The present invention provides a unique system and method that facilitates
incrementally updating spam filters in near real time or real time.
Incremental updates can be generated in part by difference learning.
Difference learning involves training a new spam filter based on new data
and then looking for the differences between the new spam filter and the
existing spam filter. Differences can be determined at least in part by
comparing the absolute values of parameter changes (weight changes of a
feature between the two filters). Other factors such as frequency of
parameters can be employed as well. In addition, available updates with
respect to particular features or messages can be looked up using one or
more lookup tables or databases. When incremental and/or feature-specific
updates are available, they can be downloaded such as by a client for
example. Incremental updates can be automatically provided or can be
provided by request according to client or server preferences.