Method and apparatus to screen electronic communications

Abstract

A method and an apparatus to screen electronic communications have been disclosed. In one embodiment, the method includes extracting URLs from electronic communication and analyzing the URLs extracted to determine whether the electronic communication is of a first predetermined category. Other embodiments have been claimed and described.

1 . A method comprising:
 using one or more computer processors, extracting URLs from electronic communication; and   analyzing the URLs extracted to determine whether the electronic communication is of a first predetermined category, generating one or more signatures using the URLs extracted.   
     
     
         2 . The method of  claim 1  further including reformatting the URLs, and using a length of the electronic communication and the reformatted URLs to generate the one or more signatures. 
     
     
         3 . The method of  claim 2 , wherein extracting the URLs comprises extracting at least one of a hostname, a domain name, a subsection of a domain relative link, and an Internet Protocol (IP) address from the electronic communication. 
     
     
         4 . The method of  claim 2 , further comprising performing a predetermined operation on the electronic communication if the electronic communication is determined to be of the first predetermined category. 
     
     
         5 . The method of  claim 3 , wherein reformatting the URLs comprises reducing the hostname to lowercase and pruning the leading and trailing white space of the URLs. 
     
     
         6 . The method of  claim 3  wherein the hostname is canonicalized and reduced to the domain name that is registered at a domain registrar. 
     
     
         7 . The method of  claim 5 , wherein the hostname is a top-level domain name, with a second level to the left of the top level, and reducing comprises pruning the parts of the hostname before the second level. 
     
     
         8 . The method of  claim 2  wherein analyzing the URLs comprises:
 selecting one or more of the one or more signatures generated; and 
 comparing the selected signatures against a plurality of predetermined signatures generated from a plurality of known electronic communications of the first predetermined category. 
 
     
     
         9 . The method of  claim 8 , wherein generating the one or more signatures further comprises using at least one of the extracted URLs as at least one of the one or more signatures. 
     
     
         10 . The method of  claim 8 , wherein generating the one or more signatures further comprises generating the one or more signatures based on at least one of a protocol, a hostname, a domain name, a subsection of a domain relative link, and an Internet Protocol (IP) address from the electronic communication. 
     
     
         11 . The method of  claim 8 , further comprising classifying the electronic communication to be of the first predetermined category if one of the selected signatures matches one of the plurality of predetermined signatures. 
     
     
         12 . The method of  claim 3 , wherein the one or more signatures are stored as database entries associated with meta data, the metadata including at least one of the group consisting of:
 a predetermined number of the first characters of the hostname that was the source of the signature, the hostname designating a host;   the registration date of the domain part of the hostname;   a selection field indicating whether the signatures derived from the host can be used for screening electronic communications;   the number of trusted reports and revocations for signatures based on the host; and   the number of different signatures created on a particular host.   
     
     
         13 . A non-transitory computer-readable storage medium that provides instructions that, when executed by a processor, will cause the processor to perform operations comprising:
 extracting URLs from electronic communication; and   analyzing the URLs extracted to determine whether the electronic communication is of a first predetermined category, said analyzing comprising reformatting the URLs, and generating one or more signatures using a length of the electronic communication and the URLs extracted.   
     
     
         14 . The computer-readable storage medium of  claim 13 , wherein the operation to extract the URLs further comprises extracting at least one of a hostname, a domain name, a subsection of a domain relative link, and an Internet Protocol (IP) address from the electronic communication. 
     
     
         15 . The computer-readable storage medium of  claim 13 , the operations further including performing a predetermined operation on the electronic communication if the electronic communication is determined to be of the first predetermined category. 
     
     
         16 . The computer-readable storage medium of  claim 14 , wherein the operation to reformat the URLs further comprises reducing the hostname to lowercase and pruning the leading and trailing white space of the URLs. 
     
     
         17 . The computer-readable storage medium of  claim 14 , the operations further including canonicalizing the hostname and reducing the hostname to the domain name that is registered at a domain registrar. 
     
     
         18 . The computer-readable storage medium of  claim 16 , wherein the hostname is a top-level domain name with a second level to the left of the top level, and reducing comprises pruning the parts of the hostname before the second level. 
     
     
         19 . The computer-readable storage medium of  claim 13 , the operations further including:
 selecting one or more of the one or more signatures generated; and   comparing the selected signatures against a plurality of predetermined signatures   
       generated from a plurality of known electronic communications of the first predetermined category. 
     
     
         20 . The computer-readable storage medium of  claim 19 , wherein the operation to generate the one or more signatures further comprises using at least one of the extracted URLs as at least one of the one or more signatures. 
     
     
         21 . The computer-readable storage medium of  claim 19 , wherein the operation to generate the one or more signatures further comprises generating the one or more signatures based on at least one of a protocol, a hostname, a domain name, a subsection of a domain relative link, and an Internet Protocol (IP) address from the electronic communication. 
     
     
         22 . The computer-readable storage medium of  claim 19 , the operations further comprising classifying the electronic communication to be of the first predetermined category if one of the selected signatures matches one of the plurality of predetermined signatures. 
     
     
         23 . A system comprising:
 a plurality of databases to store a plurality of predetermined signatures of a plurality of electronic communications of a first predetermined category; and   a server, coupled to the plurality of databases, including:   a memory device to store a plurality of instructions; and   a processor, coupled to the memory device, to retrieve the plurality of instructions from the memory device and to perform operations in response to the plurality of instructions, the operations comprising:
 extracting URLs from electronic communication and generating one or more signatures using a length of the electronic communication and the URLs extracted; 
 reformatting the URLs and generating one or more signatures using a length of the electronic communication and the URLs extracted, and comparing one or more of the one or more signatures generated against the plurality of predetermined signatures stored in the plurality of databases to determine whether the electronic communication is of the first predetermined category.