Search Ranger System and Double-Funnel Model For Search Spam Analyses and Browser Protection

• US 20080301139A1
• Filed: 05/31/2007
• Published: 12/04/2008
• Est. Priority Date: 05/31/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wang, Yi-Min, Ma, Ming
• Granted Patent: US 9,430,577 B2
• Time in Patent Office: Days
• US Class Current: 707/7
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

An exemplary system for monitoring search spam and protecting against search spam includes a self-monitoring subsystem to uncover spam patterns and a self-protection subsystem to protect against spam by providing spam-related information to strengthen a relevance ranking algorithm. An exemplary architecture for monitoring search spam includes a first component to receive one or more spammer targeted keywords and to search, scan and analyze URLs based at least in part on the one or more spammer targeted keywords, a second component to receive one or more URLs from the first component and to verify one or more of these URLs as a spam URL and a third component to collect spammer targeted keywords associated with one or more spam URLs and to provide one or more of the spammer targeted keywords to the first component. Other methods, systems, etc., are also disclosed.

Claims

1. An architecture for monitoring search spam, the architecture comprising:

a first component to receive one or more spammer targeted keywords and to search, scan and analyze URLs based at least in part on the one or more spammer targeted keywords;

a second component to receive one or more URLs from the first component and to verify one or more of these URLs as a spam URL; and

a third component to collect spammer targeted keywords associated with one or more spam URLs and to provide one or more of the spammer targeted keywords to the first component,

wherein each of the first, second and third component are implemented at least in part by a computing device.

2. The architecture of claim 1 further comprising an output to output one or more spam URLs to analyze a ranking algorithm for ranking search results based at least in part on a keyword.

3. The architecture of claim 1 further comprising an output to output one or more spammer targeted keywords to analyze a ranking algorithm for ranking search results based at least in part on a keyword.

4. The architecture of claim 1 wherein the second component identifies one or more spam heavy domains associated with the one or more spam URLs.

5. The architecture of claim 4 further comprising an output to output the one or more spam heavy domains to analyze a ranking algorithm for ranking search results based at least in part on a keyword.

6. The architecture of claim 1 further comprising one or more protection components.

7. The architecture of claim 6 wherein the one or more protection components comprises a spam forum hunter component.

8. The architecture of claim 6 wherein the one or more protection components comprises a URL extractor component to receive a list of one or more spammed forums, to extract one or more spam URL suspects from a spammed forum.

9. The architecture of claim 6 wherein the one or more protection components comprises a targeted patrol and hunting component to target and patrol spam heavy domains and/or forums.

10. The architecture of claim 6 wherein the one or more protection components protect one or more search engine ranking algorithms for ranking search results.

11. A method, implemented at least in part by a computing device, for grouping suspected spam URLs, the method comprising:

receiving a spammer targeted keyword;

inputting the spammer targeted keyword to a search engine to generate search results;

selecting a search result;

recording one or more URLs associated with the selected search result; and

grouping the one or more recorded URLs using similarity-based grouping.

12. The method of claim 11 wherein the one or more recorded URLs comprise at least one redirection URL.

13. The method of claim 11 wherein the similarity-based grouping comprises grouping based at least in part on doorway/domain similarity.

14. The method of claim 11 wherein the grouping further comprises identifying a domain associated with one or more doorways.

15. The method of claim 11 wherein the grouping comprises grouping one or more of the recorded URLs with a preexisting group.

16. The method of claim 11 wherein the recording comprises redirection tracking.

17. The method of claim 16 wherein the redirection tracking comprises intercepting redirection traffic.

18. The method of claim 11 wherein the selecting comprises generating click-through traffic.

19. The method of claim 11 further comprising verifying a URL of a group as a spam URL.

20. The method of claim 19 wherein the verifying comprises at least one member selected from a group consisting of determining if redirection occurred to a new domain with an IP address associated with a known spammer, determining if link-query results include a large number of forums popular with spammers, determining if a page uses scripting on/off cloaking to achieve crawler-browser cloaking, determining if a page uses click-through cloaking, determining if a page is an ads portal that forwards ads click-through traffic to a known spam-traffic aggregator domain, determining if a page is hosted on a known spam heavy domain, determining if characteristics of an image matches characteristics of an image of a known spammer, and determining if a script matches a script of a known spammer.

21. The method of claim 20 further comprising generating a list wherein the list comprises a member selected from a group consisting of a list of domains ranked by the number of unique confirmed spam URLs they host, a list of domains ranked by their number of spam appearances in search results, and a list of domains ranked by their spam percentages.

22. A method, implemented at least in part by a computing device, the method comprising:

scanning each URL in a set of URLs;

recording all redirection URLs for each scanned URL;

classifying URLs that redirect to a known spammer redirection domain as spam URLs; and

grouping unclassified URLs by each 3rd party domain that received redirection traffic.

23. The method of claim 22 further comprising verifying if the classified spam URLs are spam URLs.

24. The method of claim 22 further comprising verifying if the grouped, unclassified URLs are spam URLs.

25. A system for monitoring search spam and protecting against search spam, the system comprising:

a self-monitoring subsystem to uncover spam patterns; and

a self-protection subsystem to protect against spam by providing spam-related information to strengthen a relevance ranking algorithm.