Anti-spam transient entity classification
View Patent ↗Embodiments are directed towards multi-level entity classification. An object associated with an entity is received. In one embodiment the object comprises and email and the entity comprises the IP address of a sending email server. If the entity has already been classified, as indicated by an entity classification cache, then a corresponding action is taken on the object. However, if the entity has not been classified, the entity is submitted to a fast classifier for classification. A feature collector concurrently fetches available features, including fast features and full features. The fast classifier classifies the entity based on the fast features, storing the result in the entity classification cache. Subsequent objects associated with the entity are processed based on the cached result of the fast classifier. Then, a full classifier classifies the entity based on at least the full features, storing the result in the entity classification cache.
1. A method comprising:
receiving, by a computing device, a first message associated with an Internet Protocol (IP) address of a first mail server that sent the first message;
fetching, by the computing device, a plurality of features associated with the IP address, the plurality of features including one or more fast features and one or more full features, said fast features comprising features that do not require user feedback, said full features incorporating user feedback indicating how frequently the IP address is a source of a message;
classifying, by the computing device, the IP address with a fast classifier based on the one or more fast features;
determining, via the computing device, based on said classification, that the first mail server is a spammer;
caching, by the computing device, a result of said determination in an entity classification cache associated with said computing device;
receiving, by the computing device, a second message associated with the IP address;
performing, by the computing device, an action on the second message based on the cached result of the fast classifier;
classifying, by the computing device, the IP address with a full classifier based on the one or more full features and the one or more fast features;
caching, by the computing device, a result of the classification by the full classifier in the entity classification cache; and
moving, by the computing device, a plurality of received messages into a different folder based on the cached result of the full classifier.
2. The method of claim 1 , wherein the fast feature further comprises a feature not requiring aggregation of data.
3. The method of claim 2 , wherein the feature not requiring aggregation of data further comprises the feature not requiring aggregation of data over time.
4. The method of claim 2 , wherein the feature not requiring aggregation of data further comprises the feature not requiring aggregation of data from disparate geographic locations.
5. The method of claim 1 , wherein the full feature further comprises a feature requiring aggregation of data.
6. The method of claim 5 , wherein the full feature requiring aggregation of data further comprises the full feature requiring aggregation of data over time.
7. The method of claim 5 , wherein the full feature requiring aggregation of data further comprises the full feature requiring aggregation of data from disparate geographic locations.
8. The method of claim 1 , wherein the moving of the plurality of received messages into the different folder further comprises moving the plurality of received messages into a spam folder.
9. The method of claim 1 , wherein the moving of the plurality of received messages into the different folder further comprises moving the plurality of received messages into an inbox.
10. A non-transitory computer-readable storage medium tangibly encoded with computer-executable instructions, that when executed by a computing device, cause a computing device to perform a method comprising:
receiving, by a computing device, a first message associated with an Internet Protocol (IP) address of a first mail server that sent the first message;
fetching, by the computing device, a plurality of features associated with the IP address, the plurality of features including one or more fast features and one or more full features, said fast features comprising features that do not require user feedback, said full features incorporating user feedback indicating how frequently the IP address is a source of a message;
classifying, by the computing device, the IP address with a fast classifier based on the one or more fast features;
determining, via the computing device, based on said classification, that the first mail server is a spammer;
caching, by the computing device, a result of said determination in an entity classification cache associated with said computing device;
receiving, by the computing device, a second message associated with the IP address;
performing, by the computing device, an action on the second message based on the cached result of the fast classifier;
classifying, by the computing device, the IP address with a full classifier based on the one or more full features and the one or more fast features;
caching, by the computing device, a result of the classification by the full classifier in the entity classification cache; and
moving, by the computing device, a plurality of received messages into a different folder based on the cached result of the full classifier.
11. The non-transitory computer-readable storage medium of claim 10 , wherein the fast feature further comprises a feature not requiring aggregation of data.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the feature not requiring aggregation of data further comprises the feature not requiring aggregation of data over time.
13. The non-transitory computer-readable storage medium of claim 11 , wherein the feature not requiring aggregation of data further comprises the feature not requiring aggregation of data from disparate geographic locations.
14. The non-transitory computer-readable storage medium of claim 10 , wherein the full feature further comprises a feature requiring aggregation of data.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the full feature requiring aggregation of data further comprises the full feature requiring aggregation of data over time.
16. The non-transitory computer-readable storage medium of claim 14 , wherein the full feature requiring aggregation of data further comprises the full feature requiring aggregation of data from disparate geographic locations.
17. The non-transitory computer-readable storage medium of claim 10 , wherein the moving of the plurality of received messages into the different folder further comprises moving the plurality of received messages into a spam folder.
18. The non-transitory computer-readable storage medium of claim 10 , wherein the moving of the plurality of received messages into the different folder further comprises moving the plurality of received messages into an inbox.
19. A computing device, comprising:
a processor;
a non-transitory computer-readable storage medium for tangibly storing thereon program logic for execution by the processor, the stored program logic comprising:
logic executed by the processor for receiving, by the computing device, a first message associated with an Internet Protocol (IP) address of a first mail server that sent the first message;
logic executed by the processor for fetching, by the computing device, a plurality of features associated with the IP address, the plurality of features including one or more fast features and one or more full features, said fast features comprising features that do not require user feedback, said full features incorporating user feedback indicating how frequently the IP address is a source of a message;
logic executed by the processor for classifying, by the computing device, the IP address with a fast classifier based on the one or more fast features;
logic executed by the processor for determining, via the computing device, based on said classification, that the first mail server is a spammer;
logic executed by the processor for caching, by the computing device, a result of said determination in an entity classification cache associated with said computing device;
logic executed by the processor for receiving, by the computing device, a second message associated with the IP address;
logic executed by the processor for performing, by the computing device, an action on the second message based on the cached result of the fast classifier;
logic executed by the processor for classifying, by the computing device, the IP address with a full classifier based on the one or more full features and the one or more fast features;
logic executed by the processor for caching, by the computing device, a result of the classification by the full classifier in the entity classification cache; and
logic executed by the processor for moving, by the computing device, a plurality of received messages into a different folder based on the cached result of the full classifier.