Microsoft Technology Licensing, LLC

Sandisk Corporation

Eliot Carleton Gillum

Krishna C Vitaldevara

Jason D Walter

Mehrdad Bidgoli

Geoffrey John Hulten

Malcolm Hollis Davis

Fang Yu

Joshua T Goodman

Robert L Rounthwaite

Yinglian Xie

Douglas John Hines

Robert L McCann

Mihai Costea

Ivan Osipkov

Milenko Drinic

Vasantha K Vemula

David Earl Heckerman

Bryan T Starbuck

Martin Abadi

Qifa Ke

Wei Jiang

Omar H Shahine

Ryan Charles Colvin

Nathan D Howell

Tyler J Schnoebelen

Aditya Bansod

Steven Kafka

Kevin H Lau

Paul M Midgen

Michael James Ahiakpor

Sanchan Sahai Saxena

Rebecca Ping Zhu

Kenneth R Aldinger

Samuel J L Albert

Aravind K Ramachandran

Kannan Achan

David Maxwell Chickering

Zhuoqing Morley Mao

Anatoliy Panasyuk

Eric Fleischman

Aleksander R Kolcz

Imran I Qureshi

Charles Reeves Little, Ii

Hakki Tunc Bostanci

Anthony Paul Penta

Matthew Robert Ayers

Aladdin Aly Nassar

John Scarrow

David A Braun

Paul Stephen Rehfuss

Jennifer I Shen

William Raymond Hoffman

Hersh Dangayach

Joshua Korb

Chad W Mills

Sara Liu Yang

Gopalakrishnan Seshadrinathan

Michael D Schackwitz

Kumar S Srivastava

Robert Edgar Fanfant

Ilya Mironov

Jay T Buckingham

Jennie Park Telehowski

Yao Zhao

Pablo M Stern

Thomas A Leung

Chun Yu Wong

Krish Vitaldevara

Harsh Satyanarayan Dangayach

Junxian Huang

Yuxiang Xu

Roberto F Figueroa

Vikram S Sardesai

Robin L Boyea

Samuel J Albert

John P Walpole

Hans Matthew Endresen

Robert Lee Mccann

Joshua David Korb

Message management and classification techniques are described. In one or more implementations, a message received from a sender for delivery via a user account is examined to extract one or more features of the message. A determination is then made as to whether the message corresponds to one or more categories based on the extracted features, the categories usable to enable features to be applied to the message in a user interface.

Message classification and management

Email tags are described. In embodiments, email messages are received for distribution to client devices that correspond to respective recipients of the email messages. Email routing decisions are applied to route an email message to an email folder for a recipient of the email message, where the email folder may include an email inbox, a junk folder, or a user-created folder. The email message is then tagged with an email tag to generate a tagged email message. The email tag includes a routing description that indicates why the email message was routed to the particular email folder.

Email tags

The subject invention provides for an advanced and robust system and method that facilitates detecting spam. The system and method include components as well as other operations which enhance or promote finding characteristics that are difficult for the spammer to avoid and finding characteristics in non-spam that are difficult for spammers to duplicate. Exemplary characteristics include analyzing character and/or number sequences, strings, and sub-strings, detecting various entropy levels of one or more character sequences, strings and/or sub-strings and analyzing message headers.

Advanced spam detection techniques

Geo-data spam filters are described. In one or more implementations, origin data and language data of a message are evaluated to establish a score for the message indicating a likelihood that the message is spam. The evaluation includes comparing the origin data and the language data to ranked lists indicating message origins and languages with which a respective message recipient interacts positively and ranked lists indicating message origins and languages with which the respective recipient interacts negatively. Interactions of the respective recipient with previously sent messages may be tracked to form these lists. Based on the score established by evaluating the origin data and the language data of the message, the message is filtered for delivery.

Geo-data spam filter

The filtering of activities generated by nodes of a network while interacting with a device may be performed by evaluating the desirability of the activities (e.g., a spam or not-spam determination of email messages sent by the node) and assigning a trust rating to the node. However, nodes are often identified by network address, and an operator of a node sending undesirable activities may reassign the network address of the node in order to avoid heavy filtering. Instead, nodes may be identified as being controlled by a network entity (e.g., an autonomous system identified in a border gateway protocol routing table.) The network entity is assigned a network entity trust rating based on the trust ratings of the nodes controlled thereby, and an appropriate level of activity filtering based on the network entity trust rating may be selected for subsequent activities received from all nodes controlled by the network entity.

