Detection of outbound sending of spam

摘要

The invention provides for at least three processes for detecting the probability of abusive use of a message account for sending large amounts of unsolicited messages, such as spam, to other message accounts. For example, information provided at registration for a new message account can be processed to determine the likelihood of abusive use of that message account. Also, inbound messages can be processed to determine if the message account that sent the inbound message is abusing the use of that message account. Additionally, outbound messages can be processed to determine if the message account that is attempting to send an outbound message is abusing the use of that message account. Each of these three processes can operate separately or in any combination with each other to further improve the probability that abusive use of a message account will be detected promptly and accurately.

主权项

1. A network device, comprising:
a transceiver to send and receive data over a network; and a processor that receives data from and sends data to the transceiver, and performs actions, including: intercepting a message that is sent outbound from a message account to a message destination; parsing the outbound message to identify a plurality of message characteristics; analyzing the plurality of message characteristics to determine a plurality of probability values for the message; assigning a probability score to the outbound message based in part on the determined plurality of probability values and previously determined data and probability scores for a plurality of other message accounts; selectively classifying the outbound message as abusive based on the assigned probability score being at or above a determined threshold value; if the outbound message is classified as abusive, inhibiting sending of the outbound message over the network; otherwise, enabling the outbound message to be sent towards the message destination; in response to a request from a new user for a registration for a new message account:
obtaining at least biographical information, a username and a password provided by the new user and a network address that is associated with the request;determining a plurality of user probability values for the new user based at least on the biographical information, a username and a password and the network address that is associated with the request;determining a degree of similarity of at least a portion of the new user's contact information to at least a portion of multiple other user registration information provided for registering at least another message account within a defined time period; andif the plurality of user probability values are classified as abusive in comparison to at least the determined threshold value, inhibiting the new message account from at least initially sending the outbound message.