Search spam analysis and detection

Patent metadata

Field	Value
Publication number	US-8972401-B2
Application number	US-96612010-A
Country	US
Kind code	B2
Filing date	Dec 13, 2010
Priority date	May 31, 2007
Publication date	Mar 3, 2015
Grant date	Mar 3, 2015

Abstract

Defeating click-through cloaking includes retrieving a search results page to set a browser variable, inserting a link to a page into the search results page and clicking through to the page using the inserted link. Investigating cloaking includes providing script associated with a suspected spam URL, modifying the script to de-obfuscate the script and executing the modified script to reveal cloaking logic associated with the script.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
performing a search using a search engine to generate search results, the search results including a uniform resource locator (URL);
performing server-side cloaking based at least in part on the URL, the server-side cloaking comprising:
accessing, by a processor, a first web page from the URL by clicking the URL included in the search results, the first web page containing spam content;
accessing, by the processor, a second web page from the URL without clicking the URL included in the search results, the second web page containing non-spam content;
comparing, by the processor, the first web page and the second web page; and
identifying, based at least on the comparing, the URL as a suspected spam URL based on a difference between the first web page and the second web page.

2. The computer-implemented method of claim 1 further comprising reducing false positives of the URL identified as the suspected spam URL.

3. The computer-implemented method of claim 1 further comprising,
responsive to the URL being identified as a suspected spam URL, manually investigating the URL to determine that the URL is serving spam.

4. The computer-implemented method of claim 1 further comprising adding a domain of the URL to a set of known spam domains for exclusion from search results provided by a search engine.

5. A method comprising:
receiving at least one URL at a computing device;
conducting, by a processor, a first scan of the at least one URL by directly visiting the at least one URL;
recording a first scan result based at least on the first scan;
conducting, by the processor, a second scan of the at least one URL by clicking-through the at least one URL from a search results page;
recording a second scan result based at least on the second scan;
comparing, by the processor, the first scan result and the second scan result; and
determining, based at least on the comparing, that the at least one URL is a suspect spam URL when the second scan result shows a vector associated with a redirection domain that is different from a vector associated with a redirection domain from the first scan result.

6. The method of claim 5 , wherein conducting the second scan further comprises modifying a referrer field in an HTTP header to indicate a referrer URL from a search engine web site.

7. The method of claim 5 , wherein conducting the first scan further comprises recording URL redirections as an XML file and conducting the second scan further comprises recording URL redirections as an XML file.

8. The method of claim 7 further comprising applying a redirection analysis to the XML file to classify a URL that redirected to a known spammer redirection domain as spam.

9. The method of claim 5 further comprising, responsive to the at least one URL being determined to be the suspect spam URL, manually investigating the at least one URL to determine that the at least one URL is serving spam.

10. The method of claim 5 further comprising adding a domain of the at least one URL to a set of known spam domains for exclusion from search results provided by a search engine.

11. The method of claim 5 further comprising reducing false positives of the at least one URL determined to be the suspect spam URL.

12. The method of claim 5 , wherein directly visiting the at least one URL comprises entering the URL in an input window and not clicking the at least one URL.

13. A computing device comprising:
computer storage media; and
one or more processors in communication with the computer storage media, wherein the computer storage media stores computer-readable instructions executable by the one or more processors to perform operations comprising:
performing a search using a search engine to generate search results, the search results including a uniform resource locator (URL);
performing server-side cloaking based at least in part on the URL, the server-side cloaking comprising:
accessing, by a processor, a first web page associated with the URL in the search results by clicking the URL included in the search results, the first web page containing spam content;
accessing, by the processor, a second web page associated with the URL directly, wherein directly accessing the second web page comprises accessing the second web page associated with the URL independent of clicking the URL included in the search results, the second web page containing non-spam content;
comparing, by the processor, the first web page and the second web page;
identifying, based at least on the comparing, the URL as a suspected spam URL based on a difference between the first web page and the second web page.

14. The computing device of claim 13 , wherein the operations further comprise reducing false positives that the URL is the suspected spam URL.

15. The computing device of claim 14 , wherein directly accessing the second web page associated with the URL comprises entering the URL in an input window and not clicking the at least one URL.

16. The computing device of claim 13 , wherein the difference between the first web page and the second web page indicates that the URL is the suspected spam URL is determined by comparison of vectors for redirection domains determined from accessing the first web page and accessing the second web page.

17. The computing device of claim 13 , wherein the operations further comprise adding a domain of the URL to a set of known spam domains for exclusion from search results provided by a search engine.

Assignees

• Wang Yi-Min
• Ma Ming
• Microsoft Corp

Inventors

• Wang Yi-Min
• Ma Ming

Classifications

• G06F2221/2119

  Authenticating web pages, e.g. with suspicious links · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L12/585

  Electricity · mapped topic

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title