification as spam or legitimate during Bayesian filtering, the computer system characterized by: means for training a Bayesian spam filter (1) with content from previously classified documents; means for performing a surety check on a current document, wherein the Bayesian spam filter (1) compares content of the current document against content of the previous document to determine how much of the content is already known to the Bayesian spam filter (1); means for classifying the current document as being of an unknown type without classifying the current document 7

8 as being of a spam type or a legitimate type, responsive to failing the surety check, due to less than a threshold (7) amount of the content of the current document being already known to the Bayesian spam filter (1) from the training content; and means for classifying the current document as being of a spam type or a legitimate type, using Bayesian filtering, responsive to passing the surety check due to more than a threshold (7) amount of the content of the current document being already known to the Bayesian spam filter (1) from the training content. Patentansprüche 1. Computerrealisiertes Verfahren zum Verringern falscher Einstufungen als Spam oder berechtigt während eines Bayes-Filterns, wobei das Verfahren durch die Schritte gekennzeichnet ist: 1 2 Trainieren eines Bayes-Spamfilters (1) mit Inhalt von zuvor eingestuften Dokumenten; Durchführen einer Gewissheitsprüfung an einem aktuellen Dokument, wobei der Bayes-Spamfilter (1) einen Inhalt des aktuellen Dokuments mit einem Inhalt des früheren Dokuments vergleicht, um zu ermitteln, wie viel des Inhalts dem Bayes-Spamfilter (1) bereits bekannt ist; als Reaktion auf ein Durchfallen durch die Gewissheitsprüfung aufgrund dessen, dass dem Bayes-Spamfilter (1) weniger als eine Menge eines Schwellenwerts (7) des Inhalts des aktuellen Dokuments bereits aus dem Trainingsinhalt bekannt ist, Einstufen des aktuellen Dokuments als von einem unbekannten Typ, ohne das aktuelle Dokument als von einem Spamtyp oder von einem berechtigten Typ einzustufen; und als Reaktion auf ein Bestehen der Gewissheitsprüfung aufgrund dessen, dass dem Bayes-Spamfilter (1) mehr als eine Menge des Schwellenwerts (7) des Inhalts des aktuellen Dokuments bereits aus dem Trainingsinhalt bekannt ist, Einstufen des aktuellen Dokuments als von einem Spamtyp oder von einem berechtigten Typ unter Verwendung eines Bayes-Filterns. 2. Verfahren nach Anspruch 1, wobei das Ermitteln, ob dem Bayes-Spamfilter (1) bereits mehr als eine Menge des Schwellenwerts (7) des Inhalts des mindestens einen Dokuments bekannt ist, weiterhin umfasst: Ermitteln eines prozentualen Anteils von Wörtern des mindestens einen Dokuments, die dem Bayes-Spamfilter (1) bereits aus dem früheren Training des Bayes-Spamfilters (1) bekannt sind Verfahren nach Anspruch 1, wobei das Ermitteln, ob dem Bayes-Spamfilter (1) bereits mehr als eine Menge des Schwellenwerts (7) des Inhalts des mindestens einen Dokuments bekannt ist, weiterhin umfasst: Ermitteln eines während des Bayes-Filterns des mindestens einen Dokuments verwendeten prozentualen Anteils (11) eines maximalen Korrekturwertes (111), umfassend: 4 Berechnen des maximalen Korrekturwertes (111) für das mindestens eine Dokument als eine Funktion eines Nullzählungswerts (9) und einer Anzahl von Wörtern in dem mindestens einen Dokument, wobei der Nullzählungswert eine Standardwahrscheinlichkeit umfasst, die während der Bayes-Verarbeitung für Wörter zu verwenden ist, die nicht im Training angetroffen wurden; und Berechnen eines während des Bayes-Filterns des mindestens einen Dokuments verwendeten prozentualen Anteils (11) des maximalen Korrekturwertes (111) als eine Funktion eines während des Bayes-Filterns des mindestens einen Dokuments verwendeten Korrekturwertes (113) und des maximalen Korrekturwertes (111) für das mindestens eine Dokument Verfahren nach Anspruch 3, wobei der Nullzählungswert (9) weiterhin einen speziellen Wert umfasst, der während des Bayes-Filterns für Wörter zu verwenden ist, die nicht während des Bayes-Filter-Trainings angetroffen wurden, wobei das Verfahren weiterhin umfasst: Berechnen des Nullzählungswerts (9) als einen natürlichen Logarithmus von Eins geteilt durch die Anzahl von Wörtern im Trainingsdatensatz multipliziert mit einer Konstanten.. Verfahren nach Anspruch 3, wobei der während des Bayes-Filterns des mindestens einen Dokuments verwendete Korrekturwert (113) weiterhin umfasst: einen speziellen Wert, der berechnet wird, um zu verhindern, dass ein einzelnes Wort die Einstufung des 8

