REPUTATIONAL AND BEHAVIORAL SPAM MITIGATION

• US 20130018965A1
• Filed: 07/12/2011
• Published: 01/17/2013
• Est. Priority Date: 07/12/2011
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ramachandran, Aravind K., Davis, Malcolm Hollis, Costea, Mihai
• Application Number:
  US13/180,877
• Publication Number:
  US 20130018965A1
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06Q 50/01 Social networking

Abstract

One or more techniques and/or systems are provided for identifying abusive message objects (e.g., URLs, email addresses, etc.), abusive infrastructure components and/or abusive users of a message communication medium(s). In particular, abusive message objects may be identified by aggregating abuse reports to assign abuse values to message objects used within messages by reported users identified within the abuse reports. Abusive users may be identified based upon (e.g., unreported) users that have sent messages comprising message objects identified as abusive. Users may also be identified as abusive users based upon account usage patterns within the message communication medium(s) (e.g., a broadcast usage pattern where a user sends a large number of messages, but receives few responses). Additionally, infrastructure components associated with abusive users may be identified as abusive infrastructure components. In this way, abusive content, such as spam, may be identified and/or mitigated within the message communication medium(s).

Claims

1. A method for identifying abusive message objects used within messages, comprising:

defining a message object list comprising one or more message objects used within messages of a message communication medium, a message object within the message object list associated with an abuse value;

for respective abuse reports associated with one or more users of the message communication medium;

determining a reported user associated with an abuse report;

identifying one or more messages sent by the reported user, an identified message comprising at least one message object; and

incrementing one or more abuse values within the message object list for message objects associated with one or more identified messages sent by the reported user; and

defining an abusive message object list based upon message objects within the message object list having abuse values above a threshold.

2. The method of claim 1, a message object comprising at least one of a URL, a phone number, an email address, and a social network link.

3. The method of claim 1, the message communication medium comprising at least one of instant message communication, email communication, social network communication, and SMS communication.

4. The method of claim 1, comprising:

identifying a user as an abusive user based upon the user being associated with one or more message objects defined within the abusive message object list.

5. The method of claim 4, comprising:

identifying an infrastructure component as an abusive infrastructure component based upon determining the infrastructure component is associated with the abusive user, the infrastructure component comprising at least one of a URL rollup, a hostname, a domain, an IP address associated with a login of the abusive user, an IP address associated with a message sent by the abusive user, an IP address associated with a website that hosts a URL, an IP address associated with a host that hosts a URL, an IP range, a name server, and a site owner associated with an autonomous system number.

6. The method of claim 1, comprising:

identifying a user as an abusive user based upon determining that the user is a reported user and is associated with a broadcast usage pattern within the message communication medium, the broadcast usage pattern indicating that the user sends a number of messages without action by recipient users above a threshold.

7. The method of claim 1, comprising:

identifying a user as an abusive user based upon the user being a reported user and a number of unaccepted friend invites from the user above a threshold.

8. The method of claim 1, comprising:

identifying a user as an abusive user based upon the user being a reported user and an account activity pattern of the user indicative of at least one of;

a number of logins within a time span above a threshold;

a number of logins from different IP addresses above a threshold;

a number of logins from different geographical locations above a threshold;

account usage within a time span above a threshold; and

a number of offline messages compared with online messages above a threshold.

9. The method of claim 1, comprising:

assigning an abuse value to a user based upon the user being associated with one or more message objects defined within the abusive message object list.

10. The method of claim 9, comprising:

updating the abuse value of the user based upon the user being associated with an abusive message behavior pattern associated with a second message communication medium.

11. The method of claim 9, comprising:

throttling a message send rate associated with the user based upon the abuse value.

12. The method of claim 1, comprising:

assigning an abuse value to a message object within the message object list based upon a number of messages comprising the message object compared with a number of recipients invoking the message object within messages.

13. A computer readable medium comprising computer executable instructions that when executed via a processing unit perform a method for identifying an abusive user of a message communication medium, comprising:

assigning an abuse value to a user based upon a broadcast usage pattern of the user within a message communication medium, the broadcast usage pattern indicating that the user sends a number of messages without action by recipient users above a threshold; and

identifying the user as an abusive user based upon the abuse value being above a threshold.

14. The method of claim 13, the message communication medium comprising instant message communication.

15. The method of claim 13, comprising:

assigning the abuse value based upon an account activity pattern of the user indicative of at least one of;

a number of logins within a time span above a threshold;

a number of logins from different IP addresses above a threshold;

a number of logins from different geographical locations above a threshold;

account usage within a time span above a threshold; and

a number of offline messages compared with online messages above a threshold.

16. The method of claim 13, comprising:

assigning the abuse value based upon the user being associated with one or more abusive message objects defined within an abusive message object list, the abusive message object list based upon aggregated abuse report data of users of the message communication medium.

17. A system for identifying abusive message objects used within messages by users of a message communication medium, comprising:

a message object identifier configured to;

define a message object list comprising one or more message objects used within messages of a message communication medium, a message object within the message object list associated with an abuse value;

an abusive message object identifier configured to;

for respective abuse reports associated with one or more users of the message communication medium;

determine a reported user associated with an abuse report;

identify one or more messages sent by the reported user, an identified message comprising at least one message object; and

increment one or more abuse values within the message object list for message objects associated with one or more identified messages sent by the reported user; and

define an abusive message object list based upon message objects within the message object list having abuse values above a threshold.

18. The system of claim 17, comprising:

an abusive user identifier configured to;

identify a user as an abusive user based upon the user being associated with one or more message objects defined within the abusive message object list.

19. The system of claim 17, comprising:

an abusive user identifier configured to;

identify a user as an abusive user based upon determining that the user is a reported user and is associated with a broadcast usage pattern within the message communication medium, the broadcast usage pattern indicating that the user sends a number of messages without action by recipient users above a threshold.

20. The system of claim 18, the abusive user identifier configured to:

identify an infrastructure component as an abusive infrastructure component based upon determining the infrastructure component is associated with the abusive user, the infrastructure component comprising at least one of a URL rollup, a hostname, a domain, an IP address associated with a login of the abusive user, an IP address associated with a message sent by the abusive user, an IP range, a name server, and a site owner associated with an autonomous system number.