Systems and methods for distinguishing human users from bots

In one embodiment, a system is configured to identify, based on predetermined criteria, a first set of users of an online system who belong to a population segment. The system may monitor activities performed by the first set of users on the online system over a predetermined period of time and store the monitored activities as time-series data. A feature set associated with the first set of users may be generated by transforming the time-series data into a frequency domain. The system may train a machine-learning model using the feature set and other feature sets to determine whether activities associated with a given set of users exhibit diurnal behavior pattern. Using the trained machine-learning model, the system may determine whether activities performed by a second set of users on the online system exhibit diurnal behavior pattern.

TECHNICAL FIELD

This disclosure generally relates to using machine-learning to distinguish human users from non-human users, such as computer-implemented bots.

BACKGROUND

Online systems, such as social-networking websites and gaming platforms, allow users to engage with each other or with content or features provided by the online systems. For example, users of an online social-networking system may register a user account, login, and read and post messages. As another example, users of a gaming system may login to a virtual world and, often through an avatar, explore and interact with the virtual world. Such online systems are typically intended for human users. However, for various reasons, people may design bots to automate interactions with the systems. For example, a spammer wishing to distribute spam through a system may design a bot to automatically navigate the system, collect personal data of real users, and publish advertisements. As another example, in virtual gaming worlds where certain virtual objects (e.g., virtual currency, a rare weapon, etc.) have real-world value (e.g., there may be a real-world market where people are willing to pay for the virtual objects), bots are sometimes used to automatically “farm” such objects. Activities by bots, however, may negatively impact the intended user experience of these systems and compromise system integrity.

SUMMARY OF PARTICULAR EMBODIMENTS

The embodiments disclosed herein relate to systems and methods for identifying online activities that are performed by non-human users, such as bots. “Bots,” as used herein, generally refer to a computer program or script designed to automate certain tasks and/or to emulate human activity. At a high level, the subject matter covered by this application takes advantage of the observation that human activity is typically diurnal. For example, users typically are more active during the day and less active late at night. Bots, on the other hand, may continue to operate throughout the day or on a schedule different from that of a typical human user. Based on this observation, a system may be configured to automatically determine whether users are likely to be bots or humans based on the observed behavior patterns. By enabling systems to automatically detect bots, systems may automate processes for combating bots and improve system integrity.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Particular embodiments described herein relates to systems and methods for automatically determining whether users are likely to be bots or humans based on observed behavior patterns. In particular embodiments, monitored user activities may be captured as time-series data. In particular embodiments, the time-series data may be transformed into a frequency domain to simplify a machine-learning process. In particular embodiments, the resulting machine-learning model may be used to determine whether a group of users are likely to be (predominantly) human users or non-human users. In particular embodiments, the determination may further be used to label individual users as human or non-human, and such labeled user data may in turn be used to train another machine-learning model to determine whether individual users are likely to be human or non-human.

In particular embodiments, the collective behavior pattern of a population of users may be used to determine whether those users are likely to be predominantly bots. The activities of a population of users in a system (e.g., social-media network) may be monitored to gather activity data. Any types of activity may be tracked, such as registration, login, content consumption (e.g., requesting a post, viewing a message, clicking on an ad, etc.), content creation (e.g., comments, posts, “likes,” uploading photos, sharing links, etc.), friend requests, and any other activity that may be performed on the system. A gaming system, for example, may allow users to register, login, navigate a virtual world, gather resources, fight enemies, and perform any other supported gaming actions. In particular embodiments, activity data may be gathered over a period of time and represented as a time series. For example, over the course of a predetermined time period (e.g., 1, 2, 7, or 10 days), the number of “hits” (e.g., the occurrence of an activity of interest, such as registration) observed within each predetermined time interval (e.g., 1, 10, 30, 60, 120-minute intervals) may be recorded. For instance, over the course of a week, registration and login activity may be monitored and logged in one-hour intervals, which means that there may be 7×24=168 data records. For example, during the first five one-hour intervals, the system may record 113 hits, 233 hits, 444 hits, 48 hits, 56 hits, respectively. Time-series data of a population may include non-human bot activities and human activities.

