Application graph builder

Patent metadata

Field	Value
Publication number	US-11005883-B2
Application number	US-201715788570-A
Country	US
Kind code	B2
Filing date	Oct 19, 2017
Priority date	Apr 30, 2014
Publication date	May 11, 2021
Grant date	May 11, 2021

Abstract

Disclosed is a system for recommending content of a predefined category to an account holder, detecting spam applications, or account holders based on the account holder application graphs. The system receives information corresponding to applications executing on the client device of the account holders and generates an application graph for each account holder that includes a list of predefined application categories that are preferred by the account holder. For each predefined category, a list of account holders preferring content relevant to that category is predicted based on the set of generated application graphs. Some application graphs may be detected as spam application graphs by comparing the generated application graphs with a set of predefined spam application graphs. Alternatively, if the generated application graph does not match the predefined spam application graphs, they are compared to a set of application graphs from a database to find similar application graphs.

First claim

What is claimed is:

1. A computer-executed method for determining that a user account is a spam account, the method comprising:
receiving information corresponding to one or more applications executing on one or more client devices corresponding to the user account;
generating an application graph for the user account based on the received information, wherein the application graph comprises data identifying one or more first categories of applications, from a set of multiple predefined categories of applications, that have executed on the one or more client devices corresponding to the user account;
retrieving, from an application graph database, one or more spam application graphs, wherein each spam application graph is an application graph generated from information associated with a respective account that has been identified as a spam account;
comparing the application graph for the user account with each of the one or more spam application graphs to determine a respective degree of similarity between the application graph for the user account and each of the one or more spam application graphs, comprising, for each of the one or more spam application graphs:
comparing (i) the one or more first categories of applications, from the set of multiple predefined categories of applications, identified by the application graph for the user account and (ii) one or more second categories of applications, from the set of multiple predefined categories of applications, that are identified by the spam application graph;

determining, for each of the one or more spam application graphs, whether the respective degree of similarity satisfies a threshold amount; and
in response to determining that the respective degree of similarity between the application graph for the user account and a particular spam application graph satisfies the threshold amount:
obtaining additional information signals for the one or more applications executing on the one or more client devices corresponding to the user account; and
determining, from the additional information signals, that the user account is a spam account.

2. The computer-executed method of claim 1 , further comprising, in response to determining that the user account is a spam account, transmitting a notification that the user account is a spam account to one or more of:
one or more other client devices corresponding to respective other user accounts,
one or more advertising networks, or
one or more third-party agencies.

3. The computer-executed method of claim 1 , further comprising:
receiving a request to determine whether one or more user accounts are spam accounts from a requestor, wherein the requestor corresponds to an ad-network, an application developer, or a third-party application service.

4. The computer-executed method of claim 1 , wherein the additional information signals comprise one or more of: a number of downloads of applications with respect to time, a set of sent messages, or a usage time of at least one of the one or more applications executing on the one or more client devices.

5. The computer-executed method of claim 4 , wherein determining, from the additional information signals, that the user account is a spam account comprises one or more of:
determining that the user account has not downloaded any applications onto the one or more client devices within a period of time;
determining, for each application of the one or more applications besides a particular application of the one or more applications, that the usage time of the application is below a threshold; or
detecting one or more abusive messages.

6. The computer-executed method of claim 1 , further comprising:
transmitting the application graph of the user account to the application graph database; and
storing the application graph as a new spam application graph based on the determination that the user account is a spam account.

7. The computer-executed method of claim 1 , further comprising:
in response to determining that the respective degrees of similarity between the application graph for the user account and each of the one or more spam application graphs do not satisfy the threshold amount:
searching the application graph database for one or more similar application graphs, wherein each similar application graph is (i) similar to the application graph for the user account and (ii) not associated with a spam account, and
if finding one or more similar application graphs, determining that the user account is not a spam account.

8. The computer-executed method of claim 7 , wherein searching the application graph database for one or more similar application graphs comprises generating respective similarity scores quantifying a set of differences between the application graph for the user account and application graphs of the application graph database.

9. The computer-executed method of claim 7 , wherein further comprising:
if one or more similar application graphs are not found in the application graph database, determining that the user account is a spam account.

10. The computer-executed method of claim 1 , further comprising:
determining, for each of the one or more spam application graphs, whether the respective degree of similarity indicates that the application graph for the user account exactly matches the spam application graph; and
in response to determining that the respective degree of similarity between the application graph for the user account and a particular spam application graph indicates that the application graph for the user account exactly matches the spam application graph, determining that the user account is a spam account.

11. The computer-implemented method of claim 1 , wherein:
comparing (i) the one or more first categories of applications, from the set of multiple predefined categories of applications, identified by the application graph for the user account and (ii) one or more second categories of applications, from the set of multiple predefined categories of applications, that are identified by the spam application graph comprises:
determining a percentage of the first categories that match the second categories; and

determining, for each of the one or more spam application graphs, whether the respective degree of similarity satisfies a threshold amount comprises:
determining whether the percentage of the first categories that match the second categories exceeds a threshold percentage.

12. A non-transitory computer-readable storage medium comprising instructions for determining that a user account is a spam account that when executed cause a processor to:
receive information corresponding to one or more applications executing on one or more client devices corresponding to the user account;
generate an application graph for the user account based on the received information, wherein the application graph comprises data identifying one or more first categories of applications, from a set of multiple predefined categories of applications, that have executed on the one or more client devices corresponding to the user account;
retrieve, from an application graph database, one or more spam application graphs, wherein each spam application graph is an application graph generated from information associated with a respective account that has been identified as a spam account;
compare the application graph for the user account with each of the one or more spam application graphs to determine a respective degree of similarity between the application graph for the user account and each of the one or more spam application graphs, comprising, for each of the one or more spam application graphs

Assignees

• Twitter Inc

Inventors

• Rao Deepak
• Zymnis Argyrios
• Lynn Kelton
• Ducker Michael
• Cook Sean

Classifications

• G06Q10/06 Primary

  Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling · CPC title

• H04L51/212

  using filtering or selective blocking · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• G06F16/9566

  URL specific, e.g. using aliases, detecting broken or misspelled links · CPC title

• G06F8/70

  Software maintenance or management · CPC title