Abstract: Aspects of the subject matter described herein relate to predicting and using search engine switching behavior. In aspects, switching components receive a representation of user interactions with at least one browser. The switching components derive information from the representation that is useful in predicting whether a user will switch search engines. The derived information and information about a user's current interaction with a browser is then used by a switch predictor to predict whether the user will switch search engines. This prediction may be used in a variety of ways examples of which are given herein.

Abstract: Phishing detection, prevention, and notification is described. In an embodiment, a messaging application facilitates communication via a messaging user interface, and receives a communication, such as an email message, from a domain. A phishing detection module detects a phishing attack in the communication by determining that the domain is similar to a known phishing domain, or by detecting suspicious network properties of the domain. In another embodiment, a Web browsing application receives content, such as data for a Web page, from a network-based resource, such as a Web site or domain. The Web browsing application initiates a display of the content, and a phishing detection module detects a phishing attack in the content by determining that a domain of the network-based resource is similar to a known phishing domain, or that an address of the network-based resource from which the content is received has suspicious network properties.

Abstract: Architecture for detecting and removing obfuscating clutter from the subject and/or body of a message, e.g., e-mail, prior to filtering of the message, to identify junk messages commonly referred to as spam. The technique utilizes the powerful features built into an HTML rendering engine to strip the HTML instructions for all non-substantive aspects of the message. Pre-processing includes pre-rendering of the message into a final format, which final format is that which is displayed by the rendering engine to the user. The final format message is then converted to a text-only format to remove graphics, color, non-text decoration, and spacing that cannot be rendered as ASCII-style or Unicode-style characters. The result is essentially to reduce each message to its common denominator essentials so that the junk mail filter can view each message on an equal basis.

Abstract: A unique recording system and method that facilitates recording live meetings, discussions or conversations whereby such recordings are available for immediate or near immediate playback is provided. As a result, a user who has momentarily become distracted or inattentive during the meeting can quickly re-listen to what was missed or misunderstood in order to readily catch up to the current discussion. The current discussion can continue to be recorded during playback of any previously recorded data. User behavior can be monitored to estimate when the user has started to become inattentive and likely segments or time points of the recordings can be suggested for playback. One or more portions of the recordings can be filtered or selected for playback so that any desired content can be eliminated or skipped in the playback version.

Abstract: Aspects of the subject matter described herein relate to predicting and using search engine switching behavior. In aspects, switching components receive a representation of user interactions with at least one browser. The switching components derive information from the representation that is useful in predicting whether a user will switch search engines. The derived information and information about a user's current interaction with a browser is then used by a switch predictor to predict whether the user will switch search engines. This prediction may be used in a variety of ways examples of which are given herein.

Abstract: A system described herein includes analyzer component that analyzes queries submitted by users and corresponding URLs selected by the users, wherein the queries include a first query and a second query, and wherein the analyzer component determines that the first query and the second query are substantially similar queries. The system additionally includes a correlator component that, responsive to the analyzer component determining that the first query and the second query are substantially similar, generates correlation data that indicates that the first and second queries are substantially similar.

Abstract: Described is processing the search results obtained from a search engine to determine advertisements that match properties of those search results. For example, the URL-related information or domain-related information in the search results may be used to select an advertisement. Also described are various conditions that may need to be met before an advertisement is selected. Further, an advertisement may be modified to include information in the search results, such as to insert a competing company's name that appears in a search result into the advertisement. Also described is a system for returning keywords in response to a URL/domain.

Abstract: Embodiments of proofs to filter spam are presented herein. Proofs are utilized to indicate a sender used a set amount of computer resources in sending a message in order to demonstrate the sender is not a “spammer”. Varying the complexity of the proofs, or the level of resources used to send the message, will indicate to the recipient the relative likelihood the message is spam. Higher resource usage indicates that the message may not be spam, while lower resource usage increases the likelihood a message is spam. Also, if the recipient requires a higher level of proof than received, the receiver may request the sender send additional proof to verify the message is not spam.

Abstract: A system and method facilitating detection of unsolicited e-mail message(s) with challenges is provided. The invention includes an e-mail component and a challenge component. The system can receive e-mail message(s) and associated probabilities that the e-mail message(s) are spam. Based, at least in part, upon the associated probability, the system can send a challenge to a sender of an e-mail message. The challenge can be an embedded code, computational challenge, human challenge and/or micropayment request. Based, at least in part, upon a response to the challenge (or lack of response), the challenge component can modify the associated probability and/or delete the e-mail message.

Abstract: Aspects of the subject matter described herein relate to predicting and using search engine switching behavior. In aspects, switching components receive a representation of user interactions with at least one browser. The switching components derive information from the representation that is useful in predicting whether a user will switch search engines. The derived information and information about a user's current interaction with a browser is then used by a switch predictor to predict whether the user will switch search engines. This prediction may be used in a variety of ways examples of which are given herein.

