Detecting bulk fraudulent registration of email accounts

• US 8,826,450 B2
• Filed: 09/17/2009
• Issued: 09/02/2014
• Est. Priority Date: 09/19/2008
• Status: Active Grant

• Current Assignee: Yahoo Assets LLC
• Original Assignee: Yahoo! Inc. (Apollo Global Management, Inc.)
• Inventors: Hariharan, Bhasker, Jamal, Naveen, Kundu, Anirban, Ramarao, Vishwanath Tumkur, Risher, Mark E., Xi, Xiaopeng, Zheng, Lei
• Primary Examiner(s): Dharia, Rupal
• Assistant Examiner(s): MCADAMS, BRAD
• Application Number:
  US12/561,875
• Publication Number:
  US 20100076922A1
• Time in Patent Office: 1,811 Days
• Field of Search: 709/206, 726/27
• US Class Current: 726/27
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/01 Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

The invention provides for at least three processes for detecting the probability of abusive use of a message account for sending large amounts of unsolicited messages, such as spam, to other message accounts. For example, information provided at registration for a new message account can be processed to determine the likelihood of abusive use of that message account. Also, inbound messages can be processed to determine if the message account that sent the inbound message is abusing the use of that message account. Additionally, outbound messages can be processed to determine if the message account that is attempting to send an outbound message is abusing the use of that message account. Each of these three processes can operate separately or in any combination with each other to further improve the probability that abusive use of a message account will be detected promptly and accurately.

Claims

1. A network device, comprising:

a transceiver to send and receive data over a network; and

a processor that receives data from and sends data to the transceiver, and performs actions, including;

receiving registration information associated with a request to create an account for sending a message over a network, wherein the registration information includes at least a username having a plurality of characters;

determining statistics about at least the username during an initial registration of the account;

assigning a probability score to the request based in part on a comparison of the statistics to one or more previously determined statistics of characters in other usernames that have an associated probability value of being registered for abusive sending of messages and a degree of similarity of at least a portion of the registration information to at least a portion of multiple other account registration information provided for registering at least another account within a defined time period;

classifying the request as seeking registration for an account for the abusive sending of messages if the assigned probability score exceeds a predetermined threshold; and

if the request is classified as seeking registration for abusive sending of messages, inhibiting use of the requested account;

otherwise, enabling use of the requested account for sending of at least one message over the network.

2. The network device of claim 1, wherein determining statistics about the username and assigning the probability further comprises:

parsing the plurality of characters in the username to determine various statistics about the username including at least one of a length of the username based on the plurality of characters, a number of transitions between the plurality of characters, a number of digits, a number of letters, or a number of symbols; and

employing one or more rules to assign the probability score based on the statistics about the username.

3. The network device of claim 1, wherein assigning a probability score further comprises:

determining a network domain corresponding with the received username; and

modifying the assigned probability score based on the determined network domain, including based, in part, on whether the determined network domain is determined to be an unknown network domain.

4. The network device of claim 1, wherein assigning a probability score further comprises:

modifying the assigned probability score based in part on previously determined data from another message account that was classified as abusive, wherein the previous determination for the other message account is based in part on at least one of an amount of outbound messages from the other message account within a time period, an amount of previous inbound messages with a similar content from the other message account, or an amount of recipients of inbound messages sent by the other message account.

5. The network device of claim 1, wherein the processor performs actions, further including:

retrieving a plurality of characteristics and probability scores associated with a plurality of other message account registrations;

clustering at least a subset of the plurality of characteristics and probability scores associated with the plurality of other message account registrations based in part on a determined similarity in characteristics;

determining an adjustment for the probability score of the received registration request based on the clustering of at least the subset of plurality of characteristics and probability scores; and

applying the adjustment to the assigned probability score for the request.

6. The network device of claim 5, wherein determining the adjustment for the probability score further comprises employing at least one of a machine learning, artificial intelligence or logical decision tree analysis to further adjust the probability score of the received registration request.

7. A non-transitory processor readable storage medium that includes data and instructions, wherein the execution of the instructions on a computing device by enabling actions, comprising:

receiving a request to create an account for sending a message over a network;

receiving registration information usable to satisfy the request, the registration information having at least a username having a plurality of characters;

assigning a probability score to the request during an initial registration of the account based in part on a statistical analysis of the registration information and the plurality of characters in at least the username and a degree of similarity of at least a portion of the registration information to at least a portion of multiple other account registration information provided for registering at least another account within a defined time period;

classifying the request as seeking registration for an account for the abusive sending of messages if the assigned probability score exceeds a predetermined threshold; and

if the request is classified as seeking registration for abusive sending of messages, inhibiting use of the requested account;

otherwise, enabling use of the requested account for sending of at least one message over the network.

