Client-side spam detection and prevention

Systems and methods for detecting and preventing spam content attempted to be sent from a sender account may be provided. In an embodiment, a system can determine if a user's electronic service has been compromised based on analyzing electronic messages attempted to be sent by the electronic service. For example, the system can calculate a score for the electronic messages utilizing a spam detection algorithm where the score represents the probability that the message contains spam content. The system can prevent the communication of electronic messages upon a determination that the electronic service has been compromised. The system can request authentication information from the user before further communication is allowed from the compromised electronic service.

BACKGROUND

Today, communicating with individuals all over the world has never been easier. Networking technology has allowed people to communicate with one another through email, instant messaging, or various social networking sites. However, despite the many advantages this technology has granted to individuals, security and other concerns remain. With the current free flow of electronic information, people are more likely to divulge and share their personal information including bank account information or social security information. Malicious programs or outside parties may utilize a variety of methods to attempt to gain access to an individual's information that is stored or communicated electronically. Once an individual's information has been compromised, the potential security threat can harm the individual and/or others by proliferating messages or content which are unwanted or harmful. Spam content can not only be annoying to the recipients but can also be cause for concern, as the recipients may be anxious about their own information security status.

DETAILED DESCRIPTION

Embodiments of the present disclosure are directed to, among other things, a system for detecting and preventing communication of spam content from the perspective of the client. In particular, the system can detect that an individual's electronic service has been compromised by an outside party and prevent further communication of messages from the electronic service until further security steps are taken. For example, an electronic message of a participating user (e.g., a user who is participating in the spam detection and prevention service) may be analyzed prior to sending the electronic message in order to detect whether the message contains spam content. Additionally, other messages being sent within a given time window of the electronic message may be analyzed to detect spam content. In accordance with at least one embodiment, a service may determine based on the analysis of the first electronic message and one or more temporally associated electronic messages that the electronic service associated with the messages has been infiltrated by an outside party. Upon the determination that the user's electronic service has been compromised the service may prevent the communication of messages until the user is authenticated. In accordance with at least one embodiment, once the user is authenticated, the service may allow the communication of the messages. As used herein, the phrase “compromised by an outside party” may refer to a situation involving a third-party gaining access to a user's electronic service or messaging service with malicious intent including the proliferation of spam and the gathering of sensitive user information.

In a non-limiting example, a participating user's email account may be compromised by an outside party (e.g., by a virus or an entity other than the user). The user's email account may attempt to send a plurality of email's which potentially contain spam content to people in the user's email address book. Prior to sending any of the suspect emails, the service may analyze the content of the emails to assign a score to the emails. The score may represent the probability that the emails contain spam content or are otherwise not authorized by the user. The same process may be performed on all or a subset of the emails being sent within a certain time window. The service may determine based at least on the scores assigned to the emails that the user's email account is compromised. Upon a determination that the user's email account is compromised (e.g., a single score above a threshold or a combination of scores above a threshold), the service may not transmit the messages until the user has successfully authenticated with the service. For example, the service may send a short text message to the user indicating that their email account appears to be compromised. The user may need to provide a unique code included in the text message before any further communication from the email account may be allowed. In an embodiment, upon user authentication, the service may hold the emails until the user has verified which emails should be sent and which emails should be marked as spam and/or deleted.

In accordance with at least one embodiment, a user's electronic service or messaging service can include an emailing service, a social networking service, an instant messaging service, or any suitable communication service that utilizes computer network technology. As described herein, the phrase “spam content” includes content which is irrelevant, contains inappropriate messages, contains computer viruses, contains links to other web sites which proliferate spam, contains unsolicited advertisements, or is any message not authorized or otherwise intended to be sent by the user. In an example, the content of a user's message, which is either being sent or attempting to be sent, may be analyzed for spam content utilizing a spam detection algorithm. Examples of a spam detection algorithm can include a Bayesian spam filtering algorithm, an AdaBoost machine learning algorithm, or any suitable combination of supervised learning spam classification algorithms. In an example, a spam detection algorithm may be utilized to determine whether the content of the electronic message contains spam content. For example, an algorithm may be utilized to determine if an email contains a nonsensical alpha numeric string in the body of an email, or contains multiple links to web pages that are known to proliferate viruses. In accordance with at least one embodiment, an electronic message can include an email, a social networking post or message, or an instant message. In accordance with at least one embodiment, electronic messages that are configured to be sent by a user or electronic messages that are attempting to be sent by a messaging service may be analyzed to determine if the messaging service has been compromised. In an embodiment, electronic messages that are configured to be sent or electronic messages that are attempting to be sent by a messaging service include messages that are formatted appropriately under Post Office Protocol (POP), Internet Message Access Protocol (IMAP), User Datagram Protocol (UDP), Transmission Control Protocol (TCP/IP), or Simple Mail Transfer Protocol (SMTP). In accordance with at least one embodiment, electronic messages that are configured to be sent or electronic messages that are attempting to be sent by a messaging service include messages that are composed by a user but not yet sent, messages that a user has attempted to send via the messaging service (through the use of a send button for example) but that have not been sent to their intended recipient by the messaging service, or messages that have not been forwarded to the recipient of the message by the messaging service. In accordance with at least one embodiment, electronic messages that are attempting to be sent by a messaging service may be identified and/or analyzed to determine that the messaging service has been compromised by a third party. In an embodiment, identifying that a messaging service is attempting to send a plurality of electronic messages or an electronic message includes identifying that electronic messages have been composed but not yet sent. In accordance with at least one embodiment, identifying that a messaging service is attempting to send a plurality of electronic messages or an electronic message includes identifying that the messages are configured in such a way that the message service may send them when ready.

