Anti-spam transient entity classification

• US 9,442,881 B1
• Filed: 08/31/2011
• Issued: 09/13/2016
• Est. Priority Date: 08/31/2011
• Status: Active Grant

• Current Assignee: Yahoo Assets LLC
• Original Assignee: Yahoo! Inc. (Apollo Global Management, Inc.)
• Inventors: Weimer, Markus, Maeng, Young, Shue, Jyh-Shin, Narayan, Sharat, Ramarao, Vishwanath Tumkur, Tseng, Belle
• Primary Examiner(s): TANG, KAREN C
• Application Number:
  US13/222,720
• Time in Patent Office: 1,840 Days
• Field of Search: 709/206
• US Class Current: 1/1
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/046 Interoperability with other network applications or services
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 67/2866 Architectures; Arrangements

Abstract

Embodiments are directed towards multi-level entity classification. An object associated with an entity is received. In one embodiment the object comprises and email and the entity comprises the IP address of a sending email server. If the entity has already been classified, as indicated by an entity classification cache, then a corresponding action is taken on the object. However, if the entity has not been classified, the entity is submitted to a fast classifier for classification. A feature collector concurrently fetches available features, including fast features and full features. The fast classifier classifies the entity based on the fast features, storing the result in the entity classification cache. Subsequent objects associated with the entity are processed based on the cached result of the fast classifier. Then, a full classifier classifies the entity based on at least the full features, storing the result in the entity classification cache.

Claims

1. A method, comprising:

receiving, by a processor, a first e-mail message associated with an IP address of a mail server that sent the first e-mail message;

concurrently fetching, by the processor, a plurality of features associated with the IP address, the plurality of features including one or more fast features and one or more of full features, wherein a fast feature comprises a feature that fetches in less than a predefined time threshold, and wherein a full feature fetches in greater than the predefined time threshold;

classifying, by the processor, the IP address with a fast classifier based on the one or more fast features, the fast classifier further classifying a user based on information obtained during user registration with an on-line entity;

determining, by the fast classifier, that the mail server is a spammer;

caching, by the processor, a result of the fast classifier in an entity classification cache;

receiving, by the processor, a second e-mail message associated with the IP address;

performing, by the processor, an action on the second e-mail message based on the cached result of the fast classifier, the action performed on the second-email message comprising an action type selected from a group of action types consisting of discarding the second e-mail message, delivering the second e-mail message to a spam box, and not delivering the second e-mail message;

classifying, by the processor, the IP address with a full classifier based on the one or more full features, the full classifier further classifying the user based on information derived from online user activity; and

caching, by the processor, a result of the full classifier in the entity classification cache.

2. The method of claim 1, wherein a fast feature comprises a value obtained by a direct lookup in a database.

3. The method of claim 1, wherein a full feature comprises a value obtained by aggregating data collected over time or from disparate geographic locations.

4. The method of claim 1, wherein the IP address comprises a user registered with a provider of web-based advertisements, wherein classifying the IP address comprises determining an advertising preference.

5. The method of claim 1, further comprising:

receiving, by the processor, a third e-mail message associated with the IP address; and

performing, by the processor, an action on the third e-mail message based on the cached result of the full classifier, wherein the action performed on the third e-mail message differs from the action performed on the second e-mail message.

6. The method of claim 1, further comprising:

performing, by the processor, a second action on the second e-mail message based on the result of the full classifier if the result of the full classifier differs from the result of the fast classifier.

