METHOD AND SYSTEM FOR IDENTIFYING NON-USER SOCIAL MEDIA ACCOUNTS

A method, a device, and a non-transitory storage medium are described for identifying non-user social media accounts and that include obtaining a training data set of social media account information; generating additional data elements based on the training data set of social media account information; and generating a predictive model that indicates whether a social media account is a user account or a non-user account based on the obtained training data set and the additional data elements. An unknown social media account is identified for analysis. Social media account information associated with the unknown social media account is retrieved and the additional data elements for the unknown social media account are generated. The predictive model is applied to the social media account information and additional data elements for the unknown social media account to predict whether the unknown social media account is a user account or a non-user account.

BACKGROUND

Service providers often engage customers via social media platforms to receive product feedback, provide technical or account support, etc. To enhance such interactions, service providers effort to correlate each interaction with a specific customer account. One issue with accomplishing this goal is the presence of non-user social media accounts, which are typically referred to as “bots”. The term “bot” loosely refers to a social media account whose content is not directly generated by a single user, but rather is created by some automated computer algorithm, with or without human intervention. A large number of social media accounts are bot accounts that do not correspond to a particular user. Such bot accounts may emulate human users and may actively attempt to engage service provider social media activities for various purposes, some of which are illicit or nefarious in nature.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

According to exemplary embodiments, a non-user social media account identification system is described. In one implementation, the non-user social media account identification system includes components for retrieving and preparing data sourced from one or more social media platforms relating to a plurality of social media accounts. For example, account profile and metadata information as well as social media activity (i.e., posts, tags, etc.) may be retrieved. As described below, a prediction model may be created based on a corpus of data associated with known user account information (e.g., relating to known user and non-user accounts). Upon model validation, the prediction model may be applied to social media interactions associated with unknown social media accounts. A probabilistic determination regarding whether the unknown social media accounts are user accounts or non-user accounts may be made for subsequent social media interactions. The determination is used to inform future interactions and engagement with the non-known social media accounts via the social media platform.

FIG. 1is a diagram illustrating an exemplary environment100in which an exemplary embodiment of the non-user social media account detection service may be implemented. As illustrated, environment100includes a local area network105and an external network130. Local area network105may include a bot detection engine110and end devices115-1through115-X (also referred to as end devices115and individually or generally as end device115). External network130may include social media platform devices135-1through135-Z (also referred to as social media platform devices135and individually or generally as social media platform device135).

The number, type, and arrangement of networks illustrated in environment100are exemplary. The number, the type, and the arrangement of end devices115in local area network105, as illustrated and described, are exemplary. The number, the type, and the arrangement of social media platform devices135in external network130, as illustrated and described, are exemplary.

A device, such as bot detection engine110, end device115, and social media platform device135may be implemented according to one or multiple network architectures (e.g., a client device, a server device, a peer device, a proxy device, a cloud device, a virtualized function, and/or another type of network architecture (e.g., Software Defined Networking (SDN), virtual, logical, network slicing, etc.)). Additionally, social media platform device135may be implemented according to various computing architectures, such as centralized, distributed, cloud (e.g., elastic, public, private, etc.), edge, fog, and/or another type of computing architecture.

Environment100includes communication links between the networks, between bot detection engine110and end device115, and between bot detection engine110and social media platform devices135. Environment100may be implemented to include wired, optical, and/or wireless communication links among the devices illustrated. A communicative connection via a communication link may be direct or indirect. For example, an indirect communicative connection may involve an intermediary device and/or an intermediary network not illustrated inFIG. 1. A direct communicative connection may not involve an intermediary device and/or an intermediary network. The number and the arrangement of communication links illustrated in environment100are exemplary.

Environment100may include various planes of communication including, for example, a control plane, a user plane, and a network management plane. Environment100may include other types of planes of communication. A message communicated in support of the bot detection engine may use at least one of these planes of communication.

Local area network105may include a network that provides the non-user social media account detection service, as described herein. For example, local area network105may be implemented as a business network or other geographic-limited locale (e.g., business, etc.).

Bot detection engine110may include a device or combination of devices that provides the non-user social media account detection service, as described herein. For example, bot detection engine110may be implemented as one or more physical or virtual network devices (e.g., server type devices) or a combination thereof. As described herein, bot detection engine110may obtain information from one or more social media platform devices135, may generate a bot detection model based on the obtained selected elements of the obtained information, and may apply the generated model to social media interactions to determine whether user accounts associated with the social media interactions are non-user accounts (e.g., bot accounts). Although bot detection engine110is illustrated as residing on local area network105, in other implementations, bot detection engine110may reside on external network130, or may be configured as a network service having functionality distributed across one or more networks.

