Systems and methods for generating signatures for electronic communication classification

Abstract

In some embodiments, fully-automated spam identification is facilitated by accelerating a signature extraction process, allowing the use of a relatively large number of signatures finely tailored to individual spam waves, rather than a smaller number of highly-accurate signatures generated under human supervision. The signature extraction process is performed in a distributed manner. A message corpus is classified into a plurality of message clusters. Cluster-specific spam identification text patterns are extracted selectively from members of each cluster, and the text patterns are combined into cluster-specific spam identification signatures. A cluster may represent an individual spam wave. Genetic algorithms are used to optimize the set of spam identification signatures by selecting the highest-performing combinations of cluster-specific spam identification text patterns. Performing signature extraction at a subclass level allows accelerating the signature extraction process, which in turn allows frequent signature updates and facilitates fully automated spam identification.