In particular embodiments, the gathered data may be graphically represented as a time-series graph, such as the example shown inFIG. 1A. The horizontal axis represents time and the vertical axis represents the number of hits observed. The graph shown inFIG. 1Aroughly exhibits a sinusoidal pattern. If the underlying data were to be separated into a data set associated with human activities and another data set associated with non-human (bot) activities, the two data sets may be plotted as shown inFIG. 1B. The graph shown on the top represents the data set of human activities and the bottom graph represents the data set of bot activities. The graph of human activities show a clear diurnal pattern (a pattern that recurs daily). This may be due to users' sleep/wake cycle as well as work/off-work schedule. In contrast, the graph of bot activities appear random and does not exhibit the diurnal pattern exhibited by the graph of human activities. This may be because machine-generated activities may operate automatically at any hours of the day and are not subject to typical human constraints and tendencies.

The monitored population usually is not homogenous—it typically contains a mix of real human users and bots. As such, a determination made for a given population may contain false-positives (e.g., if a non-homogenous population is labeled as bots, the human users would be false-positives). However, a sufficiently small number of false-positives may be tolerable. For instance, in particular embodiments where the determination result is used to label training data for subsequent machine-learning, the machine-learning algorithm may be able to tolerate some noise in the training data.

To minimize false-positives, particular embodiments may separate segments of the population based on some characteristics typically found to be associated with bots or in humans. One goal of the segmentation is to separate activities that were likely performed by humans from those by bots, so that each data set contains a sufficiently high concentration of activities by either bots or humans. Each data set may then be analyzed and collectively labeled (e.g., as bots or humans).

In particular embodiments, population segmentation may be based on any combination of characteristics that define a signature of a segment of the population. In particular embodiments, the characteristic used may include, for example, a user's country of origin, computer system information (e.g., OS platform, mobile device, IP), server/network communication and encryption protocol used to communicate with the online system (e.g., www, m_basic, api), metadata relating to the HTTP request used to communicate with the online system, actions performed (e.g., registration, login, friend request, posting content, or any other action that a user may perform in the system), among others. In particular embodiments, the characteristics used for segmentation may also include user's profile information and/or social graph information (e.g., connections or relationships with other users, activities performed, etc.). An example of a segmentation signature for bots may be: a user who is in country X, uses communication protocol Y, has HTTP metadata Z, has very little social-graph data, and has an email address that is likely fake (e.g., appears randomly generated), etc. In particular embodiments, the population that meets the segmentation criteria may be monitored as described above, and the corresponding time-series data may be stored.

In particular embodiments, the recorded time-series data may be transformed into a frequency domain. In particular embodiments, time-series data may be difficult to be processed and analyzed by machines. To simplify the problem for machine learning, the time-series data may be transformed into the frequency domain using, e.g., Fast Fourier Transform (FFT). As an example,FIG. 2Ashows an example graphical representation of time-series data of human users, andFIG. 2Bshows an example graphical representation (as a histogram) of the data transformed into the frequency domain. As another example,FIG. 3Ashows an example graphical representation of time-series data of bots, andFIG. 3Bshows an example graphical representation (as a histogram) of the data transformed into the frequency domain. It should be appreciated that the graph inFIG. 2Bexhibits a much more concentrated pattern than the graph inFIG. 3B.

In particular embodiments, the frequency-domain data, represented inFIGS. 2B and 3Bas histograms, may be used as a feature set or feature vector for the associated set of observed data, which in particular embodiments may be associated with a segment of the population. Stated differently, each population segment associated with the observed data may have an associated feature vector. In particular embodiments, the feature vector, along with other feature vectors associated with other populations, may be used as training data for a supervised machine-learning model. An example of a feature vector may be: [0.28295, 0.32766, 0.15847, 0.21622, 0.27772, 0.26667, 8. 06241, 0.24959, 0.21574, 0.09889, 0.15138, 0.21209, 0.11611, 3.92922, 0.07194, . . . ]. In particular embodiments, each feature vector may be labeled as either being associated with (1) diurnal behavior pattern or human behavior, or (2) non-diurnal behavior pattern or non-human/bot behavior. In particular embodiments, labeling for training purposes may be performed by human analysists. In particular embodiments, a suitable machine-learning model may be trained using n data sets, each of which may correspond to a population segment and associated with a feature vector and a label. Any suitable machine-learning algorithm may be used to learn from the training data to determine whether a given feature vector is likely to indicate (1) diurnal or human behavior, or (2) non-diurnal or bot behavior. Examples of machine-learning algorithms include, e.g., support vector model (SVM), k-means, neural networks, regression analysis of a linear combination of weighted features, etc.

