Microsoft Technology Licensing, LLC

Other

Weisheng Li

Usman Ahmed Shami

Ravi Kiran Reddy Poluri

Jia Liu

Bin Benjamin Zhu

Ning Xu

Mauktik Gandhi

Alexander Nikolayev

Michael Abraham Betser

Mihai Costea

Wei-Quiang Michael Guo

Mohit Sewak

David Nicholas Yost

Milenko Drinic

William Blum

Sharada Shirish Acharya

Vaishali De

Hua Ding

Christian Rudnick

Pak On Chan

Ravi Kiran R Poluri

Phanindra Pampati

Sihong Liu

Hai Xin

Ravi Kiran Poluri

Aparna Rangarajan

The technology described herein determines whether a candidate text is in a requested class by using a generative model that may not be trained on the requested class. The present technology may use of a model trained primarily in an unsupervised mode, without requiring a large number of manual user-input examples of a label class. The may produce a semantically rich positive example of label text from a candidate text and label. Likewise, the technology may produce from the candidate text and the label a semantically rich negative example of label text. The labeling service makes use of a generative model to produce a generative result, which estimates the likelihood that the label properly applies to the candidate text. In another aspect, the technology is directed toward a method for obtaining a semantically rich example that is similar to a candidate text.

Automatic labeling of text data

Methods, systems, and computer storage media for providing a multi-attribute cluster-identifier that supports identifying malicious activity in computing environments. An instance of an activity having an attribute set can be assessed. The attribute set of the instance of the activity is analyzed to determine whether the instance of the activity is a malicious activity. The attribute set of the instance of the activity is compared to a plurality of multi-attribute cluster-identifiers of previous instances of the activity, such that, a determination that the instance of the activity is a malicious activity is made when the attribute set of the instance of the activity corresponds to an identified multi-attribute cluster-identifier. The identified multi-attribute cluster-identifier has a risk score and an attribute set that indicate a likelihood that the instance of the activity is a malicious activity. A visualization that identifies the instance of the activity as a malicious activity is generated.

Campaign intelligence and visualization for combating cyberattacks

The technology described herein visibly depicts hidden message traits to help users determine whether an email is genuine or deceptive. The hidden message traits are revealed by identifying and changing attributes that keep the hidden traits from being displayed in a rendered message. Spam messages, phishing messages, and messages that include or link to malicious programs (e.g., malware, ransomware) are examples of unwanted messages that can harm a recipient. These messages often rely on deception to get past email filtering systems and to trick a user into acting on content in a message. The deception often involves including hidden traits in a message that fool an automated filtering system. The technology described herein shows the visible traits to a user by including them in the rendered version of the message.

Email security analysis

Aspects of this disclosure include fuzzy inclusion based impersonation detection technology. In one embodiment, a reverse n-gram map is created for the list of protected entities. A suspicious string may be broken into n-grams, and each n-gram of the suspicious string is to be searched in the reverse n-gram map for corresponding protected entities. A fuzzy inclusion of a protected entity may be detected in the suspicious string depending on the protected entities found during the search. Subsequently, impersonation can be identified based on the characteristics of the fuzzy inclusion. In this way, the communication system can detect impersonation techniques using visually similar text, and accordingly take various actions to help user mitigate risks caused by impersonation.

Fuzzy inclusion based impersonation detection

A messaging application filters electronic messages based on domain attributes without a reputation. A message with a uniform resource identifier (URI) is received and determined to not be included within a trusted or a block list. A total score is computed from weighted scores assigned to factors associated with the message. The message is evaluated for an unsolicited message determination by comparing the total score against a predetermined threshold.

Filtering electronic messages based on domain attributes without reputation

The overlay human interactive proof system ('OHIPS') and techniques described herein operate in conjunction with any known or later developed computer-based applications or services to provide secure access to resources by reliably differentiating between human and non-human users. Humans have a generally superior ability to differentiate misaligned characters or objects from correctly aligned ones. As such, the OHIP splits an image including one or more visual objects into two or more partial images to form a HIP. The partial images may also be further split into groups of sub-partial images, and/or the partial images (or the sub-partial images) may be moved, so that at any given alignment position, a user can recognize only some visual objects. A user is instructed to reassemble the partial images at one or more predetermined alignment positions using a GUI, and the user is asked to identify information regarding one or more visible objects.

Overlay human interactive proof system and techniques

A method is provided for protecting an on-line resource using a HIP challenge. The method includes receiving a request to access the on-line resource from a remote client. A HIP challenge is presented to a user associated with the remote client. If a successful response to the HIP challenge is received from the user, a previous response pattern of the user is compared to known response patterns of humans and machines. The user is allowed to access to the on-line resource if the comparison indicates that the user is likely a human.

Enhanced human interactive proof (HIP) for accessing on-line resources

Spammers, and other abusers of web services, may be deterred in their attempts to sign up for these services at large scale by making changes to the service registration procedure, where the changes are designed to break the spammer's infrastructure. In one example, a procedure to register for a web service involves presenting a Human Interaction Proof (HIP, or 'captcha') to the user, and gating access to the service upon receipt of a correct solution. If spammers use botnets and/or image capture techniques to initiate registration processes and to transport the HIPs to human or automated solvers, then the registration procedure can be changed in a way that is incompatible with capturing these images, or in a way that is incompatible with receiving HIP solutions from someplace other than the location at which registration was initiated.

Preventing abuse of services through infrastructure incompatibility

The HIP creation technique described herein pertains to a technique for creating a human interactive proof (HIP) by applying tearing and/or a conformal transformation to a string of characters while maintaining readability of text. In one embodiment, the technique tears a character string into two or more pieces and applies conformal transformation to warp the pieces in order to create a HIP. The transformation changes the shape and orientation of the characters but preserves angles of the characters which makes it easy for humans to recognize the characters after the transformation. Other embodiments of the technique create HIPs by applying tearing only to a string of characters, or by applying conformal transformation only to the character string.

Tearing and conformal transformation human interactive proof

A method for generating one or more human interactive proofs (HIPs) is described herein. A HIP request may be received. One of a plurality of HIP engines may be selected using a randomization algorithm. Each HIP engine may have a distinct algorithm for generating the one or more HIPs. The one or more HIPs may be generated using the one of the plurality of HIP engines.

Growing community of inventors

Bothell, WA, United States of America

Weisheng Li