Cloud-based analytics to mitigate abuse from internet trolls

Patent metadata

Field	Value
Publication number	US-9961115-B2
Application number	US-201615267339-A
Country	US
Kind code	B2
Filing date	Sep 16, 2016
Priority date	Sep 16, 2016
Publication date	May 1, 2018
Grant date	May 1, 2018

Abstract

An approach is provided in which an information handling system creates a first language profile corresponding to a first user account in response to determining that the first user account generated a first offensive message. The information handling system computes an accumulated risk score of the first user account based on correlating the first language profile to a second language profile corresponding to a second user account that generated a second offensive post. The accumulated risk score is based on a first risk score of the first user account and a second risk score of the second user account. In turn, the information handling system generates a notification in response to determining that the accumulated risk score reaches a risk threshold.

First claim

The invention claimed is:

1. A method implemented by an information handling system that includes a memory and a processor, the method comprising:
performing, by the processor, natural language processing analysis on a first message received over a computer network and generated by a first social media user account;
determining, by the processor and based on the natural language processing analysis, that the first message includes a first set of offensive content;
creating, by the processor, a first language profile corresponding to the first social media user account in response to determining that the first message includes the first set of offensive content;
computing, by the processor, a correlation percentage between the first social media user account and a second social media account, wherein the computing of the correlation percentage further comprises:
matching a first posting time of the first message to a second posting time of a second message generated from the second social media account; and
determining that the second message includes one or more language patterns that are also included in the first message, wherein the one or more language patterns are different from the set of offensive content;

computing, by the processor, an accumulated risk score of the first social media user account based on a first risk score corresponding to the first social media user account, a second risk score corresponding to the second social media user account, and the correlation percentage; and
generating a notification in response to determining that the accumulated risk score reaches a risk threshold.

2. The method of claim 1 further comprising:
collecting a set of messages generated from the first social media user account;
identifying the one or more language patterns in response to analyzing both the first message and the set of messages; and
including the one or more language patterns in the first language profile.

3. The method of claim 1 further comprising:
performing natural language processing analysis on a set of subsequent messages that were posted in response to the first message being posted;
determining, based on the natural language processing analysis of the set of subsequent messages, that the set of subsequent messages includes one or more indications that the first message is offensive; and
factoring the one or more indications from the set of subsequent messages into the determination that the first message includes the set of offensive content.

4. The method of claim 1 further comprising:
suspending the first social media user account in response to determining that the accumulated risk score reaches the risk threshold.

5. The method of claim 1 wherein the first social media user account and the first message correspond to a first online forum, and wherein the second social media user account and the second message correspond to a second online forum that is different than the first online forum.

6. The method of claim 5 wherein the first social media user account and the second social media user account correspond to a same malicious user.

7. The method of claim 5 further comprising:
receiving the first message from the first online forum through a first application program interface (API); and
receiving the second message from the second online forum through a second application API.

8. An information handling system comprising:
one or more processors;
a memory coupled to at least one of the processors;
a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions of:
performing natural language processing analysis on a first message received over a computer network and generated by a first social media user account;
determining, based on the natural language processing analysis, that the first message includes a first set of offensive content;
creating a first language profile corresponding to the first social media user account in response to determining that the first message includes the set of offensive content;
computing, by the processor, a correlation percentage between the first social media user account and a second social media account, wherein the computing of the correlation percentage further comprises:
matching a first posting time of the first message to a second posting time of a second message generated from the second social media account; and
determining that the second message includes one or more language patterns that are also included in the first message, wherein the one or more language patterns are different from the set of offensive content;

computing, by the processor, an accumulated risk score of the first social media user account based on a first risk score corresponding to the first social media user account, a second risk score corresponding to the second social media user account, and the correlation percentage; and
generating a notification in response to determining that the accumulated risk score reaches a risk threshold.

9. The information handling system of claim 8 wherein the one or more processors perform additional actions comprising:
collecting a set of messages generated from the first social media user account;
identifying the one or more language patterns in response to analyzing both the first message and the set of messages; and
including the one or more language patterns in the first language profile.

10. The information handling system of claim 8 wherein the one or more processors perform additional actions comprising:
performing natural language processing analysis on a set of subsequent messages that were posted in response to the first message being posted;
determining, based on the natural language processing analysis of the set of subsequent messages, that the set of subsequent messages includes one or more indications that the first message is offensive; and
factoring the one or more indications from the set of subsequent messages into the determination that the first message includes the set of offensive content.

11. The information handling system of claim 8 wherein the one or more processors perform additional actions comprising:
suspending the first social media user account in response to determining that the accumulated risk score reaches the risk threshold.

12. The information handling system of claim 8 wherein the first social media user account and the first message correspond to a first online forum, and wherein the second social media user account and the second message correspond to a second online forum that is different than the first online forum.

13. The information handling system of claim 12 wherein the first social media user account and the second social media user account correspond to a same malicious user.

14. The information handling system of claim 12 wherein the one or more processors perform additional actions comprising:
receiving the first message from the first online forum through a first application program interface (API); and
receiving the second message from the second online forum through a second application API.

15. A computer program product stored in a computer readable storage medium, comprising computer program code that, when executed by an information handling system, causes the information handling system to perform actions comprising:
performing natural language processing analysis on a first message received over a computer network and generated by a first social media user account;
determining, based on the natural language processing analysis, that t

Assignees

• IBM
• Int Buisness Machines Corporation

Inventors

• Dalton Matthew D
• Luke James S

Classifications

• H04L63/302

  gathering intelligence information for situation awareness or reconnaissance · CPC title

• G06F40/284

  Lexical analysis, e.g. tokenisation or collocates · CPC title

• H04L63/308 Primary

  retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• G06F40/40

  Processing or translation of natural language (natural language analysis G06F40/20; semantic analysis G06F40/30) · CPC title