In particular embodiments, the trained machine-learning model may be used to automatically determine whether a given set of observed data likely reflects (predominantly) bot activities or human activities. The observed data may be associated with a particular segment of the population based on any segmentation rule used (if any), as described above. The observed data may be gathered over a predetermined time period and the corresponding time-series data may be transformed into frequency-domain data. The frequency-domain data may in turn be input into the trained machine-learning model. In particular embodiments, the output of the model may be a confidence score indicating a likelihood of the input data reflecting (predominantly) bot activities or human activities. The determination result may then be used to label the associated population segment. For example, based on a feature vector associated with a population segment X, the machine-learning model may determine that population segment X exhibit non-diurnal behavior patterns. As such, population segment X may be assigned a label that corresponds to non-diurnal or non-human/bot behavior. If, on the other hand, the machine-learning model determination is that the activities reflect diurnal or human behavior, population segment X may be labeled accordingly. In particular embodiments, the labeling decision may be based on predetermined rules that take into consideration the confidence score output by the machine-learning model. For example, if the confidence score is above a certain threshold (e.g., more than 0.5, 0.7, 0.95, etc.) or within a particular range (e.g., between 0.5-1 or between 0.3-0.6), a predetermined label may be assigned (e.g., a numerical value corresponding to human, bot, or some other label in between to represent uncertainty).

In particular embodiments, labeled population segments using the process described above may be used as training data for another machine-learning model configured to determine whether a given individual user is likely human or non-human. In particular embodiments, the label assigned to each population segment may be propagated down to the user level. For example, each user who performed an action in that data set may be labeled as a bot or a human according to the label assigned to the population segment as a whole. For instance, if population segment X is assigned a “bot” (or “human”) label, every user within the segment may also be labeled as a “bot” (or “human”). As discussed above, since a population segment may not be homogeneous, certain users within such a population would be mislabeled. However, this noise (i.e., the mislabeled data) may be absorbed by the machine-learning algorithm. In other words, while the user labeling may not be perfect (i.e., may contain false positives), it provides sufficiently good quality data set for machine learning training.

The user-level machine-learning model may be trained to determine whether an individual user (instead of a group of users) is likely to be a bot or a human. Any user feature may be used in this model, including, e.g., the user's login ID (whether it contains excessive numerals and symbols), country of origin, activity pattern, number of friends, types of activities performed, whether the user has uploaded any pictures, social-graph data, and any other data available in system. Such user feature data, which are readily available to the system, may be automatically labeled using the population-segment level machine-learning model, as described above. The labeled user data may thus serve as training data for the user-level machine-learning model. Any suitable machine-learning model may be used, such e.g., support vector model (SVM), k-means, neural networks, regression analysis of a linear combination of weighted features, etc. Once trained, the user-level machine-learning model may be used to take as input a given user's features and output a determination that reflects a likelihood of that user being a human or a bot.