In an embodiment, the analyzed electronic message(s) may be assigned a score which represents the probability that the message contains spam content. In accordance with at least one embodiment, the one or more scores may be compared to a certain threshold to determine if a user's electronic service has been compromised. In one embodiment, the threshold can be pre-defined by administrators of the service. In accordance with at least one embodiment, the threshold can be specified by a participating user. In one example, if the calculated score exceeds the threshold than the service may prevent communications from the electronic service. If the threshold is not exceeded, the service may allow communication from the electronic service to continue. In accordance with at least one embodiment, the threshold can be dynamically updated by the service according to training data provided by the user, the calculated scores, or any combination thereof. In accordance with at least one embodiment, the threshold can be determined based at least on whether the electronic service or service has previously been compromised by a third party.

In accordance with at least one embodiment, if an electronic service is prevented from communicating messages, the service may request authentication information from a user. In accordance with at least one embodiment, authentication information can include at least a username and password, a unique code or identifier communicated to the user via a mobile phone or other SMS texting technology, or a phone call. In accordance with at least one embodiment, upon receiving the requested authentication information from the user, communication from the electronic service may no longer be prevented. In accordance with at least one embodiment, the service may continue to prevent the communication of the electronic messages until the user has provided input on which particular messages should be communicated and which should not be communicated via a user interface.

In accordance with at least one embodiment, the service may detect that the electronic service of the user has been compromised by an outside party upon receiving one or more notifications from a social networking site. For example, one or more individuals associated with the user via the social networking site may notice that the user is communicating or posting content which appears to be spam. The individuals associated with the user may utilize a notification feature to flag the content as spam. In accordance with at least one embodiment, the user may utilize various notification features to indicate that the communicated content contains spam content. In an example, the notification features can include a flagging feature, a tag feature, or a response submit feature. In accordance with at least one embodiment, the notification features may be utilized by a user via a user interface provided by the messaging service or social networking service. In an embodiment, the flag feature, tag feature, and response submit feature can be utilized to indicate that the communicated content contains spam content and to notify the messaging service or social networking service associated with the user that the service may be compromised by a third party. For example, a recipient of the spam content may click a button on a user interface that can flag or tag the content as spam thus notifying the service provider that the messaging service or social networking service has been compromised. In another example, the recipient of the spam content may be able to select and submit the content as containing spam content by utilizing a user interface feature that allows for selection and submission of the content for further spam content analysis by the service or notification to the service regarding a possible compromise by a third party. In accordance with at least one embodiment, upon receiving a certain number of spam notifications, the electronic service associated with the user may be prevented from communicating any content until authentication information has been provided by the user as described herein.

In accordance with at least one embodiment, upon determining that an electronic service of the user has been compromised, the service may notify websites associated with the user to prevent reset authentication capabilities until authentication information has been provided by the user. For example, a user may normally use their email account to reset authentication for other services such as a bank account web page, or an electronic marketplace ordering web page. If the user's email account is compromised then an outside party may be able to reset the authentication with the associated services and gain access to said services. In accordance with at least one embodiment, the service may provide and/or utilize an API that notifies and allows the other services to prevent reset authentication capabilities. In accordance with at least one embodiment, once a user has provided authentication information to the service, the service may communicate with the associated services to allow reset authentication capabilities.