9 mindestens einen Dokuments unangemessen beeinflusst. 6. Verfahren nach Anspruch 1, wobei das mindestens eine Dokument mindestens eine -Nachricht (3) umfasst, und das Bayes-Filtern die mindestens eine -Nachricht (3) als einer einzelnen Kategorie aus einer Gruppe von Kategorien zugehörig einstuft, bestehend aus: Spam (2); berechtigte (4); und unbekannt (6). 7. Computerprogrammprodukt zum Verringern falscher Einstufungen als Spam oder berechtigt während eines Bayes- Filterns, wobei das Computerprogrammprodukt gekennzeichnet ist durch: 1 2 Programmcode zum Trainieren eines Bayes-Spamfilters (1) mit Inhalt von zuvor eingestuften Dokumenten; Programmcode zum Durchführen einer Gewissheitsprüfung an einem aktuellen Dokument, wobei der Bayes- Spamfilter (1) einen Inhalt des aktuellen Dokuments mit einem Inhalt des früheren Dokuments vergleicht, um zu ermitteln, wie viel des Inhalts dem Bayes-Spamfilter (1) bereits bekannt ist; Programmcode, um als Reaktion auf ein Durchfallen durch die Gewissheitsprüfung aufgrund dessen, dass dem Bayes-Spamfilter (1) weniger als eine Menge eines Schwellenwerts (7) des Inhalts des aktuellen Dokuments bereits aus dem Trainingsinhalt bekannt ist, das aktuelle Dokument als von einem unbekannten Typ einzustufen, ohne das aktuelle Dokument als von einem Spamtyp oder von einem berechtigten Typ einzustufen; und Programmcode, um als Reaktion auf ein Bestehen der Gewissheitsprüfung aufgrund dessen, dass dem Bayes- Spamfilter (1) mehr als eine Menge des Schwellenwerts (7) des Inhalts des aktuellen Dokuments bereits aus dem Trainingsinhalt bekannt ist, das aktuelle Dokument unter Verwendung eines Bayes-Filterns als von einem Spamtyp oder von einem berechtigten Typ einzustufen; und mindestens ein computerlesbares Medium, auf dem die Programmcodes gespeichert sind. 8. Computerprogrammprodukt nach Anspruch 7, wobei der Programmcode zum Ermitteln, ob dem Bayes-Spamfilter (1) bereits mehr als eine Menge des Schwellenwerts (7) des Inhalts des mindestens einen Dokuments bekannt ist, weiterhin umfasst: 3 Programmcode zum Ermitteln eines prozentualen Anteils von Wörtern des mindestens einen Dokuments, die dem Bayes-Spamfilter (1) bereits aus dem früheren Training des Bayes-Spamfilter-Trainings (1) bekannt sind. 9. Computerprogrammprodukt nach Anspruch 8, wobei der Programmcode zum Ermitteln, ob dem Bayes-Spamfilter (1) bereits mehr als eine Menge des Schwellenwerts (7) des Inhalts des mindestens einen Dokuments bekannt ist, weiterhin umfasst: Programmcode zum Ermitteln eines während des Bayes-Filterns des mindestens einen Dokuments verwendeten prozentualen Anteils (11) eines maximalen Korrekturwertes umfasst: 4 0 Berechnen des maximalen Korrekturwertes (111) für das mindestens eine Dokument als eine Funktion eines Nullzählungswerts (9) und einer Anzahl von Wörtern in dem mindestens einen Dokument, wobei der Nullzählungswert eine Standardwahrscheinlichkeit umfasst, die während der Bayes-Verarbeitung für Wörter zu verwenden ist, die nicht im Training angetroffen wurden; und Berechnen eines während des Bayes-Filterns des mindestens einen Dokuments verwendeten prozentualen Anteils (11) des maximalen Korrekturwertes (111) als eine Funktion eines während des Bayes-Filterns des mindestens einen Dokuments verwendeten Korrekturwertes (113) und des maximalen Korrekturwertes (111) für das mindestens eine Dokument.. Computerprogrammprodukt nach Anspruch 9, wobei der Nullzählungswert (9) weiterhin einen speziellen Wert umfasst, der während des Bayes-Filterns für Wörter zu verwenden ist, die nicht während des Bayes-Filter-Trainings angetroffen wurden, wobei das Computerprogrammprodukt weiterhin umfasst: Programmcode zum Berechnen des Nullzählungswerts (9) als einen natürlichen Logarithmus von Eins geteilt durch die Anzahl von Wörtern im Trainingsdatensatz multipliziert mit einer Konstanten. 9

