Yahoo! Inc.

Google Inc.

Oath Inc.

Vishwanath Tumkur Ramarao

Mark Risher

Naveen Jamal

Xiaopeng Xi

Parag Avinash Namjoshi

Cory Mitchell O'Connor

Youngnam Maeng

Tejaswi Nadahalli

Sonal Rajan

Belle L Tseng

Anirban Kundu

Jyh-Shin Shue

Lei Zheng

Sharat Narayan

Markus Weimer

Young Maeng

Bhasker Hariharan

Stanley Ke Wei

Andrei Z Broder

Edo Liberty

Anirban Dasgupta

Idan Szpektor

Wei Chu

Yehuda Arie Koren

Dragomir Dimitrov Yankov

Yoelle Maarek Smadja

Jay Pujara

Martin Zinkevich

Koushik Deepak Narayana

John Nathan Boyd

Paul Sokha Kim

Embodiments are directed towards multi-level entity classification. An object associated with an entity is received. In one embodiment the object comprises and email and the entity comprises the IP address of a sending email server. If the entity has already been classified, as indicated by an entity classification cache, then a corresponding action is taken on the object. However, if the entity has not been classified, the entity is submitted to a fast classifier for classification. A feature collector concurrently fetches available features, including fast features and full features. The fast classifier classifies the entity based on the fast features, storing the result in the entity classification cache. Subsequent objects associated with the entity are processed based on the cached result of the fast classifier. Then, a full classifier classifies the entity based on at least the full features, storing the result in the entity classification cache.

Anti-spam transient entity classification

Embodiments are directed towards generating a unified user account trustworthiness system through user account trustworthiness scores. A trusted group of user accounts may be identified for a given action by grouping a plurality of user accounts into tiers based on a trustworthiness score of each user account for the given action. The tiers and/or trustworthiness scores may be employed to classify an item, such as a message as spam or non-spam, based on input from the user accounts. The trustworthiness scores may also be employed to determine if a user account is a robot account or a human account. The trusted group for a given action may dynamically evolve over time by regrouping the user accounts based on modified trustworthiness scores. A trustworthiness score of an individual user account may be modified based on input received from the individual user account and input from other user accounts.

User trustworthiness

The problem of abuse of privileges at cloud-hosted service sites is addressed by connecting a single individual or 'actor' with multiple user accounts and/or other online identities, thereby creating a 'consolidated profile.' In this way a confidence level can be established that a particular user account, IP address or other identifying attribute is associated with a particular actor. Different confidence levels may suffice depending on the remediary action to be taken; for example, holding a message for human review is obviously less draconian than rejecting the actor's registration at sign-up, and would therefore require a lower degree of confidence.

Detection and prevention of unwanted content on cloud-hosted services

The problem of abuse of privileges at cloud-hosted service sites is addressed by associating each user, preferably across multiple cloud-hosted service sites, with an individual 'suspiciousness' score that may vary over time as additional user actions are detected and evaluated. Knowledge of the user is employed to better analyze the appropriateness or acceptability of user actions on the site.

The problem of abuse of privileges at cloud-hosted service sites is addressed at the sign-up stage by identifying suspicious or abusive users and preventing them from signing up in the first place. This approach may utilize a relatively small initial data set based on the recognition that while abusers' profiles are mutable and difficult to characterize stably&#x2014;abusers will deliberately shift their usage patterns to evade detection&#x2014;a site's legitimate users tend to have similar and stable characteristics; that is, such characteristics are 'cohesive' across cloud-hosted service (e.g., social media) sites and their users. The information gleaned from analysis of this small data set can be applied to a much larger, unsorted data set to obtain profiling criteria based on a large population for statistical reliability.

The invention provides for at least three processes for detecting the probability of abusive use of a message account for sending large amounts of unsolicited messages, such as spam, to other message accounts. For example, information provided at registration for a new message account can be processed to determine the likelihood of abusive use of that message account. Also, inbound messages can be processed to determine if the message account that sent the inbound message is abusing the use of that message account. Additionally, outbound messages can be processed to determine if the message account that is attempting to send an outbound message is abusing the use of that message account. Each of these three processes can operate separately or in any combination with each other to further improve the probability that abusive use of a message account will be detected promptly and accurately.

Detecting spam from a bulk registered e-mail account

Detection of outbound sending of spam

Detecting bulk fraudulent registration of email accounts

Embodiments are directed towards identifying auto-folder tags for messages by using a combinational optimization approach of bi-clustering folder names and features of messages based on relationship strengths. The combinational optimization approach of bi-clustering, generally, groups a plurality of folder names and a plurality of features into one or more metafolders to optimize a cost. The cost is based on an aggregate of cut relationship strengths, where a cut results when a relationship folder name and feature are grouped in separate metafolders. Furthermore, the plurality of folder names and the plurality of features are obtained by monitoring actions of a plurality of users, where the folder names are user generated folder names and features are from a plurality of messages. The metafolders may be used to tag new user messages with an auto-folder tag.

Mining global email folders for identifying auto-folder tags

Embodiments are directed towards classifying messages as spam using a two phased approach. The first phase employs a statistical classifier to classify messages based on message content. The second phase targets specific message types to capture dynamic characteristics of the messages and identify spam messages using a token frequency based approach. A client component receives messages and sends them to the statistical classifier, which determines a probability that a message belongs to a particular type of class. The statistical classifier further provides other information about a message, including, a token list, and token thresholds. The message class, token list, and thresholds are provided to the second phase where a number of spam tokens in a given message for a given message class are determined. Based on the threshold, the client component then determines whether the message is spam or non-spam.

Spam filtering based on statistics and token frequency modeling

Multiple features of email traffic are analyzed and extracted. Feature vectors comprising the multiple features are created and cluster analysis is utilized to track spam generation even from dynamically changing or aliased IP addresses.

Classification and cluster analysis spam detection and reduction

User behavior relative to particular web pages is reported on. The user behavior is represented by historical raw transaction data for the users with respect to the web pages. A collection of the historical raw transaction data is processed, including aggregating the historical raw transaction data and storing the aggregated historical raw transaction data. A report query is received and the aggregated historical raw transaction data is processed based on the report query. A report is caused to be generated based on the result of processing the aggregated historical raw transaction data.

User behavior reporting based on pre-aggregated activity data

Growing community of inventors

Sunnyvale, CA, United States of America

Vishwanath Tumkur Ramarao