In accordance with at least one embodiment, a plurality of electronic messages that are attempting to be sent by a user's messaging service may be analyzed to determine if the messaging service has been compromised by a third party. In accordance with at least one embodiment, the determination of whether the messaging service has been compromised is based on analyzing a spam property of each electronic message or of the plurality of electronic messages. In an embodiment, the spam property or properties can include whether the electronic message contains spam content based on a spam detection algorithm, whether each electronic message of the plurality of electronic messages is attempting to be sent to a unique recipient within a time threshold or window, or whether the collective information of the electronic message containing spam content and each electronic message being sent to a unique recipient within a time window or threshold. For example, the system may identify that a user's electronic messaging service is attempting to send an electronic message to each person in the user's contact list within a short period of time or almost simultaneously. In response to identifying the attempted mass communication to each contact associated with the user within a short time window, the system may determine that the user's messaging service has been compromised by a third party and prevent communication of the electronic messages until the user has provided authentication information. In accordance with at least one embodiment, the system may identify that a message contains spam content and determine that the user's messaging service has been compromised by a third party and prevent communication of the electronic messages until the user has provided authentication information. In accordance with at least one embodiment, the system may calculate a score based on the spam properties which it may compare to a threshold to determine if the user's messaging service has been compromised.

FIG. 1illustrates an illustrative flow for providing a spam detection and prevention feature described herein, according to at least one example. In one non-limiting example, the method100can receive an electronic message prior to being sent to a recipient at102. For example, an outside party utilizing a user device104may be attempting to send electronic messages106via an electronic service108which contain spam content110. The method100may analyze the electronic message for spam content to determine if the electronic service has been compromised112. For example, a spam detection and prevention service provider computer114may analyze the spam content electronic message110utilizing a spam detection algorithm. The spam content electronic message110may contain a link to a web site which aids in distributing and proliferating viruses and other spam content. The spam detection algorithm may calculate a score for the electronic message110which represents the probability that the message contains spam content. The service provider computer114may then determine if the electronic service108has been compromised based on the score of the electronic message110, other scores calculated from messages received within a particular time window surrounding the electronic message110, and a specified threshold value.

When it has been determined by the service provider computer114that the electronic service108has been compromised, then the service provider computer114may request authentication information from the user116before communicating electronic messages106. For example, the service provider computer114may request authentication information118from a user utilizing a user device120. Once the user has provided the requested authentication information118, the electronic messages106may be allowed to be communicated to their intended recipients122. In accordance with at least one embodiment, the electronic service108may be prevented from communicating the electronic messages106until the user has successfully authenticated with the electronic service108. The user utilizing a user device104may specify which electronic messages106can be communicated and which electronic messages were properly classified as containing spam content.

FIG. 2illustrates an example architecture for spam detection and prevention from a sender perspective described herein that includes spam detection prevention service computer systems, one or more third party computers, and/or a user device connected via one or more networks, according to at least one example. In architecture200, one or more users202(i.e., web service users) may utilize user computing devices204(1)-(N) (collectively, user devices204) to access an application206(e.g., a web browser), via one or more networks208. In some aspects, the application206may be hosted, managed, and/or provided by a computing resources service or service provider, such as by utilizing one or more service provider computers and/or one or more spam detection/prevention service computers210. The one or more spam detection/prevention service computers210may provide a native application which is configured to run on the user devices204which the user202may interact with to detect and prevent spam being sent from their associated electronic services. The one or more spam detection/prevention service computers210may, in some examples, provide computing resources such as, but not limited to, client entities, low latency data storage, durable data storage, data access, management, virtualization, cloud-based software solutions, electronic content performance management, etc. The one or more spam detection/prevention service computers210may also be operable to provide web hosting, computer application development, and/or implementation platforms, combinations of the foregoing, or the like to the one or more users202. The one or more spam detection/prevention service computers210, in some examples, may provide spam detection and prevention of electronic messages being sent from an electronic service associated with a user, determining whether the electronic service has been compromised by an outside party, and requesting authentication information from a user before sending operations may be completed. In some examples, the one or more spam detection/prevention service computers210may communicate with one or more third party computers212to provide services associated with spam detection and prevention.

In some examples, the networks208may include any one or a combination of many different types of networks, such as cable networks, the Internet, wireless networks, cellular networks and other private and/or public networks. While the illustrated example represents the users202accessing the application206over the networks208, the described techniques may equally apply in instances where the users202interact with the spam detection/prevention computers210via the one or more user devices204over a landline phone, via a kiosk, or in any other manner. It is also noted that the described techniques may apply in other client/server arrangements (e.g., set-top boxes, etc.), as well as in non-client/server arrangements (e.g., locally stored applications, etc.).

