Nathan Howell

US Patent:

7272853, Sep 18, 2007

Filed:

Jun 4, 2003

Appl. No.:

10/454168

Inventors:

Joshua T. Goodman - Redmond WA, US
Robert L. Rounthwaite - Fall City WA, US
Daniel Gwozdz - Sammamish WA, US
John D. Mehr - Seattle WA, US
Nathan D. Howell - Seattle WA, US
Micah C. Rupersburg - Seattle WA, US
Bryan T. Starbuck - Duvall WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 29/00

US Classification:

726 13

Abstract:

The present invention involves a system and method that facilitate extracting data from messages for spam filtering. The extracted data can be in the form of features, which can be employed in connection with machine learning systems to build improved filters. Data associated with origination information as well as other information embedded in the body of the message that allows a recipient of the message to contact and/or respond to the sender of the message call be extracted as features. The features, or a subset thereof, can be normalized and/or deobfuscated prior to being employed as features of the machine learning systems. The (deobfuscated) features can be employed to populate a plurality of feature lists that facilitate spam detection and prevention. Exemplary features include an email address, an IP address, a URL, an embedded image pointing to a URL, and/or portions thereof.

US Patent:

7543076, Jun 2, 2009

Filed:

Jul 5, 2005

Appl. No.:

11/174843

Inventors:

John D. Mehr - Seattle WA, US
Nathan D. Howell - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 15/173

US Classification:

709238, 709206, 709207, 709235

Abstract:

Message header spam filtering is described. In an embodiment, a message is received that includes header entries arranged in an ordered sequence which indicates a path by which the message was communicated. The header entries are parsed to categorize each header entry as a header type where the header types are listed in the ordered sequence. A quantity of each different header type is determined, and a determination is made as to whether the message is likely a spam message based at least in part on the quantity corresponding to a particular header type. In another embodiment, a numeric representation of the ordered sequence is created where the numeric representation includes unique integers assigned to each different header type. A determination is made as to whether the message is likely a spam message based at least in part on the numeric representation of the ordered sequence of header types.

US Patent:

7558832, Jul 7, 2009

Filed:

May 2, 2007

Appl. No.:

11/743466

Inventors:

Robert L. Rounthwaite - Fall City WA, US
Joshua T. Goodman - Redmond WA, US
David E. Heckerman - Bellevue WA, US
John D. Mehr - Seattle WA, US
Nathan D. Howell - Seattle WA, US
Micah C. Rupersburg - Seattle WA, US
Dean A. Slawson - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 15/16

US Classification:

709206, 709207, 709223, 709224, 713154

Abstract:

The subject invention provides for a feedback loop system and method that facilitate classifying items in connection with spam prevention in server and/or client-based architectures. The invention makes uses of a machine-learning approach as applied to spam filters, and in particular, randomly samples incoming email messages so that examples of both legitimate and junk/spam mail are obtained to generate sets of training data. Users which are identified as spam-fighters are asked to vote on whether a selection of their incoming email messages is individually either legitimate mail or junk mail. A database stores the properties for each mail and voting transaction such as user information, message properties and content summary, and polling results for each message to generate training data for machine learning systems. The machine learning systems facilitate creating improved spam filter(s) that are trained to recognize both legitimate mail and spam mail and to distinguish between them.

US Patent:

7610344, Oct 27, 2009

Filed:

Dec 13, 2004

Appl. No.:

11/011462

Inventors:

John D. Mehr - Seattle WA, US
Nathan D Howell - Seattle WA, US
Paul S Rehfuss - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 15/16

US Classification:

709206, 709207, 709202, 706 16, 707 10, 715205

Abstract:

Techniques are presented for assigning reputations to email senders. In one implementation, real-time statistics and heuristics are constructed, stored, analyzed, and used to formulate a sender reputation level for use in evaluating and controlling a given sender's connection to an message transfer agent or email recipient. A sender with an unfavorable reputation may be denied a connection before resources are spent receiving and processing email messages from the sender. A sender with a favorable reputation may be rewarded by having safeguards removed from the connection, which also saves system resources. The statistics and heuristics may include real-time analysis of traffic patterns and delivery characteristics used by an email sender, analysis of content, and historical or time-sliced views of all of the above.