8. The processor readable storage medium of claim 7, wherein the registration information further comprises at least one of a user'"'"'s name, or address, and wherein the username is provided by a requester for the account registration.

9. The processor readable storage medium of claim 7, wherein the analysis of the plurality of characters in at least the username further comprises:

parsing the username to generate one or more characteristics; and

using one or more rules to assign a probability score, the rules being a combination of one or more combinations of characteristics, each one or more combinations of characteristics having an associated probability score, the associated probability score being derived, in part, from an analysis of previously classified abusive message account registrations.

10. The processor readable storage medium of claim 9, wherein the one or more characteristics further comprises at least one of an amount of transitions between characters in the username, a number of digits in the username, a number of symbols in the username, or a length of the username.

11. The processor readable storage medium of claim 7, wherein assigning the probability score further comprises performing additional analysis of the registration information, including a network domain corresponding to the received username.

12. The processor readable storage medium of claim 7, wherein assigning a probability score further comprises:

modifying the assigned probability score based in part on previously determined data from another message account that was classified as abusive, wherein the previous determination for the other message account is based in part on at least one of an amount of outbound messages from the other message account within a time period, an amount of previous inbound messages with a similar content from the other message account, or an amount of recipients of inbound messages sent by the other message account.

13. The processor readable storage medium of claim 7, wherein the instructions enable actions, further including:

retrieving a plurality of characteristics and probability scores associated with a plurality of other message account registrations;

clustering at least a subset of the plurality of characteristics and probability scores associated with the plurality of other message account registrations based in part on a determined similarity in characteristics;

determining an adjustment for the probability score of the received registration request based on the clustering of at least the subset of plurality of characteristics and probability scores; and

applying the adjustment to the assigned probability score for the request.

14. The processor readable storage medium of claim 7, wherein the instructions enable actions, further including:

determining whether the request is associated with a user agent; and

based on the determination adjusting the probability score.

15. A system for enabling a communications over a network, comprising:

a data storage device having stored thereon, a plurality of abusive message account data from at least a plurality of other message account registrations; and

one or more processors configured to employ data from the data storage device to perform actions, including;

receiving registration information associated with a request to create an account for sending a message over a network, wherein the registration information includes at least a username having a plurality of characters;

determining statistics at least about the username during an initial registration of the account;

assigning a probability score to the request based in part on an analysis of the statistics about at least the username and one or more previously determined statistics of characters in other usernames that have an associated probability value of being registered for abusive sending of messages obtained, in part, from the data storage device and a degree of similarity of at least a portion of the registration information to at least a portion of multiple other account registration information provided for registering at least another account within a defined time period;

classifying the request as seeking registration for an account for the abusive sending of messages if the assigned probability score exceeds a predetermined threshold; and

if the request is classified as seeking registration for abusive sending of messages, inhibiting use of the requested account;

otherwise, enabling use of the requested account for sending of at least one message over the network.

16. The system of claim 15, wherein determining statistics about the username and assigning the probability further comprises:

parsing the plurality of characters in the username to determine various statistics about the username including at least one of a length of the username based on the plurality of characters, a number of transitions between the plurality of characters, a number of digits, a number of letters, or a number of symbols; and

employing one or more rules to assign the probability score based on the statistics about the username.

17. The system of claim 15, wherein assigning a probability score further comprises:

determining a network domain corresponding with the received username; and

modifying the assigned probability score based on the determined network domain, including based, in part, on whether the determined network domain is determined to be an unknown network domain.

18. The system of claim 15, wherein the one or more processors perform actions, further including:

determining a plurality of contributing factors from the plurality of abusive message account data from the plurality of other message account registrations;

comparing the determined plurality of contributing factors with the received registration information for the request; and

adjusting the probability score based on the comparison.

19. The system of claim 18, wherein the plurality of contributing factors comprise at least one of a temporal relationship to the request and another request, a velocity of outbound or inbound messages, a number of message recipients, a consistency in short or long messages from the requested account and another account, or a pattern of messages.

20. The system of claim 15, wherein the one or more processors perform actions, further including:

if the requested account is enabled for use;

collecting additional information about activities performed with the requested account;

revising the assigned probability score for the requested account based on the collected additional information; and

if the revised probability score indicates that the requested account is used for abusive sending of messages, inhibit use of the message account.