As described briefly above, the application206may allow the users202to interact with a service provider computer, such as to access web content (e.g., web pages, music, video, etc.). The one or more spam detection/prevention computers210, perhaps arranged in a cluster of servers or as a server farm, may host the application206and/or cloud-based software services. Other server architectures may also be used to host the application206. The application206may be capable of handling requests from many users202and serving, in response, various item web pages. The application206can provide any type of website that supports user interaction, including social networking sites, online retailers, informational sites, blog sites, search engine sites, news and entertainment sites, and so forth. As discussed above, the described techniques can similarly be implemented outside of the application206, such as with other applications running on the user devices204.

The user devices204may be any type of computing device such as, but not limited to, a mobile phone, a smart phone, a personal digital assistant (PDA), a laptop computer, a desktop computer, a thin-client device, a tablet PC, an electronic book (e-book) reader, etc. In some examples, the user devices204may be in communication with the spam detection/prevention computers210via the networks208, or via other network connections. Additionally, the user devices204may be part of the distributed system managed by, controlled by, or otherwise part of the spam detection/prevention computers210(e.g., a console device integrated with the spam detection/prevention computers210).

In one illustrative configuration, the user devices204may include at least one memory214and one or more processing units (or processor(s))216. The processor(s)216may be implemented as appropriate in hardware, computer-executable instructions, firmware, or combinations thereof. Computer-executable instruction or firmware implementations of the processor(s)216may include computer-executable or machine-executable instructions written in any suitable programming language to perform the various functions described. The user devices204may also include geo-location devices (e.g., a global positioning system (GPS) device or the like) for providing and/or recording geographic location information associated with the user devices204.

The memory214may store program instructions that are loadable and executable on the processor(s)216, as well as data generated during the execution of these programs. Depending on the configuration and type of user device204, the memory214may be volatile (such as random access memory (RAM)) and/or non-volatile (such as read-only memory (ROM), flash memory, etc.). The user device204may also include additional removable storage and/or non-removable storage including, but not limited to, magnetic storage, optical disks, and/or tape storage. The disk drives and their associated computer-readable media may provide non-volatile storage of computer-readable instructions, data structures, program modules, and other data for the computing devices. In some implementations, the memory214may include multiple different types of memory, such as static random access memory (SRAM), dynamic random access memory (DRAM), or ROM.

Turning to the contents of the memory214in more detail, the memory214may include an operating system and one or more application programs or services for implementing the features disclosed herein including at least a user provided input element or electronic service web page, such as via the browser application206or dedicated applications (e.g., smart phone applications, tablet applications, etc.). The browser application206may be configured to receive, store, and/or display a website or other interface for interacting with the spam detection/prevention computers210. Additionally, the memory214may store access credentials and/or other user information such as, but not limited to, user IDs, passwords, and/or other user information. In some examples, the user information may include information for authenticating an account access request such as, but not limited to, a device ID, a cookie, an IP address, a location, or the like. In addition, the user information may include a user202provided response to a security question or a geographic location obtained by the user device204.

In some aspects, the question/answer management computers210may also be any type of computing devices such as, but not limited to, a mobile phone, a smart phone, a personal digital assistant (PDA), a laptop computer, a desktop computer, a server computer, a thin-client device, a tablet PC, etc. Additionally, it should be noted that in some embodiments, the service provider computers are executed by one more virtual machines implemented in a hosted computing environment. The hosted computing environment may include one or more rapidly provisioned and released computing resources, which computing resources may include computing, networking and/or storage devices. A hosted computing environment may also be referred to as a cloud computing environment. In some examples, the spam detection/prevention computers210may be in communication with the user devices204and/or other service providers via the networks208, or via other network connections. The spam detection/prevention computers210may include one or more servers, perhaps arranged in a cluster, as a server farm, or as individual servers not associated with one another. These servers may be configured to implement the spam detection/prevention services described herein as part of an integrated, distributed computing environment.

In one illustrative configuration, the spam detection/prevention computers210may include at least one memory218and one or more processing units (or processor(s))220. The processor(s)220may be implemented as appropriate in hardware, computer-executable instructions, firmware, or combinations thereof. Computer-executable instruction or firmware implementations of the processor(s)220may include computer-executable or machine-executable instructions written in any suitable programming language to perform the various functions described.

The memory218may store program instructions that are loadable and executable on the processor(s)220, as well as data generated during the execution of these programs. Depending on the configuration and type of spam detection/prevention computers210, the memory218may be volatile (such as RAM) and/or non-volatile (such as ROM, flash memory, etc.). The spam detection/prevention computers210or servers may also include additional storage222, which may include removable storage and/or non-removable storage. The additional storage222may include, but is not limited to, magnetic storage, optical disks and/or tape storage. The disk drives and their associated computer-readable media may provide non-volatile storage of computer-readable instructions, data structures, program modules and other data for the computing devices. In some implementations, the memory218may include multiple different types of memory, such as SRAM, DRAM, or ROM.

