Methods and systems for finding compromised social networking accounts

Patent metadata

Field	Value
Publication number	US-10078750-B1
Application number	US-201414303986-A
Country	US
Kind code	B1
Filing date	Jun 13, 2014
Priority date	Jun 13, 2014
Publication date	Sep 18, 2018
Grant date	Sep 18, 2018

Abstract

Social messages sent or posted by users of a social networking service are collected. Compromised social networking accounts are identified from the collected social messages. Keywords indicative of compromised social networking accounts are extracted from social messages of identified compromised social networking accounts. The keywords are used as search terms in a search query for additional social messages. Additional compromised social networking accounts are identified from search results that are responsive to the search query.

First claim

What is claimed is:

1. A system for finding a compromised social networking account, the system comprising:
a social networking site comprising one or more computers that provide a social networking service over the Internet; and
a backend system for receiving social messages from the social networking site, identifying compromised social networking accounts from the received social messages, extracting keywords from social messages of the identified compromised social networking accounts, sending a search query with the extracted keywords as search terms, receiving search results responsive to the search query from the social networking site, and finding additional compromised social networking accounts from social messages that are included in the search results.

2. The system of claim 1 , further comprising:
a web reputation system for providing reputations of uniform resource locators (URL) extracted by the backend system from the received social messages.

3. The system of claim 1 , wherein the received social messages comprise tweet messages.

4. The system of claim 1 , wherein the received social messages comprise webpages.

5. The system of claim 1 , wherein the identified compromised social networking accounts send spam messages.

6. The system of claim 1 , wherein the identified compromised social networking accounts are accounts that have been hijacked from their registered owner.

7. A method of finding a compromised social networking account, the method comprising:
receiving in a computer a sampling of messages from a social networking service;
identifying compromised social networking accounts of the social networking service from the sampling of messages;
extracting keywords from identified compromised social networking accounts; and
searching a social networking site of the social networking service using the extracted keywords as search terms.

8. The method of claim 7 , further comprising:
receiving search results responsive to the searching; and
finding additional compromised social networking accounts from the search results.

9. The method of claim 7 , wherein identifying the compromised social networking accounts of the social networking service from the sampling of messages comprises:
extracting a uniform resource locator (URL) from the sampling of messages; and
determining a reputation of the URL.

10. The method of claim 9 , wherein determining the reputation of the URL comprises consulting a web reputation system over the Internet.

11. The method of claim 7 , wherein the sampling of messages comprise webpages.

12. The method of claim 7 , wherein the sampling of messages comprise tweet messages.

13. The method of claim 7 , wherein identifying the compromised social networking accounts of the social networking service from the sampling of messages comprises:
identifying spam messages from the sampling of messages.

14. A method of finding a compromised social networking account, the method comprising:
receiving a first set of social messages in a computer system, the first set of social messages being received over the Internet from a social networking site of a social networking service;
identifying a first set of compromised social networking accounts from the first set of social messages;
extracting keywords indicative of a compromised social networking account from the first set of compromised social networking account;
searching the social networking site for a second set of social messages that contain the keywords; and
receiving in the computer system search results responsive to the searching of the social networking site, the search results including the second set of social messages.

15. The method of claim 14 , wherein the first set of social messages comprise tweet messages.

16. The method of claim 14 , wherein the first set of social messages comprise webpages.

17. The method of claim 14 , wherein identifying the first set of compromised social networking accounts from the first set of social messages comprises:
consulting a web reputation system for reputations of uniform resource locators (URLs) that are included in the first set of social messages.

18. The method of claim 14 , wherein identifying the first set of compromised social networking accounts from the first set of social messages comprises:
identifying spam messages in the first set of social messages.

19. The method of claim 14 , further comprising:
informing the social networking service about identified compromised social networking accounts.

20. The method of claim 14 , further comprising:
finding a second set of compromised social networking accounts from the second set of social messages.

Assignees

• Trend Micro Inc

Inventors

• Oliver Jonathan James

Classifications

• G06F17/30864

  Physics · mapped topic

• H04L51/32

  Electricity · mapped topic

• G06F21/50 Primary

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• H04L51/52 Primary

  for supporting social networking services · CPC title