University of Washington

Microsoft Technology Licensing, LLC

Arvind Krishnamurthy

Fang Yu

Martin Abadi

Yinglian Xie

Tadayoshi Kohno

Thomas E Anderson

Harsha Madhyastha

John Payyappillil John

Thomas Ristenpart

Arun Venkataramani

Gabriel Maganis

Search result poisoning attacks may be automatically detected by identifying groups of suspicious uniform resource locators (URLs) containing multiple keywords and exhibiting patterns that deviate from other URLs in the same domain without crawling and evaluating the actual contents of each web page. Suspicious websites are identified and lexical features are extracted for each such website. The websites are clustered based on their lexical features, and group analysis is performed on each group to identify at least one suspicious group. Other implementations are directed to detecting a search engine optimization (SEO) attack by processing a large population of URLs to identify suspicious URLs based on the presence of a subset of keywords in each URL and the relative newness of each URL.

Automatic detection of search results poisoning attacks

A privacy-preserving device-tracking system and method to assist in the recovery of lost or stolen Internet-connected mobile devices. The function of such a system seem contradictory, since it is desirable to hide a device's legitimately-visited locations from third-party services and other parties to achieve location privacy, while still enabling recovery of the device's location(s) after it goes missing by tracking the device to determine its location. An exemplary embodiment uses a DHT for storing encrypted location information and other forensic information in connection with indices that are successively determined based on initial pseudorandom seed information (i.e., state) that is retained by the owner of the device. Using the seed information, the software can determine indices mapped to location information stored after the device went missing, enabling the device to be located. Numerous extensions are discussed for the basic exemplary design that increase its suitability for particular deployment environments.

Privacy-preserving location tracking for devices

Performance metrics between any two arbitrary end-hosts are predicted based upon previous measurements on the Internet between a plurality of geographically dispersed vantage points and clusters of end-hosts. Each cluster comprises end-hosts that are related based upon their IP address prefixes. In response to a central agent that stores the measured data for each of a plurality of predicted paths on the Internet, the vantage points use traceroute software to measure and periodically update performance metrics such as latency, bottleneck capacity, bandwidth, and packet loss rate for links comprising the predicted paths between the vantage points and one (or more) destination points associated with each cluster, and gather such data using distributed application systems. A user or client application can subsequently request predicted performance metrics for communication between specific end-hosts, based upon the previous measurement data.

Information plane for determining performance metrics of paths between arbitrary end-hosts on the internet

Growing community of inventors

Seattle, WA, United States of America

Arvind Krishnamurthy