Abstract: A computer-implemented method for detecting suspicious web pages. The method may include 1) identifying a plurality of malicious web pages; 2) establishing a classification model for identifying suspicious web pages, the classification model being based at least in part on the plurality of malicious web pages; 3) identifying an additional web page; 4) classifying the additional web page as suspicious using the classification model; 5) analyzing the additional web page to determine whether the additional web page is malicious; 6) determining that the additional web page is malicious based on the analysis; and 7) updating the classification model based at least in part on the determination. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: For each page of a set, a Bayesian classification of the URL associated with the page is performed, and a maliciousness probability is assigned to the URL based on the Bayesian classification. A traversal priority is assigned to each page of the set, the assigned traversal priorities initially directing a breadth first traversal of the set of pages. The assigned traversal priorities of a subset of the pages of the set are modified to direct higher priority traversals, responsive to the maliciousness probabilities of the URLs corresponding to the pages of the subset. Each page of the set is traversed in the order specified by the traversal priorities, and analyzed during traversal to determine whether the page is malicious.

Abstract: Methods, systems, and apparatus for computing quality scores based on neighbor features. In one aspect, a method includes obtaining a quality model that was trained using a set of training entities; identifying a set of candidate entities that are different from each of the training entities; for each candidate entity: obtaining a first quality score for the candidate entity; obtaining one or more neighbor features for neighbor entities of the candidate entity, where each neighbor entity of the candidate entity is linked to the candidate entity; obtaining one or more entity specific feature values for the candidate entity, where each entity specific feature value is determined independent of the neighbor entities of the candidate entity; and determining a second quality score for the candidate entity using the quality model, the second quality score being computed based on the first quality score, the neighbor features, and the entity specific feature values.