DETECTING SPAM MESSAGES USING RAPID SENDER REPUTATION FEEDBACK ANALYSIS

• US 20090013054A1
• Filed: 07/06/2007
• Published: 01/08/2009
• Est. Priority Date: 07/06/2007
• Status: Active Grant

• Current Assignee: Yahoo Assets LLC
• Original Assignee: Yahoo! Inc. (Apollo Global Management, Inc.)
• Inventors: Sample, Neal, Farmer, F. Randall, Morningstar, Chip, Libbey, Miles, Mohsenzadeh, Mohammad
• Granted Patent: US 7,937,468 B2
• Time in Patent Office: Days
• US Class Current: 709/207
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A network device and method are directed towards detecting and blocking spam within a message by rapidly performing a predication analysis based on early received sender reputation reports. Reputation reports may be received from a plurality of users receiving messages that they interpret as either spam or non-spam. A reputation report rate prediction table is employed to predict the total number of user reports that will occur. The total number of spam reports and not spam (ham) reports for may then be used with a sender categorization model to rapidly predict whether the sender is likely to be a spammer. If the sender is determined to be a spammer, various preventative actions may be taken, including, but not limited to blocking messages from the sender to users, alerting third party filter generators of the spammer, or the like.

Claims

1. A network device for selectively managing delivery of messages over a network, comprising:

a transceiver to send and receive data over the network; and

a processor that is operative to perform actions, including;

receiving, from a user, a spam report indicating that a message sender is sending spam;

determining a time in which the spam report is received;

predicting a total number of spam reports expected based in part on the received spam report and the time;

using the predicted total number of spam reports to statistically categorize a reputation of the message sender; and

if the message sender is categorized as a spammer, performing an action to prevent another message being sent to the user from the message sender.

2. The network device of claim 1, wherein the processor that is operative to perform actions, further comprises:

receiving a not spam report indicating that the message sender is not sending spam;

predicting a total number of not spam reports expected based in part on the received not spam report and the time; and

employing the total number of not spam reports to further statistically categorize the reputation of the message sender.

3. The network device of claim 1, wherein statistically categorizing the reputation further comprises:

determining a quickness adjustment multiplier based on a time bucket associated with the time in which the spam report is received, and an expected percent of spam reports for the time bucket.

4. The network device of claim 1, wherein the processor that is operative to perform actions, further comprises:

receiving a inbox volume indicator for a number of messages in the user'"'"'s inbox;

determining a percent spam report rate based on a ratio of predicted total number of spam reports to the inbox volume; and

statistically determine whether the percent spam report rate indicates if the message sender is likely to be a spammer.

5. The network device of claim 1, wherein the processor that is operative to perform actions, further comprises:

if the statistical categorization of the message sender indicates that the message sender is likely to have a good reputation, allowing additional messages to be sent by the message sender to the user.

6. The network device of claim 1, wherein the processor that is operative to perform actions, further comprises:

if the statistical categorization of the message sender indicates that a network address identified with the message sender may not be an actual network address of the message sender, employing additional network address information to further categorize the reputation of the message sender.

7. The network device of claim 1, wherein the processor that is operative to perform actions, further comprises:

receiving additional reports including at least one of a honeypot hit report indicating receiving of messages from the message sender at a fake mailing address, a bulk volume report, a not spam report, or a address book entry report; and

employing the additional reports to further statistically categorize the reputation of the message sender.

8. A method for use in managing delivery of content over a network, comprising:

receiving, from at least one user, at least one spam report indicating that a message sender is sending spam;

receiving a number indicating an inbox volume for the at least one user;

determining a time in which the at least one spam report is received;

determining a quickness multiplier associated with the at least one spam report and the time;

determining a percent total expected spam report rate using the quickness multiplier, inbox volume, and the at least one spam report;

using the percent total expected spam report rate to statistically categorize a reputation of the message sender; and

if the message sender is categorized as a spammer, performing an action to prevent another message being sent to the user from the message sender.

9. The method of claim 8, further comprising:

receiving, from at least one other user, at least one not spam report indicating that a message sender is not sending spam;

receiving a reputation report associated with the at least one other user sending the at least one not spam report;

determining a karma quickness multiplier associated with the at least one not spam report, the reputation report, and the time;

determining a percent ham report rate based in part on the karma quickness multiplier, and the at least one not spam report; and

modifying the categorization of the reputation of the message sender based on the percent ham report rate.

10. The method of claim 9, further comprising:

receiving at least one address book entry report indicating that the message sender is known by the at least one user; and

employing the at least one at least address book entry report to modify the percent ham report rate.

11. The method of claim 8, wherein determining the quickness multiplier further comprises:

determining a number of time buckets for receiving reputation reports, including spam reports;

determining an expected number of spam reports to be received for each of the time buckets;

determining the quickness multiplier by determining a ratio of received at least one spam reports to an expected number of spam reports for the determined time to the number of time buckets.

12. The method of claim 8, further comprising:

if the statistical categorization of the message sender indicates that the message sender is likely to have a good reputation, allowing additional messages to be sent by the message sender to the user; and

if the statistical categorization of the message sender is indeterminate based in part on a insufficient number of spam reports, and not spam reports, deferring categorization of the message sender, and enabling an additional message to be received by the at least one user from the message sender.

13. The method of claim 8, using a sender categorization model to statistically categorize the message sender'"'"'s reputation into at least one or a spammer, not a spammer, indeterminate, or that the message sender'"'"'s network address improperly identifies the message sender.

14. The method of claim 8, further comprising:

receiving at least one honeypot hit report indicating that the message sender has sent at least one message to a fake email address; and

employing the at least one at least one honeypot hit report to modify the percent total expected spam rate.

15. A system for use in selectively enabling delivery of content over a network, comprising:

a dispatcher service configured to receive a plurality of events associated with a reputation of a message sender;

a sender reputation engine that is configured to receive the plurality of events and to perform actions, including;

determining a quickness multiplier based on a received number of spam reports received in the events for a given time;

predicting a total number of percent spam reports are expected about the message sender based on the received events and the quickness multiplier;

using the predicted total number of percent spam reports to statistically categorize a reputation of the message sender; and

if the message sender is categorized as a spammer, performing an action to prevent another message being sent to the user from the message sender.

16. The system of claim 15, wherein the sender reputation engine is configure to perform actions, further comprises:

determining a karma quickness multiplier based on a received number of not spam reports received in the events for a given time;

predicting a total number of percent not spam reports are expected about the message sender based on the received events and the karma quickness multiplier; and

using the predicted total number of percent not spam reports to modify the categorization of the reputation of the message sender;

17. The system of claim 16, further comprising:

receiving at least one address book entry indicating that a user knows the message sender as other than a message spammer; and

employing the at least one address book entry to modify the predicting a total number of percent not spam reports.

18. The system of claim 15, wherein the received events further comprises at least one of a honeypot hit report indicating if the message sender has sent a message to a fake message address, and employing the honeypot hit report to modify the predicted total number of percent spam reports.

19. The system of claim 15, wherein predicting a total number of percent spam reports further comprises employing an inbox volume report to predict the total number of percent spam reports for the message sender.

20. The system of claim 15, determining a quickness multiplier further comprises further employing an expected number of percent spam reports for a given time to determine the quickness multiplier.