The memory218, the additional storage222, both removable and non-removable, are all examples of computer-readable storage media. For example, computer-readable storage media may include volatile or non-volatile, removable or non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules, or other data. The memory218and the additional storage222are all examples of computer storage media. Additional types of computer storage media that may be present in the spam detection/prevention computers210may include, but are not limited to, PRAM, SRAM, DRAM, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, DVD or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by the spam detection/prevention computers210. Combinations of any of the above should also be included within the scope of computer-readable media.

The spam detection/prevention computers210may also contain communications connection(s)224that allow the spam detection/prevention computers210to communicate with a stored database, another computing device or server, user terminals and/or other devices on the networks208. The spam detection/prevention computers210may also include I/O device(s)226, such as a keyboard, a mouse, a pen, a voice input device, a touch input device, a display, speakers, a printer, etc.

Turning to the contents of the memory218in more detail, the memory218may include an operating system228, one or more data stores230, and/or one or more application programs or services for implementing the features disclosed herein including a spam detection module232, an authentication module234, a spam prevention module236, a user interface module238, and/or a communication module240. In some examples, the spam detection module232may be configured to detect whether electronic messages contain spam content. For example, the spam detection module232can be configured to utilize one or more spam detection algorithms to determine the probability that an electronic message(s) contain spam content. In an embodiment, this process may include calculating a score for the electronic message where the score represents the probability that the message contains spam content. In another example, the spam detection module232may be configured to determine whether a plurality of messages being sent within a given time window contain spam content. The spam detection module232may be configured to calculate a score for the plurality of messages sent within a given time window to aid in determining whether an electronic service associated with the message has been compromised by an outside party.

The spam detection module232may be configured to determine whether an electronic message contains spam content. For example, the spam detection module232can utilize a spam detection algorithm to determine whether an electronic message contains spam content. The spam detection module232may also be configured to determine whether a plurality of messages that are being sent within a certain time period of the electronic message also contain spam content. In accordance with at least one embodiment, the spam detection module232may calculate a first score for the electronic message which represents the probability that the electronic message contains spam content. In some examples, the first score may be utilized by the spam prevention module236to determine whether the electronic service associated with the electronic message has been compromised.

The spam detection module232may also be configured to calculate a history score which represents the probability that the plurality of messages being sent within a certain time period of the electronic message also contain spam content. In accordance with at least one embodiment, the spam detection module232may provide the first score and the history score to the spam prevention module236to determine whether the electronic service associated with the message has been compromised by an outside party. For example, the spam prevention module236may compare a combination of the scores to a specified threshold to determine whether the electronic service has been compromised by an outside party.

In accordance with at least one embodiment, the spam detection module232may be configured to receive a notification that an electronic message is being sent by an electronic service associated with a user. For example, an outside party may be utilizing the user's user device204to send messages which contain spam content. In an example, a virus may be attempting to send a plurality of messages to each contact within a user's email account. The messages may be communicated to the one or more spam detection/prevention service computers210via the networks208from a local electronic service, such as a local mail client, configured to run on the user device204. In accordance with at least one embodiment, the spam detection/prevention service computers210may be configured to provide a native application for spam detection and prevention for use on the user device204. In accordance with at least one embodiment, the electronic message may be communicated from an electronic service configured to run on the browser application206where the electronic service is provided by a third party. The third party may utilize one or more third party computers212to communicate the messages being sent from the electronic service to the spam detection prevention service computers210via networks208. In accordance with at least one embodiment, the spam detection/prevention service computers210may be configured to provide electronic services for sending and receiving electronic messages such as an email client or social networking site. The spam detection/prevention service computers210may provide the electronic service via networks208to display and interact with on user devices204utilizing a browser application206or a native application configured to run on the user devices204. In accordance with at least one embodiment, a user may opt-in to participate in the service provided by the spam detection/prevention service computers210. In some examples, the user may participate in the spam detection/prevention services by agreeing to a user license agreement upon signing up for an electronic service such as an email client or social network. The user license agreement provided by a third party email client or social network may also include language which informs the user that they can participate in services provided by the spam detection/prevention service computers210.

The spam detection module232may also be configured to receive one or more notifications from recipients of spam content from an electronic service associated with the user. In accordance with at least one embodiment, the communication module240in conjunction with the spam detection module232may be configured to receive the one or more notifications and calculate a probability that the electronic service associated with the user has been compromised by an outside party. For example, several people associated with the user via a social networking site may receive multiple messages which contain spam content. The several people may utilize a notification feature, which has been provided by the spam detection/prevention service computer210to the electronic service, to flag or tag received content as spam. In accordance with at least one embodiment, the notification feature may communicate the notifications from the electronic service to the spam detection/prevention service computers210via networks208. In accordance with at least one embodiment, the spam prevention module236may be configured to analyze the notifications and calculate a probability that the electronic service has been compromised. For example, the number of notifications may be compared to a specified threshold by the spam prevention module236to determine if the electronic service has been compromised.

