Abstract: The filtering of activities generated by nodes of a network while interacting with a device may be performed by evaluating the desirability of the activities (e.g., a spam or not-spam determination of email messages sent by the node) and assigning a trust rating to the node. However, nodes are often identified by network address, and an operator of a node sending undesirable activities may reassign the network address of the node in order to avoid heavy filtering. Instead, nodes may be identified as being controlled by a network entity (e.g., an autonomous system identified in a border gateway protocol routing table.) The network entity is assigned a network entity trust rating based on the trust ratings of the nodes controlled thereby, and an appropriate level of activity filtering based on the network entity trust rating may be selected for subsequent activities received from all nodes controlled by the network entity.

Abstract: Network entities controlling a set of nodes may vary by trustworthiness, such as tolerance for nodes that send spam, distribute malware, or perform denial-of-service attacks. A device receiving such activities may identify a trust rating of the network entity and apply appropriately stringent filtering (such as spam evaluation) to activities received from nodes controlled by the network entity. However, a poor trust rating of a network entity may subject a legitimate node controlled by the network entity to inefficiently or unfairly stringent activity filtering. Instead, the device may evaluate the activities of a particular node, assign a trust rating to the node, and if the trust rating of the node is higher than the trust rating of the network entity, apply less stringent activity filtering to the activities of the node, thereby “rescuing” the node from the more stringent activity filtering applied to the other nodes of the network entity.

Abstract: User account behavior techniques are described. In implementations, a determination is made as to whether interaction with a service provider via a user account deviates from a model. The model is based on behavior that was previously observed as corresponding to the user account. Responsive to a determination that the interaction deviates from the model, the user account is flagged as being potentially compromised by a malicious party.

Abstract: The filtering of activities generated by nodes of a network while interacting with a device may be performed by evaluating the desirability of the activities (e.g., a spam or not-spam determination of email messages sent by the node) and assigning a trust rating to the node. However, nodes are often identified by network address, and an operator of a node sending undesirable activities may reassign the network address of the node in order to avoid heavy filtering. Instead, nodes may be identified as being controlled by a network entity (e.g., an autonomous system identified in a border gateway protocol routing table.) The network entity is assigned a network entity trust rating based on the trust ratings of the nodes controlled thereby, and an appropriate level of activity filtering based on the network entity trust rating may be selected for subsequent activities received from all nodes controlled by the network entity.

Abstract: Network entities controlling a set of nodes may vary by trustworthiness, such as tolerance for nodes that send spam, distribute malware, or perform denial-of-service attacks. A device receiving such activities may identify a trust rating of the network entity and apply appropriately stringent filtering (such as spam evaluation) to activities received from nodes controlled by the network entity. However, a poor trust rating of a network entity may subject a legitimate node controlled by the network entity to inefficiently or unfairly stringent activity filtering. Instead, the device may evaluate the activities of a particular node, assign a trust rating to the node, and if the trust rating of the node is higher than the trust rating of the network entity, apply less stringent activity filtering to the activities of the node, thereby “rescuing” the node from the more stringent activity filtering applied to the other nodes of the network entity.

Abstract: Techniques and systems are described that utilize a scalable, “light-weight” user model, which can be combined with a traditional global email spam filter, to determine whether an email message sent to a target user is a desired email. A global email model is trained with a set of email messages to detect desired emails, and a user email model is also trained to detect desired emails. Training the user email model may comprise one or more of: using labeled training emails; using target user-based information; and using information from the global email model. Global and user model scores for an email sent to a target user can be combined to produce an email score. The email score can be compared with a desired email threshold to determine whether the email message sent to the target user is desired or not.

Abstract: Apparatus for automatically scanning processed radiochromatagram strips. The apparatus comprises a carrier wheel having a processed chromatagram mounted on the periphery thereof by a strip of plastic tape. The wheel carries the processed chromatagram past a radiation detector. Photoelectric means are provided to provide signals indicative of the position of the carrier wheel. The apparatus includes electrical circuitry responsive to the signals produced by the radiation detector to provide a numerical display of the total radioactivity detected along the entire strip and for providing a numerical display of the radioactivity detected along a selected portion of the strip. A strip chart recorder is provided in the apparatus to produce a graphical display of the spectral distribution of the radioactivity along the entire strip. The apparatus includes logic means for controlling the functions of the apparatus to provide a completely automated system.