Patent ID: 8819816

Claim:
A computer implemented method comprising: receiving a plurality of messages from users of a social networking system, the messages for delivery to one or more other users of the social networking system; identifying a set of features associated with the received messages, wherein each feature is associated with one or more messages and comprises a characteristic common to the one or more messages; comparing a number of occurrences of the features across subsequent time intervals; identifying a feature of the set of features for which the number of occurrences of the feature in messages during an interval of time exceeds the occurrences of the feature in messages during a previous interval of time by more than a threshold value; sending enhanced authentication to a plurality of senders of the messages in which the identified feature occurred; responsive to more than a threshold percentage of the plurality of senders failing to pass the enhanced authentication within a time interval, determining whether the identified feature as indicative of bad content; and responsive to determining the identified feature as indicative of bad content, blocking from delivery subsequent messages received in which the identified feature occurs.