Microsoft Technology Licensing, LLC

Ivan Osipkov

Malcolm Hollis Davis

Geoffrey John Hulten

Wei Jiang

Douglas John Hines

John Scarrow

Joshua Korb

Eliot Carleton Gillum

Kristofer Noel Iverson

Geoff Hulten

Krishna C Vitaldevara

Jason D Walter

Mehrdad Bidgoli

Robert L McCann

Milenko Drinic

Aravind K Ramachandran

Fang Yu

Anatoliy Panasyuk

John D Mehr

Yinglian Xie

Kumar S Srivastava

One or more techniques and/or systems are provided for defining a message behavior profile for a sender, which may be used to categorize messages from the sender. A message behavior profile may be defined based upon, for example, message distribution behavior of the sender (e.g., volume, frequency, variance in content amongst messages sent to recipients, etc.); recipient interactions with messages from the sender (e.g., message read rates, message response rates, etc.); unsubscription options comprised within messages from the sender; and/or other factors. In this way, the message behavior profile and/or features extracted from a message may be used to categorize a message from the sender (e.g., newsletter, commercial advertisements, alert, social network etc.). Categorized messages may be organized into folders, displayed or hidden within views, and/or processed based upon their respective categorizations.

Message categorization

A message queue (e.g., an email mailbox) may comprise messages received from various sources and including various types of content. For respective messages, a trust category may be identified, e.g., a trusted message category comprising messages received from a known source, an untrusted message category comprising messages received from an unverified source, and a suspicious message category comprising messages containing potentially malicious attachments or potentially unwanted content. The message queue may be presented to the user with the messages of each trust category having a visual style that visually distinguishes the trust categories; e.g., trusted messages may be visually emphasized, and suspicious messages may be visually de-emphasized. This manner of distinguishing messages may enable the user to triage the messages of the message queue, and may mitigate the disadvantages of a false positive in the trust level identification (as compared with moving the suspicious message to a different folder).

Visual styles for trust categories of messages

A method of safe file transmission and reputation lookup is provided. As a part of the safe file transmission and reputation lookup methodology, a data file that is to be made available to a data file receiver is accessed and it is determined whether the data file needs to be provided a protective file. The data file is wrapped in a protective file to create a non-executing package file. Access is provided to the non-executing package file where the associated data file is prevented from being executed until data file reputation information is received.

Safe file transmission and reputation lookup

The filtering of activities generated by nodes of a network while interacting with a device may be performed by evaluating the desirability of the activities (e.g., a spam or not-spam determination of email messages sent by the node) and assigning a trust rating to the node. However, nodes are often identified by network address, and an operator of a node sending undesirable activities may reassign the network address of the node in order to avoid heavy filtering. Instead, nodes may be identified as being controlled by a network entity (e.g., an autonomous system identified in a border gateway protocol routing table.) The network entity is assigned a network entity trust rating based on the trust ratings of the nodes controlled thereby, and an appropriate level of activity filtering based on the network entity trust rating may be selected for subsequent activities received from all nodes controlled by the network entity.

Activity filtering based on trust ratings of network

The claimed subject matter is directed to mining user behavior data for increasing Internet Protocol ('IP') space intelligence. Specifically, the claimed subject matter provides a method and system of mining user behavior within an IP address space and the application of the IP address space intelligence derived from the mined user behavior. In one embodiment, the IP address space intelligence is formed and/or increased with information obtained from the mined user behavior data. A system of uniquely-identified users is monitored and their behavior within the IP address space is recorded. Further data is mined from estimated characteristics about the user, including the nature of the IP address the user uses to log into the service, and characterizing the IP address according to a network type.

Mining user behavior data for IP address space intelligence

Network entities controlling a set of nodes may vary by trustworthiness, such as tolerance for nodes that send spam, distribute malware, or perform denial-of-service attacks. A device receiving such activities may identify a trust rating of the network entity and apply appropriately stringent filtering (such as spam evaluation) to activities received from nodes controlled by the network entity. However, a poor trust rating of a network entity may subject a legitimate node controlled by the network entity to inefficiently or unfairly stringent activity filtering. Instead, the device may evaluate the activities of a particular node, assign a trust rating to the node, and if the trust rating of the node is higher than the trust rating of the network entity, apply less stringent activity filtering to the activities of the node, thereby 'rescuing' the node from the more stringent activity filtering applied to the other nodes of the network entity.

Rescuing trusted nodes from filtering of untrusted network entities

Safe file transmission and reputation lookup. As a part of the safe file transmission and reputation lookup methodology, a data file that is to be made available to a data file receiver is accessed and it is determined whether the data file needs to be provided a protective file. The data file is wrapped in a protective file to create a non-executing package file. Access is provided to the non-executing package file where the associated data file is prevented from being executed until data file reputation information is received.

Functionality is described for addressing a threat to the security of a user device that utilizes a network-accessible service. The functionality operates by assessing the likelihood that the user device is infected by the undesirable item. When the user device makes a request to access the network-accessible service, the functionality can interact with the user device in a manner that is governed by the assessed likelihood that the user device is infected by the undesirable item.

Growing community of inventors

Bellevue, WA, United States of America

Ivan Osipkov