Anti-spam transient entity classification

A method, comprising:

• receiving, by a processor, a first message associated with an IP address of a mail server that sent the first message;
• fetching, by the processor, a plurality of features associated with the IP address, the plurality of features including one or more fast features and one or more full features, wherein a fast feature comprises a feature that does not require user feedback, and wherein a full feature incorporates user feedback;
• classifying, by the processor, the IP address with a fast classifier based on the one or more fast features;
• determining, by the fast classifier, that the mail server is a spammer;
• caching, by the processor, a result of the fast classifier in an entity classification cache;
• receiving, by the processor, a second message associated with the IP address;
• performing, by the processor, an action on the second message based on the cached result of the fast classifier;
• classifying, by the processor, the IP address with a full classifier based on the one or more full features and based on the one or more fast features, wherein the one or more full features comprises how frequently the IP address is a source of a message;
• caching, by the processor, a result of the full classifier in the entity classification cache;
• and
• moving, by the processor, a plurality of received messages into a different folder based on the result of the full classifier.

A computing device, comprising:

• a processor;
• a storage medium for tangibly storing thereon program logic for execution by the processor, the stored program logic comprising:
• message receiving logic executed by the processor for receiving a first message associated with an IP address of a mail server that sent the first message;
• fetching logic executed by the processor for fetching a plurality of features associated with the IP address, the plurality of features including one or more fast features and one or more full features, wherein a fast feature comprises a feature that does not require user feedback, and wherein a full feature incorporates user feedback;
• fast feature classifying logic executed by the processor for classifying the IP address with a fast classifier based on the one or more fast features;
• spammer determining logic executed by the processor for determining, by the fast classifier, that the mail server is a spammer;
• fast classifier caching logic executed by the processor for caching a result of the fast classifier in an entity classification cache;
• second message receiving logic executed by the processor for receiving a second message associated with the IP address;
• action performing logic executed by the processor for performing an action on the second message based on the cached result of the fast classifier;
• full feature classifying logic executed by the processor for classifying the IP address with a full classifier based on the one or more full features and based on the one or more fast features, wherein the one or more full features comprises how frequently the IP address is a source of a message;
• full classifier caching logic executed by the processor for caching a result of the full classifier in the entity classification cache;
• and
• message moving logic executed by the processor for moving a plurality of received messages into a different folder based on the result of the full classifier.

A non-transitory computer-readable storage medium comprising computer-executable instructions for execution by a processor, the instructions comprising:

• receiving, by the processor, a first message associated with an IP address of a mail server that sent the first message;
• fetching, by the processor, a plurality of features associated with the IP address, the plurality of features including one or more fast features and one or more full features, wherein a fast feature comprises a feature that does not require user feedback, and wherein a full feature incorporates user feedback;
• classifying, by the processor, the IP address with a fast classifier based on the one or more fast features;
• determining, by the fast classifier, that the mail server is a spammer;
• caching, by the processor, a result of the fast classifier in an entity classification cache;
• receiving, by the processor, a second message associated with the IP address;
• performing, by the processor, an action on the second message based on the cached result of the fast classifier;
• classifying, by the processor, the IP address with a full classifier based on the one or more full features and based on the one or more fast features, wherein the one or more full features comprises how frequently the IP address is a source of a message;
• caching, by the processor, a result of the full classifier in the entity classification cache;
• and
• moving, by the processor, a plurality of received messages into a different folder based on the result of the full classifier.