Detection of lockstep behavior

Patent metadata

Field	Value
Publication number	US-9077744-B2
Application number	US-201313787591-A
Country	US
Kind code	B2
Filing date	Mar 6, 2013
Priority date	Mar 6, 2013
Publication date	Jul 7, 2015
Grant date	Jul 7, 2015

Abstract

Disclosed here are methods, systems, paradigms and structures for determining fraudulent content in a social network. The methods include identifying a plurality of users of the social network who perform a plurality of tasks within the social network in a lockstep manner. In the method, the plurality of users are determined to be performing a given task in the lockstep manner when the plurality of users each perform the given task within a predefined duration of time, where the predefined duration of time is associated with the given task. The method further includes identifying content data generated by the performance of the plurality of tasks by each of the plurality of users. The method further includes determining at least a portion of the content data generated by the performance of the plurality of tasks as fraudulent content.

First claim

What is claimed is:

1. A method for determining fraudulent content in a social network, the method comprising:
identifying, by a computing device, a plurality of users of the social network who perform a plurality of tasks within the social network in a lockstep manner, the plurality of users performing a specified task in the lockstep manner when the plurality of users each perform the specified task within a predefined duration of time, the predefined duration of time being associated with the specified task,
wherein the plurality of tasks performed within the social network include one or more of four tasks:
endorsing a Page associated with an entity, the Page being within the social network;
rating a product associated with the entity, the product being marketed within the social network;
adding a user of the social network to a follow list that includes one or more users who share information; or
posting a review of a product associated with the entity;

identifying, by the computing device, content data generated by the performance of the plurality of tasks, including one or more of the four tasks, by the identified plurality of users,
wherein the identified content data include updates to a plurality of web contents in the social network;
determining, by the computing device, at least a portion of the identified content data as fraudulent content; and
removing, by the computing device, the determined portion of the content data from the plurality of web contents in the social network.

2. The method of claim 1 , wherein the specified task is performed within the predefined duration of time by the plurality of users when a time of performance of the specified task by a specified user from the plurality of users is separated at most by the predefined duration of time from the time of performance of the specified task by any of the other users.

3. The method of claim 1 , wherein the content data generated by the performance of the specified task by the plurality of users is gathered as social data in the social network.

4. The method of claim 3 , wherein the social data includes one or more of:
a user endorsement of the Page associated with the entity;
a user rating of the product associated with the entity;
a user request to add the user to the follow list; or
a user review of the product associated with the entity.

5. The method of claim 4 , wherein the lockstep manner of posting of the review of the product by the plurality of users is further determined as a function of at least one or more of: a review tone of a specified posted review; a linguistic cue of the specified posted review; or an IP address associated with the specified posted review.

6. A method for determining fraudulent content in a social network, the method comprising:
identifying, by a computing device, a plurality of users in the social network, the identification of the plurality of users being based on a performance of a first task and a second task within the social network by each of the plurality of users,
wherein a first time of performance of the first task by a specified user from the plurality of users is separated at most by a first time duration from the time of performance of the first task by any of the other users,
wherein a second time of performance of the second task by the specified user is separated at most by a second time duration from the time of performance of the second task by any of the other users, and
wherein the first task and the second task are related to providing a public opinion of a person or a product within the social network;
identifying, by the computing device, content data generated by the performance of the first task and the second task by the identified plurality of users,
wherein the identified content data include updates to a plurality of web contents in the social network;
determining, by the processing device, at least a portion of the identified content data generated by the performance of the first task and the second task as fraudulent content; and
removing, by the computing device, the determined portion of the content data from the plurality of web contents in the social network.

7. The method of claim 6 , wherein a specified task performed within the social network includes one or more of:
an endorsing of a Page associated with an entity, the Page being within the social network;
a rating of a product associated with the entity, the product being marketed within the social network;
an adding of a user of the social network to a follow list that includes one or more users who share information; or
a posting of a review of the product associated with the entity.

8. The method of claim 7 , wherein the content data generated by the performance of the specified task by the plurality of users is gathered as social data in the social network.

9. The method of claim 8 , wherein the social data includes one or more of:
a user endorsement of the Page associated with the entity;
a user rating of the product associated with the entity;
a user request to add the user to the follow list; or
a user review of the product associated with the entity.

10. The method of claim 9 , wherein the lockstep manner of posting of the review of the product by the plurality of users is further determined as a function of at least one or more of: a review tone of a specified posted review; a linguistic cue of the specified posted review; or an IP address associated with the specified posted review.

11. A system, comprising:
at least one memory storing computer-executable instructions; and
at least one processor configured to access the at least one memory and execute the computer-executable instructions to perform a set of acts, the acts including:
identifying a plurality of users of a social network who perform a specified task within the social network in a lockstep manner such that the plurality of users each perform the specified task within a predefined duration of time, the predefined duration of time being associated with the specified task,
wherein the specified task is related to expressing a public opinion of a person or a product within the social network;
identifying content data generated by the performance of the specified task by the identified plurality of users,
wherein the identified content data include updates to a plurality of web contents in the social network;
determining at least a portion of the identified content data generated by the performance of the specified task as fraudulent content; and
removing the determined portion of the content data from the plurality of web contents in the social network.

12. The system of claim 11 , wherein the specified task is performed within the predefined duration of time by the plurality of users when a time of performance of the specified task by a specified user from the plurality of users is separated at most by the predefined duration of time from the time of performance of the specified task by any of the other users.

13. The system of claim 11 , wherein the specified task performed within the social network includes one or more of:
an endorsing of a Page associated with an entity, the Page being within the social network;
a rating of a product associated with the entity, the product being marketed within the social network;
an adding of a user of the social network to a follow list that includes one or more users who share information; or
a posting of a review of the product associated with the entity.

Assignees

• Facebook Inc

Inventors

• Beutel Alexander
• Xu Wanhong

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L65/403

  Arrangements for multi-party communication, e.g. for conferences (data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15) · CPC title

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title