10 11. Computerprogrammprodukt nach Anspruch 9, wobei der während des Bayes-Filterns des mindestens einen Dokuments verwendete Korrekturwert (113) weiterhin umfasst: einen speziellen Wert, der berechnet wird, um zu verhindern, dass ein einzelnes Wort die Einstufung des mindestens einen Dokuments unangemessen beeinflusst Computerprogrammprodukt nach Anspruch 7, weiterhin umfassend Programmcode zum Einstufen mindestens einer -Nachricht (3) als einer einzelnen Kategorie aus einer Gruppe von Kategorien zugehörig, bestehend aus: Spam (2); berechtigte (4); und unbekannt (6). 13. Computersystem zum Verringern falscher Einstufungen als Spam oder berechtigt während eines Bayes-Filterns, wobei das Computersystem gekennzeichnet ist durch: 2 Mittel zum Trainieren eines Bayes-Spamfilters (1) mit Inhalt von zuvor eingestuften Dokumenten; Mittel zum Durchführen einer Gewissheitsprüfung an einem aktuellen Dokument, wobei der Bayes-Spamfilter (1) einen Inhalt des aktuellen Dokuments mit einem Inhalt des früheren Dokuments vergleicht, um zu ermitteln, wie viel des Inhalts dem Bayes-Spamfilter (1) bereits bekannt ist; Mittel, um als Reaktion auf ein Durchfallen durch die Gewissheitsprüfung aufgrund dessen, dass dem Bayes- Spamfilter (1) weniger als eine Menge eines Schwellenwerts (7) des Inhalts des aktuellen Dokuments bereits aus dem Trainingsinhalt bekannt ist, das aktuelle Dokument als von einem unbekannten Typ einzustufen, ohne das aktuelle Dokument als von einem Spamtyp oder von einem berechtigten Typ einzustufen; und Mittel, um als Reaktion auf ein Bestehen der Gewissheitsprüfung aufgrund dessen, dass dem Bayes-Spamfilter (1) mehr als eine Menge des Schwellenwerts (7) des Inhalts des aktuellen Dokuments bereits aus dem Trainingsinhalt bekannt ist, das aktuelle Dokument als von einem Spamtyp oder von einem berechtigten Typ einzustufen. Revendications 3 1. Procédé mis en oeuvre par ordinateur pour la réduction des fausses classifications comme spam ou légitime durant le filtrage bayésien, le procédé caractérisé par les étapes de : 4 l entraînement d un filtre bayésien anti-spam (1) avec le contenu de documents classifiés antérieurement ; l exécution d une vérification de sécurité sur un document actuel, dans laquelle le filtre bayésien anti-spam (1) compare le contenu du document actuel avec le contenu des documents antérieurs pour déterminer combien du contenu est déjà connu du filtre bayésien anti-spam (1) ; la classification du document actuel comme étant d un type inconnu, sans la classification du document actuel comme étant de type spam ou de type légitime, répondant à l échec de la vérification de sécurité, dû au fait que moins d une quantité seuil (7) du contenu du document actuel est déjà connue par le filtre bayésien antispam (1) à partir du contenu de l entraînement ; et la classification du document actuel comme étant de type spam ou de type légitime, en employant un filtrage bayésien, répondant au succès de la vérification de sécurité, dû au fait que plus d une quantité seuil (7) du contenu du document actuel est déjà connue par le filtre bayésien anti-spam (1) à partir du contenu de l entraînement Procédé selon la revendication 1, dans lequel déterminer si plus d une quantité seuil (7) du contenu de l au moins un document est déjà connue par le filtre bayésien anti-spam (1) comprend en outre : la détermination d un pourcentage de mots de l au moins un document qui sont déjà connus par le filtre bayésien anti-spam (1) à partir de l entraînement antérieur du filtre bayésien anti-spam (1). 3. Procédé selon la revendication 1, dans lequel déterminer si plus d une quantité seuil (7) du contenu de l au moins un document est déjà connue par le filtre bayésien anti-spain (1) comprend en outre :