FIG. 4illustrates an example method400for predicting/determining whether activities performed by a set of users exhibit diurnal behavior pattern. For example, the method may begin at step410, where a computing system may identify, based on predetermined criteria, a first set of users of an online system who belong to a population segment. At step420, the system may monitor activities performed by the first set of users on the online system over a predetermined period of time. At step430, the system may store the monitored activities as time-series data. At step440, the system may generate a feature set associated with the first set of users by transforming the time-series data into a frequency domain. At step450, the system may train a machine-learning model using the feature set and a plurality of other feature sets. The machine-learning model is configured to determine whether activities associated with a given set of users exhibit diurnal behavior pattern. At step460, the system may use the trained machine-learning model to determine whether activities performed by a second set of users on the online system exhibit diurnal behavior pattern. Particular embodiments may repeat one or more steps of the method ofFIG. 4, where appropriate. Although this disclosure describes and illustrates particular steps of the method ofFIG. 4as occurring in a particular order, this disclosure contemplates any suitable steps of the method ofFIG. 4occurring in any suitable order. Moreover, although this disclosure describes and illustrates an example method for determining whether user activities exhibit diurnal behavior pattern, including the particular steps of the method ofFIG. 4, this disclosure contemplates any suitable method for determining whether user activities exhibit diurnal behavior pattern, including any suitable steps, which may include all, some, or none of the steps of the method ofFIG. 4, where appropriate. Furthermore, although this disclosure describes and illustrates particular components, devices, or systems carrying out particular steps of the method ofFIG. 4, this disclosure contemplates any suitable combination of any suitable components, devices, or systems carrying out any suitable steps of the method ofFIG. 4.

FIG. 5illustrates an example network environment500associated with a social-networking system. Network environment500includes a client system530, a social-networking system560, and a third-party system570connected to each other by a network510. AlthoughFIG. 5illustrates a particular arrangement of client system530, social-networking system560, third-party system570, and network510, this disclosure contemplates any suitable arrangement of client system530, social-networking system560, third-party system570, and network510. As an example and not by way of limitation, two or more of client system530, social-networking system560, and third-party system570may be connected to each other directly, bypassing network510. As another example, two or more of client system530, social-networking system560, and third-party system570may be physically or logically co-located with each other in whole or in part. Moreover, althoughFIG. 5illustrates a particular number of client systems530, social-networking systems560, third-party systems570, and networks510, this disclosure contemplates any suitable number of client systems530, social-networking systems560, third-party systems570, and networks510. As an example and not by way of limitation, network environment500may include multiple client system530, social-networking systems560, third-party systems570, and networks510.

This disclosure contemplates any suitable network510. As an example and not by way of limitation, one or more portions of network510may include an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), a portion of the Internet, a portion of the Public Switched Telephone Network (PSTN), a cellular telephone network, or a combination of two or more of these. Network510may include one or more networks510.

Links550may connect client system530, social-networking system560, and third-party system570to communication network510or to each other. This disclosure contemplates any suitable links550. In particular embodiments, one or more links550include one or more wireline (such as for example Digital Subscriber Line (DSL) or Data Over Cable Service Interface Specification (DOC SIS)), wireless (such as for example Wi-Fi or Worldwide Interoperability for Microwave Access (WiMAX)), or optical (such as for example Synchronous Optical Network (SONET) or Synchronous Digital Hierarchy (SDH)) links. In particular embodiments, one or more links550each include an ad hoc network, an intranet, an extranet, a VPN, a LAN, a WLAN, a WAN, a WWAN, a MAN, a portion of the Internet, a portion of the PSTN, a cellular technology-based network, a satellite communications technology-based network, another link550, or a combination of two or more such links550. Links550need not necessarily be the same throughout network environment500. One or more first links550may differ in one or more respects from one or more second links550.

In particular embodiments, client system530may be an electronic device including hardware, software, or embedded logic components or a combination of two or more such components and capable of carrying out the appropriate functionalities implemented or supported by client system530. As an example and not by way of limitation, a client system530may include a computer system such as a desktop computer, notebook or laptop computer, netbook, a tablet computer, e-book reader, GPS device, camera, personal digital assistant (PDA), handheld electronic device, cellular telephone, smartphone, augmented/virtual reality device, other suitable electronic device, or any suitable combination thereof. This disclosure contemplates any suitable client systems530. A client system530may enable a network user at client system530to access network510. A client system530may enable its user to communicate with other users at other client systems530.