In accordance with at least one embodiment, the spam detection/prevention service computers210and the spam detection module232may be responsible for encrypting and decrypting electronic messages being sent by the user utilizing an electronic service configured to run on a browser application206or a native application on the user device204. In accordance with at least one embodiment, messages may be encrypted for communication to the spam detection/prevention service computers210, decrypted and analyzed by the spam detection module232, and encrypted again for transfer to the electronic service attempting to send the message. In some examples, the spam detection prevention service computers210may employ encryption/decryption techniques including a symmetric key encryption scheme, a public key encryption scheme, or any suitable encryption/decryption algorithm or scheme.

The memory218may also include a spam prevention module236. The spam prevention module236may be configured to determine if an electronic service has been compromised. As described herein and in accordance with at least one embodiment, the spam prevention module236can compare a score calculated by the spam detection module232to a specified threshold to determine if the electronic service of a user has been compromised. In accordance with at least one embodiment, a user may specify the threshold which determines if an electronic service has been compromised. In accordance with at least one embodiment, the user specified thresholds may be stored on the one or more data stores230for access and maintenance. In accordance with at least one embodiment, an administrator of the spam detection/prevention service computers210may specify the threshold. In accordance with at least one embodiment, different users may have different thresholds specified for them. In some examples, different electronic services associated with the user may have varying threshold values specified by either the user or an administrator of the spam detection/prevention computers210.

In accordance with at least one embodiment, the spam prevention module236may be responsible for preventing the sending of electronic messages from an electronic service that has been determined to be compromised. For example, upon a determination by the spam prevention module236that a user's email account has been compromised, the spam prevention module236can prevent the communication of any outgoing emails from the email account until authentication information has been provided by the user. Thus, the outside party who has compromised the email account may be unable to send a message to any recipient until the user has provided the requested authentication information. As will be described below, the spam prevention module236may communicate with the authentication module234to request authentication information from the user to allow the sending of electronic messages.

In accordance with at least one embodiment, the spam prevention module236in combination with the communication module240may be responsible for preventing third party reset authentication capabilities upon a determination that the user's electronic service has been compromised. For example, a user's email account may be compromised by a third party. The compromising party, or outside party, may then be able to utilize the email account to reset the user's authentication for an associated bank account, electronic marketplace ordering account, a credit card account, or any third party service which contains financial information or personal information. In accordance with at least one embodiment, the spam detection/prevention service computers210may provide to participating third party services an API which allows the spam prevention module236to prevent reset authentication capabilities. In accordance with at least one embodiment, the spam prevention module236may invoke the API of a participating third party service to prevent reset authentication capabilities via networks208to, for example, one or more third party computers212. In accordance with at least one embodiment, the third party services may provide their own preventative reset authentication functions or APIs which may be called or invoked by the spam prevention module236upon a determination that a user's electronic service has been compromised.

The memory218may also include authentication module234. The authentication module234may be configured to request and receive authentication information from a user. For example, when a determination has been made that the user's electronic service has been compromised, the authentication module234may create a unique code to provide to the user via a means other than the compromised electronic service. In an example, the authentication module234may provide a unique code to the user via a SMS text message, a digital message to be played on a mobile phone, an email to an electronic service that has not been determined to be compromised, or via any suitable means of digital communication. In accordance with at least one embodiment, the authentication module234may be configured to request authentication information. Authentication information may include username and password information, an answer to a security question, a previously provided code, or a time sensitive code communicated to the user.

In accordance with at least one embodiment, the authentication information requested may include an authenticator token which can be provided by the spam detection/prevention service computers210via a separate standalone application. In accordance with at least one embodiment, the authentication module234and spam prevention module236may be configured to allow the sending of messages upon receiving the requested authentication information. In accordance with at least one embodiment, the one or more data stores230may be configured to store and maintain requested and received authentication information. In accordance with at least one embodiment, the authentication module234and the spam prevention module236may be configured to communicate with one or more third party services to allow reset authentication capabilities that may have been previously locked.