11 la détermination d un pourcentage (11) d une valeur de correction maximale (111) utilisée durant le filtrage bayésien de l au moins un document comprenant : le calcul de la valeur de correction maximale (111) pour l au moins un document en fonction d une valeur de zéro (9) et d un nombre de mots dans l au moins un document, dans lequel la valeur de zéro comprend une probabilité par défaut à utiliser durant le processus bayésien pour les mots non rencontrés durant l entraînement ; et le calcul d un pourcentage (11) de la valeur de correction maximale (111) utilisée durant le filtrage bayésien de l au moins un document en fonction d une valeur de correction (113) utilisée durant le filtrage bayésien de l au moins un document et de la valeur de correction maximale (111) pour l au moins un document Procédé selon la revendication 3, dans lequel la valeur de zéro (9) comprend en outre une valeur spéciale à utiliser durant le filtrage bayésien pour les mots non rencontrés durant l entraînement du filtre bayésien, le procédé comprenant en outre : le calcul de la valeur de zéro (9) comme un logarithme naturel de un divisé par le nombre de mots dans l ensemble des données d entraînement multiplié par une constante.. Procédé selon la revendication 3, dans lequel la valeur de correction (113) utilisée durant le filtrage bayésien de l au moins un document comprend en outre : une valeur spéciale calculée pour empêcher un quelconque mot individuel d influencer excessivement la classification de l au moins un document Procédé selon la revendication 1, dans lequel l au moins un document comprend au moins un message courriel (3) et le filtrage bayésien classifie l au moins un message courriel (3) comme appartenant à une seule catégorie provenant d un groupe de catégories constitué de : spam (2); courriel légitime (4); et inconnu (6) Produit de logiciel pour la réduction des fausses classifications comme spam ou légitime durant le filtrage bayésien, le produit de logiciel caractérisé par : un code de logiciel pour l entraînement d un filtre bayésien anti-spam (1) avec le contenu de documents classifiés antérieurement ; un code de logiciel pour l exécution d une vérification de sécurité sur un document actuel, dans laquelle le filtre bayésien anti-spam (1) compare le contenu du document actuel avec le contenu des documents antérieurs pour déterminer combien du contenu est déjà connu par le filtre bayésien anti-spam (1) ; un code de logiciel pour la classification du document actuel comme étant d un type inconnu, sans la classification du document actuel comme étant de type spam ou de type légitime, répondant à l échec de la vérification de sécurité, dû au fait que moins d une quantité seuil (7) du contenu du document actuel est déjà connue par le filtre bayésien anti-spam (1) à partir du contenu de l entraînement ; et un code de logiciel pour la classification du document actuel comme étant de type spam ou de type légitime, en employant un filtrage bayésien, répondant au succès de la vérification de sécurité, dû au fait que plus d une quantité seuil (7) du contenu du document actuel est déjà connue par le filtre bayésien anti-spam (1) à partir du contenu de l entraînement ; et au moins un support lisible par ordinateur sur lequel les codes de logiciel sont enregistrés. 8. Produit de logiciel selon la revendication 7, dans lequel le code de logiciel pour déterminer si plus d une quantité seuil (7) du contenu de l au moins un document est déjà connue par le filtre bayésien anti-spam (1) comprend en outre : un code de logiciel pour la détermination d un pourcentage de mots de l au moins un document qui sont déjà connus par le filtre bayésien anti-spam (1) à partir de l entraînement antérieur du filtre bayésien anti-spam (1). 11