In particular embodiments, client system530may include a web browser532, such as MICROSOFT INTERNET EXPLORER, GOOGLE CHROME or MOZILLA FIREFOX, and may have one or more add-ons, plug-ins, or other extensions, such as TOOLBAR or YAHOO TOOLBAR. A user at client system530may enter a Uniform Resource Locator (URL) or other address directing the web browser532to a particular server (such as server562, or a server associated with a third-party system570), and the web browser532may generate a Hyper Text Transfer Protocol (HTTP) request and communicate the HTTP request to server. The server may accept the HTTP request and communicate to client system530one or more Hyper Text Markup Language (HTML) files responsive to the HTTP request. Client system530may render a webpage based on the HTML files from the server for presentation to the user. This disclosure contemplates any suitable webpage files. As an example and not by way of limitation, webpages may render from HTML files, Extensible Hyper Text Markup Language (XHTML) files, or Extensible Markup Language (XML) files, according to particular needs. Such pages may also execute scripts such as, for example and without limitation, those written in JAVASCRIPT, JAVA, MICROSOFT SILVERLIGHT, combinations of markup language and scripts such as AJAX (Asynchronous JAVASCRIPT and XML), and the like. Herein, reference to a webpage encompasses one or more corresponding webpage files (which a browser may use to render the webpage) and vice versa, where appropriate.

In particular embodiments, social-networking system560may be a network-addressable computing system that can host an online social network. Social-networking system560may generate, store, receive, and send social-networking data, such as, for example, user-profile data, concept-profile data, social-graph information, or other suitable data related to the online social network. Social-networking system560may be accessed by the other components of network environment500either directly or via network510. As an example and not by way of limitation, client system530may access social-networking system560using a web browser532, or a native application associated with social-networking system560(e.g., a mobile social-networking application, a messaging application, another suitable application, or any combination thereof) either directly or via network510. In particular embodiments, social-networking system560may include one or more servers562. Each server562may be a unitary server or a distributed server spanning multiple computers or multiple datacenters. Servers562may be of various types, such as, for example and without limitation, web server, news server, mail server, message server, advertising server, file server, application server, exchange server, database server, proxy server, another server suitable for performing functions or processes described herein, or any combination thereof. In particular embodiments, each server562may include hardware, software, or embedded logic components or a combination of two or more such components for carrying out the appropriate functionalities implemented or supported by server562. In particular embodiments, social-networking system560may include one or more data stores564. Data stores564may be used to store various types of information. In particular embodiments, the information stored in data stores564may be organized according to specific data structures. In particular embodiments, each data store564may be a relational, columnar, correlation, or other suitable database. Although this disclosure describes or illustrates particular types of databases, this disclosure contemplates any suitable types of databases. Particular embodiments may provide interfaces that enable a client system530, a social-networking system560, or a third-party system570to manage, retrieve, modify, add, or delete, the information stored in data store564.

In particular embodiments, social-networking system560may store one or more social graphs in one or more data stores564. In particular embodiments, a social graph may include multiple nodes—which may include multiple user nodes (each corresponding to a particular user) or multiple concept nodes (each corresponding to a particular concept)—and multiple edges connecting the nodes. Social-networking system560may provide users of the online social network the ability to communicate and interact with other users. In particular embodiments, users may join the online social network via social-networking system560and then add connections (e.g., relationships) to a number of other users of social-networking system560to whom they want to be connected. Herein, the term “friend” may refer to any other user of social-networking system560with whom a user has formed a connection, association, or relationship via social-networking system560.

In particular embodiments, social-networking system560may provide users with the ability to take actions on various types of items or objects, supported by social-networking system560. As an example and not by way of limitation, the items and objects may include groups or social networks to which users of social-networking system560may belong, events or calendar entries in which a user might be interested, computer-based applications that a user may use, transactions that allow users to buy or sell items via the service, interactions with advertisements that a user may perform, or other suitable items or objects. A user may interact with anything that is capable of being represented in social-networking system560or by an external system of third-party system570, which is separate from social-networking system560and coupled to social-networking system560via a network510.

In particular embodiments, social-networking system560may be capable of linking a variety of entities. As an example and not by way of limitation, social-networking system560may enable users to interact with each other as well as receive content from third-party systems570or other entities, or to allow users to interact with these entities through an application programming interfaces (API) or other communication channels.