End device115may include a device that obtains information and has communication capabilities to at least transmit the information to local area network and/or external network130. For example, end device115may be implemented as a computer (e.g., desktop, laptop, etc.), a mobile device (e.g., a smartphone, a tablet, etc.), etc., that may receive information from and/or transmit information to social media platform devices135and bot detection engine110as described herein.

External network130may include various types of networks external from local area network105. For example, external network130may include a wired network, a wireless network, an optical network, a private network, a public network, a terrestrial network, and/or a satellite network. By way of further example, external network130may include the Internet, a service provider network, a transport network, a data network, an application layer network (e.g., a cloud network, etc.), the World Wide Web, a radio access network (RAN), a core network, a packet-switched network, and/or other types of networks not specifically described herein.

Depending on the implementation, external network130may include various network devices, such as social media platform devices135. For example, social media platform devices135may provide various applications, services, or other type of end device assets, such as servers (e.g., web, application, cloud, etc.), mass storage devices, and/or data center devices. As described herein, social media platform devices135may provide information elements relating to users and accounts on the social media platform via one or more application programming interfaces (APIs). For example, social media platform devices135may provide or support an API for developers that provides access to user account information and social media activity information.

FIG. 2is a diagram illustrating exemplary components of a device200that may be included in one or more of the devices described herein. For example, device200may correspond to bot detection engine110, end device115, and social media platform device135, and other types of network devices or logic, as described herein. As illustrated inFIG. 2, device200includes a bus205, a processor210, a memory/storage215that stores software220, a communication interface225, an input230, and an output235. According to other embodiments, device200may include fewer components, additional components, different components, and/or a different arrangement of components than those illustrated inFIG. 2and described herein.

Bus205includes a path that permits communication among one or multiple components of device200. For example, bus205may include a system bus, an address bus, a data bus, and/or a control bus. Bus205may also include bus drivers, bus arbiters, bus interfaces, clocks, and so forth.

Processor210may control the overall operation, or a portion of operation(s) performed by device200. Processor210may perform one or multiple operations based on an operating system and/or various applications or computer programs (e.g., software220). Processor210may access instructions from memory/storage215, from other components of device200, and/or from a source external to device200(e.g., a network, another device, etc.). Processor210may perform an operation and/or a process based on various techniques including, for example, multithreading, parallel processing, pipelining, interleaving, etc.

Memory/storage215includes one or multiple memories and/or one or multiple other types of storage mediums. For example, memory/storage215may include one or multiple types of memories, such as, a random access memory (RAM), a dynamic random access memory (DRAM), a static random access memory (SRAM), a cache, a read only memory (ROM), a programmable read only memory (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), a single in-line memory module (SIMM), a dual in-line memory module (DIMM), a flash memory (e.g.,2D,3D, NOR, NAND, etc.), a solid state memory, and/or some other type of memory. Memory/storage215may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optic disk, a solid state disk, etc.), a Micro-Electromechanical System (MEMS)-based storage medium, and/or a nanotechnology-based storage medium. Memory/storage215may include drives for reading from and writing to the storage medium.

Memory/storage215may be external to and/or removable from device200, such as, for example, a Universal Serial Bus (USB) memory stick, a dongle, a hard disk, mass storage, off-line storage, or some other type of storing medium (e.g., a compact disc (CD), a digital versatile disc (DVD), a Blu-Ray disk (BD), etc.). Memory/storage215may store data, software, and/or instructions related to the operation of device200.

Software220includes an application or a program that provides a function and/or a process. As an example, with reference to bot detection engine110, software220may include an application that, when executed by processor210, provides a function of the non-user social media account detection service, as described herein. Additionally, for example, with reference to end device115, software220may include an application that, when executed by processor210, provides an interface for interacting with the non-user social media account detection service. Software220may also include firmware, middleware, microcode, hardware description language (HDL), and/or other form of instruction. Software220may also be virtualized. Software220may further include an operating system (OS) (e.g., Windows, Linux, Android, proprietary, etc.).

Communication interface225permits device200to communicate with other devices, networks, systems, and/or the like. Communication interface225includes one or multiple wireless interfaces, wired interfaces, and/or optical interfaces. For example, communication interface225may include one or multiple transmitters and receivers, or transceivers. Communication interface225may operate according to a protocol stack and a communication standard. Communication interface225may include an antenna.