12 9. Produit de logiciel selon la revendication 8, dans lequel le code de logiciel pour déterminer si plus d une quantité seuil (7) du contenu de l au moins un document est déjà connue par le filtre bayésien anti-spam (1) comprend en outre : un code de logiciel pour la détermination d un pourcentage (11) d une valeur de correction maximale utilisée durant le filtrage bayésien de l au moins un document comprenant : 1 le calcul de la valeur de correction maximale (111) pour l au moins un document en fonction d une valeur de zéro (9) et d un nombre de mots dans l au moins un document, dans lequel la valeur de zéro comprend une probabilité par défaut à utiliser durant le processus bayésien pour les mots non rencontrés durant l entraînement ; et le calcul d un pourcentage (11) de la valeur de correction maximale (111) utilisée durant le filtrage bayésien de l au moins un document en fonction d une valeur de correction (113) utilisée durant le filtrage bayésien de l au moins un document et de la valeur de correction maximale (111) pour l au moins un document.. Produit de logiciel selon la revendication 9, dans lequel la valeur de zéro (9) comprend en outre une valeur spéciale à utiliser durant le filtrage bayésien pour les mots non rencontrés durant l entraînement du filtre bayésien, le produit de logiciel comprenant en outre : un code de logiciel pour le calcul de la valeur de zéro (9) comme un logarithme naturel de un divisé par le nombre de mots dans l ensemble des données d entraînement multiplié par une constante Produit de logiciel selon la revendication 9, dans lequel la valeur de correction (113) utilisée durant le filtrage bayésien de l au moins un document comprend en outre : une valeur spéciale calculée pour empêcher un quelconque mot individuel d influencer excessivement la classification de l au moins un document. 12. Produit de logiciel selon la revendication 7 comprenant en outre un code de logiciel pour la classification d au moins un message courriel (3) comme appartenant à une seule catégorie provenant d un groupe de catégories constitué de : 3 spam (2); courriel légitime (4); et inconnu (6). 13. Système informatique pour la réduction de fausses classifications comme spam ou légitime durant le filtrage bayésien, le système informatique caractérisé par : 4 0 un moyen pour l entraînement d un filtre bayésien anti-spam (1) avec le contenu de documents classifiés antérieurement ; un moyen pour l exécution d une vérification de sécurité sur un document actuel, dans laquelle le filtre bayésien anti-spam (1) compare le contenu du document actuel avec le contenu des documents antérieurs pour déterminer combien du contenu est déjà connu par le filtre bayésien anti-spam (1); un moyen pour la classification du document actuel comme étant d un type inconnu, sans la classification du document actuel comme étant de type spam ou de type légitime, répondant à l échec de la vérification de sécurité, dû au fait que moins d une quantité seuil (7) du contenu du document actuel est déjà connue par le filtre bayésien anti-spam (1) à partir du contenu de l entraînement ; et un moyen pour la classification du document actuel comme étant de type spam ou de type légitime, en employant un filtrage bayésien, répondant au succès de la vérification de sécurité, dû au fait que plus d une quantité seuil (7) du contenu du document actuel est déjà connue par le filtre bayésien anti-spam (1) à partir du contenu de l entraînement. 12

13 13

14 REFERENCES CITED IN THE DESCRIPTION This list of references cited by the applicant is for the reader s convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard. Patent documents cited in the description US A1 [0008] US B1 [0009] Non-patent literature cited in the description GUOQING MO et al. Multi-agent Interaction Based Collaborative P2P System for Fighting Spam. INTEL- LIGENT AGENT TECHNOLOGY, 06. IAT 06. IEEE/WIC/ACM INTERNATIONAL CONFERENCE ON, 01 December 06, [00] VIVEK CHANDRA et al. Ways to Evade Spam Filters and Machine Learning as a Potential Solution. COM- MUNICATIONS AND INFORMATION TECHNOLO- GIES, 06. ISCIT 06. INTERNATIONAL SYMPO- SIUM ON, 01 October 06, [00] 14