Microsoft Technology Licensing, LLC

Other

Robert L McCann

Eliot Carleton Gillum

Krishna C Vitaldevara

Jason D Walter

Mehrdad Bidgoli

Geoffrey John Hulten

Malcolm Hollis Davis

Ryan Charles Colvin

Milenko Drinic

Chad W Mills

Ivan Osipkov

Harry Simon Katz

Joshua Korb

Aravind K Ramachandran

Xin Huang

Aleksander R Kolcz

Douglas John Hines

Christian Seifert

Geoff Hulten

Kevin Andrew Chan

Vasantha K Vemula

Eriola Kruja

The disclosed embodiments generate a plurality of anomaly detector configurations and compare results generated by these anomaly detectors to a reference result set. The reference result set is generated by a trained model. A correlation between each result generated by the anomaly detectors and the result set is compared to select an anomaly detector configuration that provides results most similar to those of the trained model. In some embodiments, data defining the selected configuration is then communicated to a product installation. The product installation instantiates the defined anomaly detector and analyzes local events using the instantiated detector. In some other embodiments, the defined anomaly detector is instantiated by the same system that selects the anomaly detector, and thus in these embodiments, the anomaly detector configuration is not transmitted from one system to another.

Dynamic configuration of anomaly detection

The filtering of activities generated by nodes of a network while interacting with a device may be performed by evaluating the desirability of the activities (e.g., a spam or not-spam determination of email messages sent by the node) and assigning a trust rating to the node. However, nodes are often identified by network address, and an operator of a node sending undesirable activities may reassign the network address of the node in order to avoid heavy filtering. Instead, nodes may be identified as being controlled by a network entity (e.g., an autonomous system identified in a border gateway protocol routing table.) The network entity is assigned a network entity trust rating based on the trust ratings of the nodes controlled thereby, and an appropriate level of activity filtering based on the network entity trust rating may be selected for subsequent activities received from all nodes controlled by the network entity.

Activity filtering based on trust ratings of network

A computer implemented method for filtering unwanted bulk email in an email system and providing a positive user experience is provided. The method enables protection of email users from unsolicited bulk email using user-provided data on user interactions at both a user storage level and a global level with an email system. Metadata on user interactions with messages is collected. Messages are received by the system and evaluated using a global filter which assigns a score resulting in a message action. The action may be message delivery, message non-delivery or message routing, based on a score assigned by the global filter. When the message is delivered to user storage, the message may be examined relative to the metadata, and may alter the message action to an action different than the message action resulting from the score. Metadata for a plurality of users is returned to the global filter for use in making filtering future messages and modifies the global filter.

Personalized email interactions applied to global filtering

A system and method of managing unsolicited email sent to an email system over a network. Email messages are received at an message at an inbound mail transfer agent. A determination is made as to whether the email message is suspected to be an unsolicited suspect message. One or more queries for additional information on one or more characteristics of the message is initiated. Determinations are made based on replies to the queries before issuing a message accepted for delivery indication to a sending server.

Real-time spam look-up system

Detecting spam from metafeatures of an email message. As a part of detecting spam, the email message is accessed and a distribution of numerical values is accorded to a set of features of the email message. It is determined whether the distribution of numerical values accorded the set of features of the email message is consistent with that of spam. Access is provided to the determination of whether the email message has a distribution of numerical values accorded the set of features that is consistent with that of spam.

Detecting spam from metafeatures of an email message

Network entities controlling a set of nodes may vary by trustworthiness, such as tolerance for nodes that send spam, distribute malware, or perform denial-of-service attacks. A device receiving such activities may identify a trust rating of the network entity and apply appropriately stringent filtering (such as spam evaluation) to activities received from nodes controlled by the network entity. However, a poor trust rating of a network entity may subject a legitimate node controlled by the network entity to inefficiently or unfairly stringent activity filtering. Instead, the device may evaluate the activities of a particular node, assign a trust rating to the node, and if the trust rating of the node is higher than the trust rating of the network entity, apply less stringent activity filtering to the activities of the node, thereby 'rescuing' the node from the more stringent activity filtering applied to the other nodes of the network entity.

Rescuing trusted nodes from filtering of untrusted network entities

Determining email filtering type based on sender classification. Incoming email is accessed and a sender of the incoming email is identified. The reputation of the sender of the incoming email is determined. An email sender classification is made based on the reputation of the sender. A determination of the type of filtering operations to be performed by an email filter on the email is made based on the classification. The parameters of the type of filtering operations to be performed are determined. The parameters of the type of filtering operations to be performed are provided to the email filter.

Determining email filtering type based on sender classification

A reputation data store provides reputation information to a user regarding the source of an electronic communication via a client. When the client receives an electronic communication, the client queries a reputation data store for reputation information regarding the source of the electronic communication. The client receives the reputation information from the reputation data store and displays the reputation information to the user. The user then decides whether to interact with the source of the electronic communication based on the displayed reputation information. Alternatively, an administrator may decide whether the user may interact with the source of the electronic communication.

Leveraging global reputation to increase personalization

Apparatus for automatically scanning processed radiochromatagram strips. The apparatus comprises a carrier wheel having a processed chromatagram mounted on the periphery thereof by a strip of plastic tape. The wheel carries the processed chromatagram past a radiation detector. Photoelectric means are provided to provide signals indicative of the position of the carrier wheel. The apparatus includes electrical circuitry responsive to the signals produced by the radiation detector to provide a numerical display of the total radioactivity detected along the entire strip and for providing a numerical display of the radioactivity detected along a selected portion of the strip. A strip chart recorder is provided in the apparatus to produce a graphical display of the spectral distribution of the radioactivity along the entire strip. The apparatus includes logic means for controlling the functions of the apparatus to provide a completely automated system.

Growing community of inventors

Fall City, WA, United States of America

Robert L McCann