The memory218may also include user interface module238. In accordance with at least one embodiment, the user interface module238, the spam prevention module236, and the spam detection module232may be configured to receive input from a user interface associated with the electronic service. In accordance with at least one embodiment, the user interface module238and the spam prevention module236may prevent the sending of messages from a compromised electronic service after receiving authentication information provided by the user. The modules238and236may require further input from the user regarding which messages should be sent and which were correctly classified as containing spam content. In some examples, the user interface module238and the spam prevention module236may allow the sending of user specified electronic messages upon receiving the user input. In an example, the user interface module may be configured to receive input regarding which messages should be sent and which should not be sent. For example, if a user's email account has been compromised, upon providing the requested authentication information, the user may securely log into the email account and specify which emails should be sent and which should not be sent. In accordance with at least one embodiment, the spam detection/prevention service computers210and the user interface module238may be responsible for providing a user interface which the user may interact with to provide input regarding electronic messages. In accordance with at least one embodiment, the user interface module238may provide a user interface to the user via the browser application206or via an application configured to run on the user device204.

A few additional examples of the operations of the question/answer management computers210are also described in greater detail below with reference toFIGS. 3-8.

FIG. 3depicts a user interface diagram illustrating an example user specified electronic message confirmation web page in accordance with at least one embodiment. As shown, the illustrative web page300is displayed via a web-browser302. It should be noted that while the user specified electronic message confirmation web page is discussed in this example as utilizing a web page interface, any user friendly GUI configured to run on a suitable computing device may also be utilizing including an application configured to run on the user device204or provided by the one or more service provider computers210. The web page300may include an address bar304which a user may enter a uniform resource locator (URL) to be directed to a user specified electronic message confirmation web page associated with an electronic service such as an email account. The web page300may include an information box306which may provide instructions to the user on how to interact with the user specified electronic message confirmation web page.

The web page300may include a plurality of electronic messages308that are being prevented from being sent by the spam detection/prevention service described herein. As described above, the interface provided via web page300may be configured to receive input from the user indicating which messages should be sent310and which messages were correctly classified as spam content312. In accordance with at least one embodiment, once the user has indicated that a message may be communicated, the modules236and238may allow the electronic service associated with the messages to complete the sending operation of the confirmed messages. In accordance with at least one embodiment, messages which are confirmed as containing spam content may be utilized by the spam detection/prevention computers210and spam detection module232to provide training data for the one or more spam detection algorithms described above. In accordance with at least one embodiment, the one or more spam detection algorithms may be dynamically updated utilizing the provided training data as confirmed by the user.

FIG. 4illustrates an illustrative flow for providing a spam detection and prevention feature associated with a social network described herein, according to at least one example. In one non-limiting example, the method400can receive one or more notifications from an electronic service that spam content is being communicated from the user's electronic service at402. For example, one or more recipients of the spam content408may notify the spam detection and prevention service computers406utilizing user devices404. The method400may determine based on the one or more notifications if the electronic service has been compromised410. For example, a spam detection and prevention service provider computer406may compare the number of received notifications to a specified threshold to determine if the user's electronic service has been compromised. As described above, the spam prevention module236and communication module420may be responsible for determining whether the user's electronic service has been compromised based at least in part on the one or more notifications.

When it has been determined by the service provider computer406that the user's electronic service has been compromised, then the service provider computer406may request authentication information from the user412before communicating electronic messages from the associated electronic service. For example, the service provider computer406may request authentication information414from a user utilizing a user device416. Once the user has provided the requested authentication information414, electronic messages may again be communicated from the associated electronic service. In accordance with at least one embodiment, the electronic service may be prevented from communicating the electronic messages until the user has successfully authenticated with the electronic service. The user utilizing a user device404,416may specify which electronic messages can be communicated and which electronic messages were properly classified as containing spam content.

FIG. 5illustrates an illustrative flow for a third party reset authentication prevention feature described herein, according to at least one example. In one non-limiting example, the method500can receive an electronic message prior to being sent to a recipient at502. For example, an outside party utilizing a user device504may be attempting to send electronic messages506via an electronic service508which contain spam content510. The method500may analyze the electronic message for spam content to determine if the electronic service has been compromised512. For example, a spam detection and prevention service provider computer514may analyze the spam content electronic message510utilizing a spam detection algorithm. The spam content electronic message510may contain a link to a web site which aids in distributing and proliferating viruses and other spam content. The spam detection algorithm may calculate a score for the electronic message510which represents the probability that the message contains spam content. The service provider computer514may then determine if the electronic service508has been compromised based on the score of the electronic message510, other scores calculated from messages received within a particular time window surrounding the electronic message510, and a specified threshold value. In accordance with at least one embodiment, the service provider computer514may determine if the electronic service508has been compromised based on any combination of the score of the electronic message510, other scores calculated from messages received within a particular time window surrounding the electronic message510, or a specified threshold value.

