Apparatus and method for obfuscation detection within a spam filtering model

Abstract

A computer-implemented system and method are described for detecting obfuscated words in email messages and using this information to determine whether each email message is spam or valid email (ham). For example, a method according to one embodiment of the invention comprises: providing an obfuscation feature set for detecting obfuscation within email messages, the obfuscation feature set build from a group of obfuscation parameters including a similarity metric, the similarity metric using a set using a set of frequently obfuscated words (FOW) selected from a larger set of obfuscated words; analyzing an email message to detect whether the email message contains features within the obfuscation feature set, wherein the analysis includes determining the similarity of one or more words in the email message with each of the FOWs; generating the similarity metric based on the analysis, the similarity metric providing a relative likelihood that each of the one or more words is obfuscated; firing one or more of the obfuscation detection features based, at least in part, on the value of the similarity metric; analyzing the email message to detect whether the email contains one or more additional spam features unrelated to obfuscation; and determining whether the email message is spam based on the combined obfuscation detection features and the additional spam features.