US Patent:

7665131, Feb 16, 2010

Filed:

Jan 9, 2007

Appl. No.:

11/621363

Inventors:

Joshua T. Goodman - Redmond WA, US
Robert L. Rounthwaite - Fall City WA, US
Daniel Gwozdz - Sammamish WA, US
John D. Mehr - Seattle WA, US
Nathan D. Howell - Seattle WA, US
Micah C. Rupersburg - Seattle WA, US
Bryan T. Starbuck - Duvall WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 29/06

US Classification:

726 13, 726 22

Abstract:

The present invention involves a system and method that facilitate extracting data from messages for spam filtering. The extracted data can be in the form of features, which can be employed in connection with machine learning systems to build improved filters. Data associated with origination information as well as other information embedded in the body of the message that allows a recipient of the message to contact and/or respond to the sender of the message can be extracted as features. The features, or a subset thereof, can be normalized and/or deobfuscated prior to being employed as features of the machine learning systems. The (deobfuscated) features can be employed to populate a plurality of feature lists that facilitate spam detection and prevention. Exemplary features include an email address, an IP address, a URL, an embedded image pointing to a URL, and/or portions thereof.

US Patent:

8214438, Jul 3, 2012

Filed:

Mar 1, 2004

Appl. No.:

10/790574

Inventors:

John D. Mehr - Seattle WA, US
Nathan D. Howell - Seattle WA, US
Micah C. Rupersburg - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 15/16

US Classification:

709206

Abstract:

The present invention involves a system and method that facilitate extracting data from messages for spam filtering. The extracted data can be in the form of features, which can be employed in connection with machine learning systems to build improved filters. Data associated with the subject line, timestamps, and the message body can be extracted and employed to generate one or more features. In particular, subject lines and message bodies can be examined for consecutive, repeating characters, blobs, the association or distance between such characters, blobs and non-blob portions of the message. The values or counts obtained can be broken down into one or more ranges corresponding to a degree of spaminess. Presence and type of attachments to messages, percentage of non-white-space and non-numeric characters of a message, and determining message delivery times can be used to identify spam. A time-based delta can be computed to facilitate determining the delivery time.

US Patent:

8533270, Sep 10, 2013

Filed:

Jun 23, 2003

Appl. No.:

10/601741

Inventors:

Bryan T. Starbuck - Duvall WA, US
Robert L. Rounthwaite - Fall City WA, US
David E. Heckerman - Bellevue WA, US
Joshua T. Goodman - Redmond WA, US
Eliot C. Gillum - Los Gatos CA, US
Nathan D. Howell - Seattle WA, US
Kenneth R. Aldinger - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 15/16

US Classification:

709206, 709201, 709203, 709204

Abstract:

The subject invention provides for an advanced and robust system and method that facilitates detecting spam. The system and method include components as well as other operations which enhance or promote finding characteristics that are difficult or the spammer to avoid and finding characteristics in non-spam that are difficult for spammers to duplicate. Exemplary characteristics include examining origination features in pairs, analyzing character and/or number sequences, strings, and sub-strings, detecting various entropy levels of one or more character sequences, strings and/or sub-strings as well as analyzing message and/or feature sizes.

US Patent:

8208375, Jun 26, 2012

Filed:

Mar 17, 2008

Appl. No.:

12/050162

Inventors:

Manjunath Bharadwaj - Bellevue WA, US
Nathan Howell - Seattle WA, US
Wei Jiang - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 11/00

US Classification:

370230, 3703953

Abstract:

Several approaches to selectively filtering network traffic are described. One approach involves a system for selectively filtering network traffic. The system includes a helper application, which is coupled to a networking program, and is used to identify a user-initiated request. A network filter driver is coupled to the networking program, for intercepting the user-initiated request. A filtering service is coupled to both the helper application and the network filter driver, and is used to determine if the user-initiated request is allowable. If the request is allowable, the filtering service is configured to generate a special identifier, which the helper application is configured to include in a subsequent request. The filtering service is configured to allow a subsequent request which includes the special identifier, and the network filter driver's configured to strip a special identifier from subsequent requests.