Yahoo! Inc.

Google Inc.

Mark Risher

Vishwanath Tumkur Ramarao

Naveen Jamal

Anirban Kundu

Parag Avinash Namjoshi

Cory Mitchell O'Connor

Youngnam Maeng

Tejaswi Nadahalli

Sonal Rajan

Lei Zheng

Xiaopeng Xi

Miles Augustus Libbey, Iv

Mark Delany

Bhasker Hariharan

Masumi Taketomi

Andrei Z Broder

Edo Liberty

Idan Szpektor

Yehuda Arie Koren

Yoelle Maarek Smadja

Sharat Narayan

Stanley Ke Wei

The problem of abuse of privileges at cloud-hosted service sites is addressed by connecting a single individual or 'actor' with multiple user accounts and/or other online identities, thereby creating a 'consolidated profile.' In this way a confidence level can be established that a particular user account, IP address or other identifying attribute is associated with a particular actor. Different confidence levels may suffice depending on the remediary action to be taken; for example, holding a message for human review is obviously less draconian than rejecting the actor's registration at sign-up, and would therefore require a lower degree of confidence.

Detection and prevention of unwanted content on cloud-hosted services

The problem of abuse of privileges at cloud-hosted service sites is addressed by associating each user, preferably across multiple cloud-hosted service sites, with an individual 'suspiciousness' score that may vary over time as additional user actions are detected and evaluated. Knowledge of the user is employed to better analyze the appropriateness or acceptability of user actions on the site.

The problem of abuse of privileges at cloud-hosted service sites is addressed at the sign-up stage by identifying suspicious or abusive users and preventing them from signing up in the first place. This approach may utilize a relatively small initial data set based on the recognition that while abusers' profiles are mutable and difficult to characterize stably&#x2014;abusers will deliberately shift their usage patterns to evade detection&#x2014;a site's legitimate users tend to have similar and stable characteristics; that is, such characteristics are 'cohesive' across cloud-hosted service (e.g., social media) sites and their users. The information gleaned from analysis of this small data set can be applied to a much larger, unsorted data set to obtain profiling criteria based on a large population for statistical reliability.

The invention provides for at least three processes for detecting the probability of abusive use of a message account for sending large amounts of unsolicited messages, such as spam, to other message accounts. For example, information provided at registration for a new message account can be processed to determine the likelihood of abusive use of that message account. Also, inbound messages can be processed to determine if the message account that sent the inbound message is abusing the use of that message account. Additionally, outbound messages can be processed to determine if the message account that is attempting to send an outbound message is abusing the use of that message account. Each of these three processes can operate separately or in any combination with each other to further improve the probability that abusive use of a message account will be detected promptly and accurately.

Detecting spam from a bulk registered e-mail account

Detection of outbound sending of spam

Detecting bulk fraudulent registration of email accounts

Embodiments are directed towards identifying auto-folder tags for messages by using a combinational optimization approach of bi-clustering folder names and features of messages based on relationship strengths. The combinational optimization approach of bi-clustering, generally, groups a plurality of folder names and a plurality of features into one or more metafolders to optimize a cost. The cost is based on an aggregate of cut relationship strengths, where a cut results when a relationship folder name and feature are grouped in separate metafolders. Furthermore, the plurality of folder names and the plurality of features are obtained by monitoring actions of a plurality of users, where the folder names are user generated folder names and features are from a plurality of messages. The metafolders may be used to tag new user messages with an auto-folder tag.

Mining global email folders for identifying auto-folder tags

Embodiments are directed towards detecting and reporting use by a domain of a message authentication mechanism, such as DomainKeys (DK), and/or DomainKeys Identified Mail (DKIM), and enabling subsequent blocking of messages based, in part, on its usage. When a message is received by an inbound message server, a message source is determined for the message. In one embodiment, the message source is a domain name associated with the sender of the message. Statistics are recorded about the message, including the message source, whether the message is suspect, includes a forged source identifier, employs DK/DKIM message authentication, and the like. The reports may then be sent to various message sources to enable them to determine the extent of use of DK/DKIM message authentication, and to selectively block, re-direct, or forward the messages based, in part, on the use of DK/DKIM message authentication mechanism.

Blocking of spoofed E-mail

Embodiments are directed towards classifying messages as spam using a two phased approach. The first phase employs a statistical classifier to classify messages based on message content. The second phase targets specific message types to capture dynamic characteristics of the messages and identify spam messages using a token frequency based approach. A client component receives messages and sends them to the statistical classifier, which determines a probability that a message belongs to a particular type of class. The statistical classifier further provides other information about a message, including, a token list, and token thresholds. The message class, token list, and thresholds are provided to the second phase where a number of spam tokens in a given message for a given message class are determined. Based on the threshold, the client component then determines whether the message is spam or non-spam.

Spam filtering based on statistics and token frequency modeling

Embodiments are directed towards detecting and reporting use by a domain of a message authentication mechanism, such as DomainKeys (DK), and/or DomainKeys Identified Mail (DKIM), and enabling subsequent blocking of messages based, in part, on its usage. When a message is received by an inbound message server, a message source is determined for the message. In one embodiment, the message source is a domain name associated with the sender of the message. Statistics are recorded about the message, including the message source, whether the message is suspect, includes a forged source identifier, employs DK/DKIM message authentication, and the like. The reports may ten be sent to various message sources to enable them to determine the extent of use of DK/DKIM message authentication, and to selectively block, re-direct, or forward the messages based, in part, on the use of DK/DKIM message authentication mechanism.

Reporting on spoofed e-mail

Growing community of inventors

San Francisco, CA, United States of America

Mark Risher