Microsoft Technology Licensing, LLC

Ryan Charles Colvin

Joshua T Goodman

Robert L Rounthwaite

Robert L McCann

Elliott Jeb Haber

Chad W Mills

Ameya S Bhatawdekar

Gopalakrishnan Seshadrinathan

Geoffrey John Hulten

Eliot Carleton Gillum

Manav Mishra

Anthony Paul Penta

Joshua Korb

Darren Ernest Canavor

Paul J Leach

David Maxwell Chickering

Josh D Benaloh

Chris J Guzak

Jane T Kim

Krishna C Vitaldevara

Anshul Rawat

Xin Huang

Aleksander R Kolcz

Jason D Walter

Warren G Stevens

John J Lambert

Jeffrey Richard McKune

Malcolm Hollis Davis

Daniel Oliver

Robert C J Pengelly

Shawn Domenic Loveland

Elissa E Murphy

Douglas John Hines

Mehrdad Bidgoli

John Scarrow

Geoff Hulten

Jess Holbrook

Kevin Andrew Chan

Paul Stephen Rehfuss

Sarah J Bowers

Nina Kang

Harry Simon Katz

Milenko Drinic

Karanbir Singh

Derek M Hazeur

Crispin Cowan

Jay T Buckingham

Ritika Virmani

Xiang Tu

Eriola Kruja

Jay Dave

Andy Davidson

James Dooley

Elliot J (Jeb) Haber

Robert Lee Mccann

Joshua David Korb

Reputation-based resource lookup may include determining the reputation of resources that are to be accessed. Based on the reputation of the resource, a user experience is provided. Protection can be provided from known and suspicious resources, by providing warnings, such as unique graphical visual warnings and textual messages. Furthermore, additional information may be provided as to the desired resource. A user may be further required to go through several pages or asked various questions before accessing a resource.

Reputation-based safe access user experience

A Web browser of a computing device downloads or otherwise obtains a file. File information identifying the file is obtained and is sent to a remote reputation service. Client information identifying aspects of the computing device can also optionally be sent to the remote reputation service. In response to the file information (and optionally client information), a reputation indication for the file is received from the remote reputation service. A user interface for the Web browser to present at the computing device is determined, based at least in part on the reputation indication, and presented at the computing device.

Reputation checking obtained files

Malware detection is often based on monitoring a local application binary and/or process, such as detecting patterns of malicious code, unusual local resource utilization, or suspicious application behavior. However, the volume of available software, variety of malware, and sophistication of evasion techniques may reduce the effectiveness of detection based on monitoring local resources. Presented herein are techniques for identifying malware based on the reputations of remote resources (e.g., web content, files, databases, IP addresses, services, and users) accessed by an application. Remote resource accesses may be reported to a reputation service, which may identify reputations of remote resources, and application reputations of applications that utilize such remote resources. These application reputations may be used to adjust the application policies of the applications executed by devices and servers. These techniques thereby achieve rapid detection and mitigation of newly identified malware through application telemetry in a predominantly automated manner.

Identifying application reputation based on resource accesses

A system and method of managing unsolicited email sent to an email system over a network. Email messages are received at an message at an inbound mail transfer agent. A determination is made as to whether the email message is suspected to be an unsolicited suspect message. One or more queries for additional information on one or more characteristics of the message is initiated. Determinations are made based on replies to the queries before issuing a message accepted for delivery indication to a sending server.

Real-time spam look-up system

The reputation of an executable computer program is checked when a user input to a computing device initiates a program launch, thus triggering a check of a local cache of reputation information. If the local cache confirms that the program is safe, it is permitted to launch, typically without notifying the user that a reputation check has been made. If the local cache cannot confirm the safety of the program, a reputation check is made by accessing a reputation service in the cloud. If the reputation service identifies the program as safe, it returns an indication to the computing device and the program is permitted to be launched, again without notifying the user that a reputation check has been made. If the reputation service identifies the program as unsafe or potentially unsafe, or does not recognize it at all, a warning is displayed to the user.

Reputation checking of executable programs

Evidence of attempted malware attacks may be used to identify the location and nature of future attacks. A failed attack may cause a program to crash. Crash data may be sent to an analyzer for analysis. The analysis may reveal information such as the identity of the program that is being exploited, the specific way in which the program is being exploited, and the identity or location of the source of the attack. This information may be used to identify potential sources of attack and to identify the same type of attack from other sources. When the source and/or nature of an attempted attack is known, remedial action may be taken. Filters may warn users who are attempting to visit sites from which attacks have been attempted, and the makers of programs that are being exploited can be notified so that those program makers can release updates.

Early detection of potential malware

Detecting spam from metafeatures of an email message. As a part of detecting spam, the email message is accessed and a distribution of numerical values is accorded to a set of features of the email message. It is determined whether the distribution of numerical values accorded the set of features of the email message is consistent with that of spam. Access is provided to the determination of whether the email message has a distribution of numerical values accorded the set of features that is consistent with that of spam.

Detecting spam from metafeatures of an email message

Embodiments of proofs to filter spam are presented herein. Proofs are utilized to indicate a sender used a set amount of computer resources in sending a message in order to demonstrate the sender is not a 'spammer'. Varying the complexity of the proofs, or the level of resources used to send the message, will indicate to the recipient the relative likelihood the message is spam. Higher resource usage indicates that the message may not be spam, while lower resource usage increases the likelihood a message is spam. Also, if the recipient requires a higher level of proof than received, the receiver may request the sender send additional proof to verify the message is not spam.

Proofs to filter spam

Determining email filtering type based on sender classification. Incoming email is accessed and a sender of the incoming email is identified. The reputation of the sender of the incoming email is determined. An email sender classification is made based on the reputation of the sender. A determination of the type of filtering operations to be performed by an email filter on the email is made based on the classification. The parameters of the type of filtering operations to be performed are determined. The parameters of the type of filtering operations to be performed are provided to the email filter.

Determining email filtering type based on sender classification

Identification of email forwarders is described. In an implementation, a method includes using heuristics to identify email forwarders for use in a reputation system for locating spammers. In another implementation, a method includes determining a likelihood that a particular Internet Protocol (IP) address corresponds to an email forwarder and processing email originating from the particular IP address based on the determined likelihood. In a further implementation, a method includes collecting heuristic data that describes characteristics of emails sent from one or more Internet Protocol (IP) addresses and constructing a model from the heuristic data for identifying whether at least one of the IP address is an email forwarder. In yet a further implementation, a method includes identifying that a particular Internet Protocol (IP) address likely corresponds to an email forwarder and processing email from the particular IP address based on an implied sender of the email.

Identification of email forwarders

Disclosed are systems and methods that facilitate securing communication channels used in a challenge-response system to mitigate spammer intrusion or deception. The systems and methods make use of unique IDs that can be added to outbound messages originating from a sender, a recipient, and a third-party server. The IDs can be correlated according to the relevant parties. Thus, for example, a sender can add a signed ID to an outgoing message. A challenge sent back to the sender for that particular message can echo the same ID or a new ID derived from the original ID to allow a sender to verify that the challenge corresponds to an actual message. The IDs can include cookies as well to facilitate correlation of messages and to facilitate the retrieval of messages once a sender is determined to be legitimate.

Challenge response systems

Growing community of inventors

Bothell, WA, United States of America

Ryan Charles Colvin