Hash-based systems and methods for detecting and preventing transmission of unwanted e-mail

Abstract

A system ( 120 ) detects transmission of potentially unwanted e-mail messages. The system ( 120 ) may receive e-mail messages and generate hash values based on one or more portions of the e-mail messages. The system ( 120 ) may then determine whether the generated hash values match hash values associated with prior e-mail messages. The system ( 120 ) may determine that one of the e-mail messages is a potentially unwanted e-mail message when one or more of the generated hash values associated with the e-mail message match one or more of the hash values associated with the prior e-mail messages.

1 . In a network of cooperating mail servers, one of the mail servers comprising:
 one or more hash memories configured to store information relating to hash values corresponding to previously-observed e-mails; and   a hash processor configured to:   receive at least some of the hash values from another one or more of the cooperating mail servers,   store information relating to the at least some of the hash values in at least one of the one or more hash memories,   receive an e-mail message,   hash one or more portions of the received e-mail message to generate hash values, as generated hash values,   determine whether the generated hash values match the hash values corresponding to previously-observed e-mails, and   identify the received e-mail message as a potentially unwanted e-mail message when one or more of the generated hash values associated with the received e-mail message match one or more of the hash values corresponding to previously-observed e-mails.