In particular embodiments, a third-party system570may include one or more types of servers, one or more data stores, one or more interfaces, including but not limited to APIs, one or more web services, one or more content sources, one or more networks, or any other suitable components, e.g., that servers may communicate with. A third-party system570may be operated by a different entity from an entity operating social-networking system560. In particular embodiments, however, social-networking system560and third-party systems570may operate in conjunction with each other to provide social-networking services to users of social-networking system560or third-party systems570. In this sense, social-networking system560may provide a platform, or backbone, which other systems, such as third-party systems570, may use to provide social-networking services and functionality to users across the Internet.

In particular embodiments, social-networking system560also includes user-generated content objects, which may enhance a user's interactions with social-networking system560. User-generated content may include anything a user can add, upload, send, or “post” to social-networking system560. As an example and not by way of limitation, a user communicates posts to social-networking system560from a client system530. Posts may include data such as status updates or other textual data, location information, photos, videos, links, music or other similar data or media. Content may also be added to social-networking system560by a third-party through a “communication channel,” such as a newsfeed or stream.

FIG. 6illustrates example social graph600. In particular embodiments, social-networking system560may store one or more social graphs600in one or more data stores. In particular embodiments, social graph600may include multiple nodes—which may include multiple user nodes602or multiple concept nodes604—and multiple edges606connecting the nodes. Example social graph600illustrated inFIG. 6is shown, for didactic purposes, in a two-dimensional visual map representation. In particular embodiments, a social-networking system560, client system530, or third-party system570may access social graph600and related social-graph information for suitable applications. The nodes and edges of social graph600may be stored as data objects, for example, in a data store (such as a social-graph database). Such a data store may include one or more searchable or queryable indexes of nodes or edges of social graph600.

In particular embodiments, a pair of nodes in social graph600may be connected to each other by one or more edges606. An edge606connecting a pair of nodes may represent a relationship between the pair of nodes. In particular embodiments, an edge606may include or represent one or more data objects or attributes corresponding to the relationship between a pair of nodes. As an example and not by way of limitation, a first user may indicate that a second user is a “friend” of the first user. In response to this indication, social-networking system560may send a “friend request” to the second user. If the second user confirms the “friend request,” social-networking system560may create an edge606connecting the first user's user node602to the second user's user node602in social graph600and store edge606as social-graph information in one or more of data stores564. In the example ofFIG. 6, social graph600includes an edge606indicating a friend relation between user nodes602of user “A” and user “B” and an edge indicating a friend relation between user nodes602of user “C” and user “B.” Although this disclosure describes or illustrates particular edges606with particular attributes connecting particular user nodes602, this disclosure contemplates any suitable edges606with any suitable attributes connecting user nodes602. As an example and not by way of limitation, an edge606may represent a friendship, family relationship, business or employment relationship, fan relationship (including, e.g., liking, etc.), follower relationship, visitor relationship (including, e.g., accessing, viewing, checking-in, sharing, etc.), subscriber relationship, superior/subordinate relationship, reciprocal relationship, non-reciprocal relationship, another suitable type of relationship, or two or more such relationships. Moreover, although this disclosure generally describes nodes as being connected, this disclosure also describes users or concepts as being connected. Herein, references to users or concepts being connected may, where appropriate, refer to the nodes corresponding to those users or concepts being connected in social graph600by one or more edges606.