7. A computing device, comprising:

a processor;

a storage medium for tangibly storing thereon program logic for execution by the processor, the stored program logic comprising;

first e-mail message receiving logic executed by the processor for receiving a first e-mail message associated with an IP address of a mail server that sent the first e-mail message;

fetching logic executed by the processor for concurrently fetching a plurality of features associated with the IP address, the plurality of features including one or more fast features and one or more of full features, wherein a fast feature comprises a feature that fetches in less than a predefined time threshold, and wherein a full feature fetches in greater than the predefined time threshold;

fast classifier classifying logic executed by the processor for classifying the IP address with a fast classifier based on the one or more fast features, the fast classifier further classifying a user based on information obtained during user registration with an on-line entity;

spammer determining logic executed by the processor for determining, by the fast classifier, that the mail server is a spammer;

caching logic executed by the processor for caching a result of the fast classifier in an entity classification cache;

second e-mail message receiving logic executed by the processor for receiving a second e-mail message associated with the IP address;

action performing logic executed by the processor for performing an action on the second e-mail message based on the cached result of the fast classifier, the action performed on the second-email message comprising an action type selected from a group of action types consisting of discarding the second e-mail message, delivering the second e-mail message to a spam box, and not delivering the second e-mail message;

full classifier classifying logic executed by the processor for classifying the IP address with a full classifier based on the one or more full features, the full classifier further classifying the user based on information derived from online user activity; and

result caching logic executed by the processor for caching a result of the full classifier in the entity classification cache.

8. The computing device of claim 7, wherein the IP address comprises a user registered with a provider of web-based advertisements, wherein the fast classifier classifying logic for classifying the IP address comprises determining logic executed by the processor for determining an advertising preference.

9. The computing device of claim 7, further comprising:

third e-mail message receiving logic executed by the processor for receiving a third e-mail message associated with the IP address; and

third e-mail message action performing logic executed by the processor for performing an action on the third e-mail message based on the cached result of the full classifier, wherein the action performed on the third e-mail message differs from the action performed on the second e-mail message.

10. The computing device of claim 7, further comprises:

second action performing logic executed by the processor for performing a second action on the second e-mail message based on the result of the full classifier when the result of the full classifier differs from the result of the fast classifier.

11. The computing device of claim 7, further comprising:

second IP address classifying logic executed by the processor for classifying a second IP address associated with the second e-mail message; and

classification action performing logic executed by the processor for performing the action on the second e-mail message based on the classification of the IP address and the classification of the second IP address.

12. A non-transitory computer-readable storage medium comprising computer-executable instructions for execution by a processor, the instructions comprising:

receiving a first e-mail message associated with an IP address of a mail server that sent the first e-mail message;

concurrently fetching a plurality of features associated with the IP address, the plurality of features including one or more fast features and one or more of full features, wherein a fast feature comprises a feature that fetches in less than a predefined time threshold, and wherein a full feature fetches in greater than the predefined time threshold;

classifying the IP address with a fast classifier based on the one or more fast features, the fast classifier further classifying a user based on information obtained during user registration with an on-line entity;

determining, by the fast classifier, that the mail server is a spammer;

caching a result of the fast classifier in an entity classification cache;

receiving a second e-mail message associated with the IP address;

performing an action on the second e-mail message based on the cache result of the fast classifier, the action performed on the second-email message comprising an action type selected from a group of action types consisting of discarding the second e-mail message, delivering the second e-mail message to a spam box, and not delivering the second e-mail message;

classifying the IP address with a full classifier based on the one or more full features, the full classifier further classifying the user based on information derived from online user activity; and

caching a result of the full classifier in the entity classification cache.

13. The non-transitory computer-readable storage medium of claim 12, wherein a fast feature comprises a value obtained by a direct lookup in a database.

14. The non-transitory computer-readable storage medium of claim 12, wherein a full feature comprises value obtained by aggregating user feedback.

15. The non-transitory computer-readable storage medium of claim 12, wherein the IP address comprises a user registered with a provider of web-based advertisements, wherein classifying the IP address comprises determining an advertising preference.

16. The non-transitory computer-readable storage medium of claim 12, wherein the action further comprises:

receiving a third e-mail message associated with the IP address; and

performing an action on the third e-mail message based on the cached result of the full classifier, wherein the action performed on the third e-mail message differs from the action performed on the second e-mail message.