Abstract: Embodiments are directed towards generating a unified user account trustworthiness system through user account trustworthiness scores. A trusted group of user accounts may be identified for a given action by grouping a plurality of user accounts into tiers based on a trustworthiness score of each user account for the given action. The tiers and/or trustworthiness scores may be employed to classify an item, such as a message as spam or non-spam, based on input from the user accounts. The trustworthiness scores may also be employed to determine if a user account is a robot account or a human account. The trusted group for a given action may dynamically evolve over time by regrouping the user accounts based on modified trustworthiness scores. A trustworthiness score of an individual user account may be modified based on input received from the individual user account and input from other user accounts.

Abstract: A network device and method are directed towards detecting and blocking image spam within a message by performing statistical analysis on differences in edge pixel distribution patterns. An image spam detection component receives a message with an image attachment. Physical characteristics of the image are examined to determine whether the image is a candidate for further analysis. If so, then the image may be converted to a grayscale image, and then performing edge detection, followed by the elimination of non-maxima and thresholding of weak edges. Edge pixels and then employed to determine a normalized pixel density distribution (PDD). Various statistical analyses are applied to the resulting normalized PDD to determine a likelihood that the image is spam. A signature based exemption may be applied to images improperly identified as spam, based on trusted user feedback.

Abstract: Embodiments are directed towards employing a multi-pass ad-hoc spam message filtering approach that dynamically generates a temporary classifier during a first pass based on a result of a previously applied message filter that sorts messages into various folders for a user. The first pass scans messages in a user's mail folders, and reads various information within the messages, including, but not limited to sender information, headers, including a subject, an originating network address, message contents, attachments, and the like. After creating a classification model, the classifier with its model is used in a second pass on the message folders to retrospectively inspect the messages and present to the user a list of messages that might be misclassified. The classification model is maintained within memory on a user's client device, as memory resident only, and is not stored on disk or within another persistent data store.

Abstract: A network device and method are directed towards detecting and blocking image spam within a message by performing statistical analysis on differences in edge pixel distribution patterns. An image spam detection component receives a message with an image attachment. Physical characteristics of the image are examined to determine whether the image is a candidate for further analysis. If so, then the image may be converted to a grayscale image, and then performing edge detection, followed by the elimination of non-maxima and thresholding of weak edges. Edge pixels and then employed to determine a normalized pixel density distribution (PDD). Various statistical analyses are applied to the resulting normalized PDD to determine a likelihood that the image is spam. A signature based exemption may be applied to images improperly identified as spam, based on trusted user feedback.

Abstract: A network device and method are directed towards detecting and blocking image spam within a message by performing statistical analysis on differences in edge pixel distribution patterns. An image spam detection component receives a message with an image attachment. Physical characteristics of the image are examined to determine whether the image is a candidate for further analysis. If so, then the image may be converted to a grayscale image, and then performing edge detection, followed by the elimination of non-maxima and thresholding of weak edges. Edge pixels and then employed to determine a normalized pixel density distribution (PDD). Various statistical analyses are applied to the resulting normalized PDD to determine a likelihood that the image is spam. A signature based exemption may be applied to images improperly identified as spam, based on trusted user feedback.

Abstract: Detecting and blocking spam messages using statistical analysis on distributions of message sizes for a given IP address. Mail volumes are examined to model a distribution of volumes to cluster IP addresses. The messages sizes may distributed across ranges of message sizes, which is then used to determine an entropy of message sizes for the given IP address. The entropy of the given IP address may be compared to entropies of known good IP addresses, and if a difference between the entropies is statistically significant, then the given IP address may be determined to be an IP spammer. User feedback may also be employed to further characterize an IP address. For example, a number of messages from the IP address may be sent to intended recipients. User feedback may then be monitored to determine whether to the IP address should be reclassified.

Abstract: Embodiments are directed towards employing a multi-pass ad-hoc spam message filtering approach that dynamically generates a temporary classifier during a first pass based on a result of a previously applied message filter that sorts messages into various folders for a user. The first pass scans messages in a user's mail folders, and reads various information within the messages, including, but not limited to sender information, headers, including a subject, an originating network address, message contents, attachments, and the like. After creating a classification model, the classifier with its model is used in a second pass on the message folders to retrospectively inspect the messages and present to the user a list of messages that might be misclassified. The classification model is maintained within memory on a user's client device, as memory resident only, and is not stored on disk or within another persistent data store.

Abstract: Detecting and blocking spam messages using statistical analysis on distributions of message sizes for a given IP address. Mail volumes are examined to model a distribution of volumes to cluster IP addresses. The messages sizes may distributed across ranges of message sizes, which is then used to determine an entropy of message sizes for the given IP address. The entropy of the given IP address may be compared to entropies of known good IP addresses, and if a difference between the entropies is statistically significant, then the given IP address may be determined to be an IP spammer. User feedback may also be employed to further characterize an IP address. For example, a number of messages from the IP address may be sent to intended recipients. User feedback may then be monitored to determine whether to the IP address should be reclassified.

Abstract: A network device and method are directed towards detecting and blocking image spam within a message by performing statistical analysis on differences in edge pixel distribution patterns. An image spam detection component receives a message with an image attachment. Physical characteristics of the image are examined to determine whether the image is a candidate for further analysis. If so, then the image may be converted to a grayscale image, and then performing edge detection, followed by the elimination of non-maxima and thresholding of weak edges. Edge pixels and then employed to determine a normalized pixel density distribution (PDD). Various statistical analyses are applied to the resulting normalized PDD to determine a likelihood that the image is spam. A signature based exemption may be applied to images improperly identified as spam, based on trusted user feedback.

Abstract: Systems and methods for incorporating user feedback on advertising relevancy and providing the feedback to advertisers is disclosed. Generally, a user requests a web page from an online service provider. The online service provider checks to determine if the user requesting the page is a member of the user assisted advertising relevancy user population. If the user is not a member, the online service provider sends the web page the user requested without a method to rate the advertisement. If the user is a member of the user assisted advertising relevancy user base, the online service provider sends the requested web page with the ability to rate the advertisements sent on the page.