Communication interface225may include various processing logic or circuitry (e.g., multiplexing/de-multiplexing, filtering, amplifying, converting, error correction, application programming interface (API), etc.). Communication interface225may be implemented as a point-to-point interface, a service based interface, etc. Communication interface225may be implemented to include logic that supports the non-user social media account detection service, such as the transmission and reception of messages (e.g., commands, etc.), packet filtering, establishment and tear down of a connection, and so forth, as described herein.

Input230permits an input into device200. For example, input230may include a keyboard, a mouse, a display, a touchscreen, a touchless screen, a button, a switch, an input port, speech recognition logic, and/or some other type of visual, auditory, tactile, etc., input component. Output235permits an output from device200. For example, output235may include a speaker, a display, a touchscreen, a touchless screen, a light, an output port, and/or some other type of visual, auditory, tactile, etc., output component.

As previously described, a network device may be implemented according to various computing architectures (e.g., in a cloud, etc.) and according to various network architectures (e.g., a virtualized function, etc.). Device200may be implemented in the same manner. For example, device200may be instantiated, created, deleted, or some other operational state during its life-cycle (e.g., refreshed, paused, suspended, rebooting, or another type of state or status), using well-known virtualization technologies (e.g., hypervisor, container engine, virtual container, virtual machine, etc.) in a network.

Device200may perform a process and/or a function, as described herein, in response to processor210executing software220stored by memory/storage215. By way of example, instructions may be read into memory/storage215from another memory/storage215(not shown) or read from another device (not shown) via communication interface225. The instructions stored by memory/storage215cause processor210to perform a process and/or a function, as described herein. Alternatively, for example, according to other implementations, device200performs a process and/or a function as described herein based on the execution of hardware (processor210, etc.).

FIG. 3is a block diagram illustrating exemplary components of and information stored in bot detection engine110consistent with implementations described herein. The components of bot detection engine function110may be implemented, for example, via processor210executing instructions from memory/storage215. Alternatively, some or all of the functional components of bot detection engine110may be implemented via hard-wired circuitry. The information stored in bot detection engine110may be stored as a database in memory/storage215, for example. As shown, bot detecting engine110may include data extraction and preparation module305, training data310, model generation and validation engine315, social media interaction analyzing module320, and bot scoring logic325. Although components305-325are shown to be separate elements inFIG. 3, any of these components may be combined into fewer elements, such as into a single component, or divided into more components as may serve a particular implementation.

Data extraction and preparation module305includes logic configured to retrieve or otherwise capture information associated with a plurality of social media accounts. In some implementations, such information may be retrieved via a developer API provided by a social media platform. In other implementations, the information may be capture or “scraped” from information that has been made publicly available by the social media platforms. Consistent with implementations described herein, information retrieved from social media platform devices135may include account level information and post level information. Account level information includes information and metrics relating to the social media user account, such as user name (i.e., handle), profile content, geographic location, follower/following counts, repost/reply counts, etc. Post level information comprises the content and associated metadata (e.g., time, date, posting software, etc.) associated with individual social media posts associated the with particular user accounts.

In some implementations, the account level information contains both data that account creators are required to provide during account creation as well as optional data that an account creator may submit during or subsequent to account creation. Exemplary account level information may include direct level account information or information derived from the other available fields from the social media platform, such as: post count, follower count, following count, following-follower ratio, whether the account is “verified,” a total number of “likes”, a number of days since account creation, engagement count, number of tweets per day, account name match, author name (self-declaration), screen name (self-declaration), user description (e.g., bio) (self-declaration), account creator (self-declaration), and source name based (self-declaration).

Consistent with implementations described herein, post level information may include information regarding a predetermined recent number social media posts associated with a particular account. For example, information regarding a most recent 200 posts for each social media account may be retrieved. Although a most recent 200 posts is reference herein, it should be understood that any suitable number of posts may be used, to balance efficiency, temporal relevancy, and thoroughness. Exemplary post level information may include, total latest record, the number of non-repost posts, the number of replies, the number of repost posts, the percentage of repost posts, the percentage of posts that include “@”, the percentage of posts that include “#”, the percentage of posts that include HTTPS, the percentage of posts that include “|”, the percentage of posts that include “vote”, the percentage of posts that include “via@”, the percentage of posts that include “viaHTTPS”, the percentage of posts that include “/”, the percentage of posts that include “Register”, the percentage of posts that include “signup”, the percentage of posts that include “//”, the percentage of posts that include “Moreinfo”, the percentage of posts that include “:”, the percentage of posts that include “!”, the percentage of posts that include “Many Symbol”, and the percentage of posts that include particular keywords relating to a particular service provider, retailer, etc.