In particular embodiments, an edge606between a user node602and a concept node604may represent a particular action or activity performed by a user associated with user node602toward a concept associated with a concept node604. As an example and not by way of limitation, as illustrated inFIG. 6, a user may “like,” “attended,” “played,” “listened,” “cooked,” “worked at,” or “watched” a concept, each of which may correspond to an edge type or subtype. A concept-profile page corresponding to a concept node604may include, for example, a selectable “check in” icon (such as, for example, a clickable “check in” icon) or a selectable “add to favorites” icon. Similarly, after a user clicks these icons, social-networking system560may create a “favorite” edge or a “check in” edge in response to a user's action corresponding to a respective action. As another example and not by way of limitation, a user (user “C”) may listen to a particular song (“Imagine”) using a particular application (SPOTIFY, which is an online music application). In this case, social-networking system560may create a “listened” edge606and a “used” edge (as illustrated inFIG. 6) between user nodes602corresponding to the user and concept nodes604corresponding to the song and application to indicate that the user listened to the song and used the application. Moreover, social-networking system560may create a “played” edge606(as illustrated inFIG. 6) between concept nodes604corresponding to the song and the application to indicate that the particular song was played by the particular application. In this case, “played” edge606corresponds to an action performed by an external application (SPOTIFY) on an external audio file (the song “Imagine”). Although this disclosure describes particular edges606with particular attributes connecting user nodes602and concept nodes604, this disclosure contemplates any suitable edges606with any suitable attributes connecting user nodes602and concept nodes604. Moreover, although this disclosure describes edges between a user node602and a concept node604representing a single relationship, this disclosure contemplates edges between a user node602and a concept node604representing one or more relationships. As an example and not by way of limitation, an edge606may represent both that a user likes and has used at a particular concept. Alternatively, another edge606may represent each type of relationship (or multiples of a single relationship) between a user node602and a concept node604(as illustrated inFIG. 6between user node602for user “E” and concept node604for “SPOTIFY”).

In particular embodiments, social-networking system560may create an edge606between a user node602and a concept node604in social graph600. As an example and not by way of limitation, a user viewing a concept-profile page (such as, for example, by using a web browser or a special-purpose application hosted by the user's client system530) may indicate that he or she likes the concept represented by the concept node604by clicking or selecting a “Like” icon, which may cause the user's client system530to send to social-networking system560a message indicating the user's liking of the concept associated with the concept-profile page. In response to the message, social-networking system560may create an edge606between user node602associated with the user and concept node604, as illustrated by “like” edge606between the user and concept node604. In particular embodiments, social-networking system560may store an edge606in one or more data stores. In particular embodiments, an edge606may be automatically formed by social-networking system560in response to a particular user action. As an example and not by way of limitation, if a first user uploads a picture, watches a movie, or listens to a song, an edge606may be formed between user node602corresponding to the first user and concept nodes604corresponding to those concepts. Although this disclosure describes forming particular edges606in particular manners, this disclosure contemplates forming any suitable edges606in any suitable manner.

In particular embodiments, an advertisement may be text (which may be HTML-linked), one or more images (which may be HTML-linked), one or more videos, audio, other suitable digital object files, a suitable combination of these, or any other suitable advertisement in any suitable digital format presented on one or more webpages, in one or more e-mails, or in connection with search results requested by a user. In addition or as an alternative, an advertisement may be one or more sponsored stories (e.g., a news-feed or ticker item on social-networking system560). A sponsored story may be a social action by a user (such as “liking” a page, “liking” or commenting on a post on a page, RSVPing to an event associated with a page, voting on a question posted on a page, checking in to a place, using an application or playing a game, or “liking” or sharing a website) that an advertiser promotes, for example, by having the social action presented within a pre-determined area of a profile page of a user or other page, presented with additional information associated with the advertiser, bumped up or otherwise highlighted within news feeds or tickers of other users, or otherwise promoted. The advertiser may pay to have the social action promoted. As an example and not by way of limitation, advertisements may be included among the search results of a search-results page, where sponsored content is promoted over non-sponsored content.

In particular embodiments, an advertisement may be requested for display within social-networking-system webpages, third-party webpages, or other pages. An advertisement may be displayed in a dedicated portion of a page, such as in a banner area at the top of the page, in a column at the side of the page, in a GUI of the page, in a pop-up window, in a drop-down menu, in an input field of the page, over the top of content of the page, or elsewhere with respect to the page. In addition or as an alternative, an advertisement may be displayed within an application. An advertisement may be displayed within dedicated pages, requiring the user to interact with or watch the advertisement before the user may access a page or utilize an application. The user may, for example view the advertisement through a web browser.

