Detecting spam messages using rapid sender reputation feedback analysis
First Claim
1. A network device for selectively managing delivery of messages over a network, comprising:
- a transceiver to send and receive data over the network; and
a processor that is operative to perform actions, including;
receiving, from a user, a spam report indicating that a message sender is sending spam;
determining a time in which the spam report is received;
determining a total percent expected spam report rate based in part on the received spam report and the time using in part a reputation report rate prediction mechanism comprising a plurality of time buckets, each time bucket representing an expected percentage of spam reports to be received within a given time period;
using the total percent expected spam report rate to statistically categorize a reputation of the message sender; and
if the message sender is categorized as a spammer, performing an action to prevent another message being sent to the user from the message sender.
6 Assignments
0 Petitions
Accused Products
Abstract
A network device and method are directed towards detecting and blocking spam within a message by rapidly performing a predication analysis based on early received sender reputation reports. Reputation reports may be received from a plurality of users receiving messages that they interpret as either spam or non-spam. A reputation report rate prediction table is employed to predict the total number of user reports that will occur. The total number of spam reports and not spam (ham) reports for may then be used with a sender categorization model to rapidly predict whether the sender is likely to be a spammer. If the sender is determined to be a spammer, various preventative actions may be taken, including, but not limited to blocking messages from the sender to users, alerting third party filter generators of the spammer, or the like.
64 Citations
20 Claims
-
1. A network device for selectively managing delivery of messages over a network, comprising:
- a transceiver to send and receive data over the network; and
a processor that is operative to perform actions, including;
receiving, from a user, a spam report indicating that a message sender is sending spam;
determining a time in which the spam report is received;
determining a total percent expected spam report rate based in part on the received spam report and the time using in part a reputation report rate prediction mechanism comprising a plurality of time buckets, each time bucket representing an expected percentage of spam reports to be received within a given time period;
using the total percent expected spam report rate to statistically categorize a reputation of the message sender; and
if the message sender is categorized as a spammer, performing an action to prevent another message being sent to the user from the message sender. - View Dependent Claims (2, 3, 4, 5, 6, 7)
- a transceiver to send and receive data over the network; and
-
8. A method for use in managing delivery of content over a network, comprising:
- receiving, from at least one user, at least one spam report indicating that a message sender is sending spam;
receiving a number indicating an inbox volume for the at least one user;
determining a time in which the at least one spare report is received;
determining a quickness multiplier associated with the at least one spam report and the time;
determining a total percent expected spam report rate using the quickness multiplier, inbox volume, and the at least one spam report;
using the total percent expected spam report rate to statistically categorize a reputation of the message sender; and
if the message sender is categorized as a spammer, performing an action to prevent another message being sent to the user from the message sender. - View Dependent Claims (9, 10, 11, 12, 13, 14)
- receiving, from at least one user, at least one spam report indicating that a message sender is sending spam;
-
15. A system for use in selectively enabling delivery of content over a network, comprising:
- a dispatcher service configured to receive a plurality of events associated with a reputation of a message sender;
a sender reputation engine that is configured to receive the plurality of events and to perform actions, including;
determining a quickness multiplier based on a received number of spam reports received in the events for a given time;
determining a total percent expected spam report rate about the message sender based on the received events and the quickness multiplier;
using the total percent expected spam report rate to statistically categorize a reputation of the message sender; and
if the message sender is categorized as a spammer, performing an action to prevent another message being sent to the user from the message sender. - View Dependent Claims (16, 17, 18, 19, 20)
- a dispatcher service configured to receive a plurality of events associated with a reputation of a message sender;
Specification