Consistent with implementations described herein, in addition to the retrieved or captured social media account information, data extraction and preparation module305may also generate additional data elements for each social media account by combining one or more elements of retrieved data as Boolean or true/false values. In particular, the additional data elements may include indications of whether particular elements of social media account information have certain defined characteristics or meet particular, identified criteria relevant to a non-user account determination.

For example, data elements may be generated indicating: whether, if 100% of an account's posts are reposts, any of the posts were replies; whether, if 100% of an account's posts are reposts, none of the posts were replies; whether, if 100% of the posts contain the “|” character, none of the posts are replies; whether, if at least 80% of the posts contain the “via@” string, none of the posts are replies; and whether either the self-declaration description or the self-declaration screen name of the account includes any of a predetermined number of character strings indicating that the account is associated with a news outlet is some manner. Such news-related character strings may include the following character strings: “news,” “magazine,” “publication,” “production services,” “creative,” “newswire,” “report,” “author,” “article writing,” “newzz,” “maintenance services,” “founder,” “CEO,” “leader,” “helping organizations,” “management,” “freelance,” “writer/analyst,” “fiber networks,” “communications,” “analyst,” “photography,” “media,” “#media,” “#science,” “#technology,” “freelancer,” “blogger,” “SEO,” “artist,” “information and technology,” “interviews,” “executive,” “marketer,” “consultant,” “investors,” and “investor.” It should be understood that this listing of possible character strings is exemplary only and that any suitable and relevant character string may be used.

As described herein, training data310may store a data set of social media account information for a plurality of social media accounts retrieved by data extraction and preparation module305from social media platform devices135. As described above, for account information stored in training data310, identification of whether the particular accounts are user or non-user (bot) accounts is independently known.

Model generation and validation engine315may include logic to generate a model for accurately predicting whether an account is a user account or a non-user (bot) account based on a combination of features regarding the social media account based on the above-identified features, or combinations thereof. Consistent with implementations described herein, model generation and validation engine315may include one or more machine learning algorithms to generate a score indicative of the likelihood that a particular social media account is a user account or a non-user account. For example, training data310may be input into a gradient boosting classification algorithm to generate a model that accurately predicts whether a particular social media account is a user account or a non-user account based on a collection of social media account feature data. Gradient boosting is a type of supervised machine learning that relies on an iterative combination of relatively weak prediction models or decision trees to minimize overall prediction error. Additional machine learning algorithms that may be used include, for example, a neural network, a regression analysis, a random forest analysis, etc. Model generation and validation engine315may validate the resulting model based on the known social media account types (e.g., user or non-user) for each record in training data310.

In an exemplary implementation, model generation and validation engine315may identify a collection of dominant features which form the primary basis of predicting social media account type. In particular, such dominant features may include:

1) a total number of reply posts (e.g., in the social media account's most recent 200 posts),

2) the Boolean value indicating whether either the self declaration description or the self-declaration screen name of the account includes any of a predetermined number of character strings indicating that the account is associated with a news outlet,

3) a Boolean value indicating whether the source of the post intersects with a set of “renowned” social media platforms. As used herein, “renowned” social media platforms refer to sources that typically charge a fee to access. Examples include Microsoft® Power Platform®, TweetDeck®, Mailchimp®, etc.,

4) a Boolean value indicating whether the source for any of the account's 200 most recent posts contains a case-insensitive match with any of the following patterns related to bots: [‘bot’, ‘robot’, ‘b0t’, ‘bots’, ‘robots’], though other patterns are also contemplated,

5) a Boolean value indicating whether any text string in account self-declaration description contains a case-insensitive match with a pattern in the list [‘bot’, ‘robot’, ‘b0t’, ‘bots’, ‘robots’] AND is NOT an exact match for an unambiguous non-bot term, such as “both,” “botany,” “bottle,” etc.,

In addition to the above dominant features, the additional captured features or additional data elements described above may also be impactful to the accuracy of the model.