When it has been determined by the service provider computer514that the user's electronic service has been compromised, then the service provider computer514may call APIs to prevent reset authentication capability of associated third party services until authentication information has been provided by the user516. For example, the service provider computer514may call or invoke APIs provided by the one or more associated third party services518to prevent reset authentication capability. In accordance with at least one embodiment, the API may be provided to the associated third party services by the spam detection/prevention service via networks208. Once the user has provided the requested authentication information the service provider computer514may communicate with the associated third party services518to again allow reset authentication capability. In accordance with at least one embodiment, the renewal of reset authentication capability may be provided by a different or a similar API call as utilized at516.

FIG. 6illustrates an example flow diagram of a process for describing an implementation of a spam detection and prevention system described herein, according to at least one example. In some examples, the one or more spam detection/prevention service computers210(e.g., utilizing at least one of the spam detection module232, the authentication module234, the spam prevention module236, the user interface module238, the communication module240, and the one or more data stores230) shown inFIG. 2may perform the process600ofFIG. 6. The process600may begin at602by receiving an electronic message of a plurality of electronic messages being sent by a user. In an embodiment, the electronic messages may include an email, an instant message, or an electronic message associated with a social networking site. At604, the process600may include calculating a score for the electronic message utilizing a spam detection algorithm. In an embodiment, the score represents the probability that the electronic message contains spam content.

At606the process600may include calculating a recent history score for the plurality of electronic messages. In an embodiment, the recent history score can be calculated utilizing the spam detection algorithm described above. In some examples, the recent history score can be a combination of scores for each individual message. In accordance with at least one embodiment, a recent history score can be calculated based at least in part on how many individual messages are being sent within a given time window surrounding the electronic message. In accordance with at least one embodiment, the time window may be specified by the user, the service provider, or the messaging service. At608the process600may include determining whether an email client of the user has been compromised by an outside party based at least in part on the score and the recent history score. At610the process600may include requesting authentication information from the user upon a determination that the email client has been compromised by an outside party. In an embodiment, the authentication information may be requested from a user via a text message, an email message sent to an alternate email client, or a digital recording that may interact with any suitable media player. The process600may conclude at612by preventing the communication of the plurality of electronic messages until the user has provided the authentication information612. In some examples, the user may provide the authentication information utilizing user devices204.

FIG. 7illustrates an example flow diagram of a process for describing an implementation of a spam detection and prevention system described herein, according to at least one example. In some examples, the one or more spam detection/prevention service computers210(e.g., utilizing at least one of the spam detection module232, the authentication module234, the spam prevention module236, the user interface module238, the communication module240, and the one or more data stores230) shown inFIG. 2may perform the process700ofFIG. 7. The process700may begin at702by receiving an electronic message being sent by a user. In an embodiment, the electronic messages may include an email, an instant message, or an electronic message associated with a social networking site. At704, the process700may include calculating a score for the electronic message. In an embodiment, the score represents the probability that the electronic message contains spam content. In accordance with at least one embodiment, the score may be calculated utilizing one or more spam detection algorithms.

At706the process700may include determining whether an electronic service of the user has been infiltrated by an outside party based at least in part on the score. The process700may conclude at708by requesting authentication information from the user upon a determination that the electronic service has been compromised. In an embodiment, the authentication information may be requested from a user via a text message, an email message sent to an alternate email client, or a digital recording that may interact with any suitable media player. In some examples, the user may provide the authentication information utilizing user devices204.

FIG. 8illustrates an example flow diagram of a process for describing an implementation of a spam detection and prevention system described herein, according to at least one example. In some examples, the one or more spam detection/prevention service computers210(e.g., utilizing at least one of the spam detection module232, the authentication module234, the spam prevention module236, the user interface module238, the communication module240, and the one or more data stores230) shown inFIG. 2may perform the process800ofFIG. 8. The process800may begin at802by receiving one or more notifications from an electronic service associated with the user that span content is being communicated. In an embodiment, the notifications can be in response to a social network associated with the user communicating electronic messages which contain spam, or in response to an email client associated with the user communicating emails which contain spam content. At804, the process800may include determining whether to prevent communication of content from the electronic service based at least in part on the one or more notifications and a pre-defied threshold. In an embodiment, the pre-defined threshold may be specified by the user or by an administrator of the spam detection/prevention service computers210.

At806the process800may include requesting authentication information from the user upon a determination to prevent communication of content from the electronic service. In an embodiment, the authentication information may be requested from a user via a text message, an email message sent to an alternate email client, or a digital recording that may interact with any suitable media player. In some examples, the user may provide the authentication information utilizing user devices204. The process800may conclude at808by preventing the communication of content from the electronic service until the user has provided authentication information.