Abstract: Architecture that automatically detects historical search contexts as well as behaviors related to a search query. Machine learning and hand-authored rules are employed to automatically identify search contexts. Historical information likely to be useful in the current context is surfaced. When a user enters a search query or executes another search behavior, past behaviors are exposed which are contextually related to the current behavior. The architecture also provides automatic discovery of historical contexts, features related to the contexts, and training or authoring of a system for classifying behavior into contexts, using some combination of the machine learning and/or hand-authored rules. A runtime system classifies the current user behavior into a context and surfaces contextual information to the user.

Abstract: A searchable web site discovery and recommendation system and method for discovering and recommending searchable web sites to a user of a search engine. In general, given a search query by a user embodiments of the system and method discover and then recommend a list of searchable web sites. Embodiments of the system and method discover and recommend searchable web sites using client-side query behavior logs. A set of descriptive features is automatically extracted from the logs. In addition, embodiments of the system and method expand the initial search query by submitting the query to a general search engine and leveraging snippets from the search engine results. Embodiments of the system and method model a conditional probability of a searchable web site based on four components and the extracted descriptive features. A ranked list of recommended searchable web sites is obtained from the conditional probability and displayed to a user.

Abstract: This patent application pertains to dynamic search interaction. One example includes an organizational component configured to obtain a search query from a user. The organizational component can also be configured to obtain related search queries. The organizational component can further be configured to organize the related search queries by topic and to estimate a relative likelihood that an intent of the user matches an individual topic. This example also includes an image generation component configured to cause the organized related search queries to be presented on a graphical user interface (GUI) in a manner that reflects the relative likelihood.

Abstract: Aspects of the subject matter described herein relate to predicting and using search engine switching behavior. In aspects, switching components receive a representation of user interactions with at least one browser. The switching components derive information from the representation that is useful in predicting whether a user will switch search engines. The derived information and information about a user's current interaction with a browser is then used by a switch predictor to predict whether the user will switch search engines. This prediction may be used in a variety of ways examples of which are given herein.

Abstract: Described herein is a system that facilitates assigning indications of usefulness to query suggestions. The system includes a query suggestion generator component that receives a query and generates a query suggestion based at least in part upon the received query. A model component outputs an indication of usefulness with respect to the query suggestion, wherein the model component is a machine-learned model of user behavior with respect to query suggestions.

Abstract: Distribution displays for categories are provided which illuminate the distribution of continuous attributes over all cases in a category, and which provide a histogram of the population of the different states of categorical attributes. An array of such displays by attribute (in one dimension) and category (in another dimension) may be provided. Category diagram displays are also provided for visualizing the different categories, and their distributions, populations, and similarities. These are displayed through different shading of nodes and edges representing categories and the relationship between two categories, and through proximity of nodes.

Abstract: Decision trees populated with classifier models are leveraged to provide enhanced spam detection utilizing separate email classifiers for each feature of an email. This provides a higher probability of spam detection through tailoring of each classifier model to facilitate in more accurately determining spam on a feature-by-feature basis. Classifiers can be constructed based on linear models such as, for example, logistic-regression models and/or support vector machines (SVM) and the like. The classifiers can also be constructed based on decision trees. “Compound features” based on internal and/or external nodes of a decision tree can be utilized to provide linear classifier models as well. Smoothing of the spam detection results can be achieved by utilizing classifier models from other nodes within the decision tree if training data is sparse. This forms a base model for branches of a decision tree that may not have received substantial training data.

Abstract: A dependency structure is used to divide samples corresponding to items to be ranked into leaf nodes, based on the rank of the items. The dependency structure is trained by splitting or merging training data received at given nodes based on selected features and selected thresholds for those features. A metric is then calculated which is indicative of performance of the node, in splitting the data. The trained structure is then used during runtime to rank items.

Abstract: The present invention provides for generating inputs that can be provided to a message classification module to facilitate more reliable classification of electronic messages, such as, for example, as unwanted and/or unsolicited. In one embodiment, a sending messaging server provides an appropriate response to address verification data thereby indicating a reduced likelihood of the sending messaging server using a forged network address. In another embodiment, it is determined if a messaging server is authorized to send electronic messages for a domain. In yet another embodiment, electronic message transmission policies adhered to by a domain are identified. In yet a further embodiment, a sending computer system expends computational resources to solve a computational puzzle and includes an answer document in an electronic message. A receiving computer system receives the electronic message and verifies the answer document.

Abstract: Identification of email forwarders is described. In an implementation, a method includes using heuristics to identify email forwarders for use in a reputation system for locating spammers. In another implementation, a method includes determining a likelihood that a particular Internet Protocol (IP) address corresponds to an email forwarder and processing email originating from the particular IP address based on the determined likelihood. In a further implementation, a method includes collecting heuristic data that describes characteristics of emails sent from one or more Internet Protocol (IP) addresses and constructing a model from the heuristic data for identifying whether at least one of the IP address is an email forwarder. In yet a further implementation, a method includes identifying that a particular Internet Protocol (IP) address likely corresponds to an email forwarder and processing email from the particular IP address based on an implied sender of the email.