Social media interaction analyzing module320may include logic configured to receive requests for social media account type determination. For example, social media interaction analyzing module320may receive a request from an end device115associated with a social media engagement representative requesting a prediction regarding a particular social media account. In other implementations, social media interaction analyzing module320may monitor all social media posts that tag the service provider or meet other predefined criteria to proactively determine a likely social media account type, and to further inform future engagement activities. Examples of tagging may include “mentions,” “@” hash tagging (#), etc.

In response to either a request or a periodic or on-demand review, social media interaction analyzing module320may be configured to request that data extraction and preparation module305retrieve the above-identified social media account and post information for the identified social media account(s). For example, data extraction and preparation module305may retrieve the account level and post level data associated with the social media account(s) in question.

Bot scoring logic325may include logic configured to score the social media account(s) based on the model determined by model generation and validation engine315. For example, bot scoring logic325may be configured to apply the validated model to the data retrieved by data extraction and preparation module305and generate a bot or non-bot score based thereon. In some implementations, a numerical score indicative of a confidence of the model may be generated, while in other implementations, a binary yes/no indication (score) may be provided.

In implementations in which the request for account type prediction was received from an end device115, the resulting score generated by bot scoring logic325may be transmitted or delivered to the requesting end device115(or a user of end device115). In implementations in which account type predictions are made automatically or autonomously based on the content of social media posts, bot scoring logic325may maintain a database of social media accounts that includes information identifying the social media accounts and an indication of the account type prediction. In such an implementation, the database may be queried in determining subsequent social media engagement activities.

FIG. 4is a flow diagram that conceptually illustrates an exemplary process400for predicting whether a social media account is a user account or a non-user account consistent with implementations described herein. In one implementation, process400may be implemented by bot detection engine110. In other implementations, process400may be implemented by other component(s) in local area network105or external network130, such as via a network supported service.

As shown inFIG. 4, process400may include obtaining a training data set of social media account and content information (block405). For example, as described above, data extraction and preparation module305may retrieve social media content for a plurality of social media accounts having a known account type from one or more social media platform devices135. The retrieved data may include both account level and post-level data. Additional data elements may be generated based on the retrieved social media account data (block410). For example, various data elements relating to text or character strings appearing in social media posts, alone, or in combination with other data elements may be generated. The retrieved social media account data and additional data elements may be stored as training data (block415). For example, the social media account information and additional data may be stored in training data310.

A model for predicting a social media account type may be generated based on the training data310(block420). For example, model generation and validation engine315may perform a machine learning regression, such as a gradient boosted regression, to determine a collection of variables and relative impact that most strongly predicts the account type for the data in training data310. The model may be validated using the known social media account types (block425).

One or more unknown social media accounts may be identified for analysis (block430). For example, social media interaction analyzing module320may receive a request to predict an account type for a particular social media account. Alternatively, social media interaction analyzing module320may autonomously predict social media account types for social media accounts meeting certain criteria, such as those that mention or attempt to directly communicate with a particular entity associated with bot detecting engine100, such as a service provider, a vendor, a manufacturer, a retailer, etc.

Information regarding the identified social media account(s) may be retrieved for analysis (block435). For example, social media interaction analyzing module320may direct data extraction and preparation module305to retrieve account level and post level data for the identified social media account. Similar to the processing performed during model generation, data extraction and preparation module305may further generate the additional account type determination related data elements based on the retrieved social media account data.

An account type for each of the identified social media accounts may be predicted based on the generated model (block440). For example, bot scoring logic325may apply the model developed by model generation and validation engine315to the retrieved/generated social media account data. The prediction may be output to a requesting entity or database for use in determining subsequent social media engagement activities (block445).

Additionally, embodiments described herein may be implemented as a non-transitory computer-readable storage medium that stores data and/or information, such as instructions, program code, a data structure, a program module, an application, a script, or other known or conventional form suitable for use in a computing environment. The program code, instructions, application, etc., is readable and executable by a processor (e.g., processor510) of a device. A non-transitory storage medium includes one or more of the storage mediums described in relation to memory/storage515. The non-transitory computer-readable storage medium may be implemented in a centralized, distributed, or logical division that may include a single physical memory device or multiple physical memory devices spread across one or multiple network devices.

No element, act, or instruction set forth in this description should be construed as critical or essential to the embodiments described herein unless explicitly indicated as such.

All structural and functional equivalents to the elements of the various aspects set forth in this disclosure that are known or later come to be known are expressly incorporated herein by reference and are intended to be encompassed by the claims.