Activity filtering based on trust ratings of network

The claimed subject matter provides a method for detecting compromised accounts. The method includes receiving a communication from a sender's account to a recipient. The sender's account is associated with a sender. The method also includes presenting a compromised account reporting interface to the recipient based on specific conditions. Further, the method includes receiving a selection by the recipient indicating the sender's account is compromised. The method also includes determining that the sender's account is compromised based on the selection. Additionally, the method includes generating, in response to a selection by the recipient, a report indicating that the account is compromised.

Reporting compromised email accounts

Campaign detection techniques are described. In implementations, a signature is computed for each of a plurality of emails to be communicated by a service provider to respective intended recipients. A determination is made that two or more of the plurality of emails is similar based on the respective signatures. Responsive to a finding that a number of similar emails exceeds a threshold, an indication is output that the similar emails have a likelihood of being involved in a spam campaign.

Campaign detection

A computer implemented method for filtering unwanted bulk email in an email system and providing a positive user experience is provided. The method enables protection of email users from unsolicited bulk email using user-provided data on user interactions at both a user storage level and a global level with an email system. Metadata on user interactions with messages is collected. Messages are received by the system and evaluated using a global filter which assigns a score resulting in a message action. The action may be message delivery, message non-delivery or message routing, based on a score assigned by the global filter. When the message is delivered to user storage, the message may be examined relative to the metadata, and may alter the message action to an action different than the message action resulting from the score. Metadata for a plurality of users is returned to the global filter for use in making filtering future messages and modifies the global filter.

Personalized email interactions applied to global filtering

A system and method of managing unsolicited email sent to an email system over a network. Email messages are received at an message at an inbound mail transfer agent. A determination is made as to whether the email message is suspected to be an unsolicited suspect message. One or more queries for additional information on one or more characteristics of the message is initiated. Determinations are made based on replies to the queries before issuing a message accepted for delivery indication to a sending server.

Real-time spam look-up system

A service accessible by a set of entities may be provided to each entity at a different service level (e.g., with a different set of privileges) based on the privilege level of the entity. However, many users may attempt to perform malicious activities through the service, and may do so with impunity if the penalties of detection are inconsequential. Instead, privilege levels of entities may be established based on the claims of assets having identifiable value. Such claims may be established by submitting an asset identifier to the service, such as proof of a software license identified by the submission of a license key purchased at a substantial cost. The penalties of malicious activities performed by such users may include the invalidation of such asset identifiers. Establishing the privilege levels of respective entities in this manner raises the penalties, and hence the deterrence, of attempted malicious use of the service.

Establishing privileges through claims of valuable assets

Dynamic IP addresses may be automatically identified and their dynamics patterns may be analyzed. Multi-user IP address blocks are determined as candidates for further analysis. An entropy score is determined for each IP address in every candidate block to distinguish between a dynamic IP and a static IP shared by multiple users. IP addresses with high entropy scores are grouped, and then analyzed, and may be used in various applications, such as spam filtering.

Automatically identifying dynamic internet protocol addresses

A computer implemented system and method to enable protection of email users from unsolicited bulk email using a message delivery delay based on characteristics detected in selected messages. Messages are evaluated for characteristics resembling unsolicited bulk email. A determination is made whether a message passing through the email system exhibits such characteristics and whether to delay the message. Suspect messages may be delayed for a period of time, the delay period being dependent on the characteristics giving rise to a determination to delay. Following the period, additional information received during the delay period characterizing the message is used to determine whether to dispose or deliver the message. Messages evaluated can be inbound to the email system, outbound to other email systems, or moving within the email system.

Delaying inbound and outbound email messages

Trusted user accounts of an application provider are determined. Graphs, such as trees, are created with each node corresponding to a trusted account. Each of the nodes is associated with a vouching quota, or the nodes may share a vouching quota. Untrusted user accounts are determined. For each of these untrusted accounts, a trusted user account that has a social networking relationship is determined. If the node corresponding to the trusted user account has enough vouching quota to vouch for the untrusted user account, then the quota is debited, a node is added for the untrusted user account to the graph, and the untrusted user account is vouched for. If not, available vouching quota may be borrowed from other nodes in the graph.

Vouching for user account using social networking relationship

Growing community of inventors

Mountain View, CA, United States of America

Eliot Carleton Gillum