A user may interact with an advertisement in any suitable manner. The user may click or otherwise select the advertisement. By selecting the advertisement, the user may be directed to (or a browser or other application being used by the user) a page associated with the advertisement. At the page associated with the advertisement, the user may take additional actions, such as purchasing a product or service associated with the advertisement, receiving information associated with the advertisement, or subscribing to a newsletter associated with the advertisement. An advertisement with audio or video may be played by selecting a component of the advertisement (like a “play button”). Alternatively, by selecting the advertisement, social-networking system560may execute or modify a particular action of the user.

An advertisement may also include social-networking-system functionality that a user may interact with. As an example and not by way of limitation, an advertisement may enable a user to “like” or otherwise endorse the advertisement by selecting an icon or link associated with endorsement. As another example and not by way of limitation, an advertisement may enable a user to search (e.g., by executing a query) for content related to the advertiser. Similarly, a user may share the advertisement with another user (e.g., through social-networking system560) or RSVP (e.g., through social-networking system560) to an event associated with the advertisement. In addition or as an alternative, an advertisement may include social-networking-system content directed to the user. As an example and not by way of limitation, an advertisement may display information about a friend of the user within social-networking system560who has taken an action associated with the subject matter of the advertisement.

In particular embodiments, one or more servers562may be authorization/privacy servers for enforcing privacy settings. In response to a request from a user (or other entity) for a particular object stored in a data store564, social-networking system560may send a request to the data store564for the object. The request may identify the user associated with the request and may only be sent to the user (or a client system530of the user) if the authorization server determines that the user is authorized to access the object based on the privacy settings associated with the object. If the requesting user is not authorized to access the object, the authorization server may prevent the requested object from being retrieved from the data store564, or may prevent the requested object from being sent to the user. In the search query context, an object may only be generated as a search result if the querying user is authorized to access the object. In other words, the object must have a visibility that is visible to the querying user. If the object has a visibility that is not visible to the user, the object may be excluded from the search results. Although this disclosure describes enforcing privacy settings in a particular manner, this disclosure contemplates enforcing privacy settings in any suitable manner.

FIG. 7illustrates an example computer system700. In particular embodiments, one or more computer systems700perform one or more steps of one or more methods described or illustrated herein. In particular embodiments, one or more computer systems700provide functionality described or illustrated herein. In particular embodiments, software running on one or more computer systems700performs one or more steps of one or more methods described or illustrated herein or provides functionality described or illustrated herein. Particular embodiments include one or more portions of one or more computer systems700. Herein, reference to a computer system may encompass a computing device, and vice versa, where appropriate. Moreover, reference to a computer system may encompass one or more computer systems, where appropriate.

In particular embodiments, computer system700includes a processor702, memory704, storage706, an input/output (I/O) interface708, a communication interface710, and a bus712. Although this disclosure describes and illustrates a particular computer system having a particular number of particular components in a particular arrangement, this disclosure contemplates any suitable computer system having any suitable number of any suitable components in any suitable arrangement.

In particular embodiments, processor702includes hardware for executing instructions, such as those making up a computer program. As an example and not by way of limitation, to execute instructions, processor702may retrieve (or fetch) the instructions from an internal register, an internal cache, memory704, or storage706; decode and execute them; and then write one or more results to an internal register, an internal cache, memory704, or storage706. In particular embodiments, processor702may include one or more internal caches for data, instructions, or addresses. This disclosure contemplates processor702including any suitable number of any suitable internal caches, where appropriate. As an example and not by way of limitation, processor702may include one or more instruction caches, one or more data caches, and one or more translation lookaside buffers (TLBs). Instructions in the instruction caches may be copies of instructions in memory704or storage706, and the instruction caches may speed up retrieval of those instructions by processor702. Data in the data caches may be copies of data in memory704or storage706for instructions executing at processor702to operate on; the results of previous instructions executed at processor702for access by subsequent instructions executing at processor702or for writing to memory704or storage706; or other suitable data. The data caches may speed up read or write operations by processor702. The TLBs may speed up virtual-address translation for processor702. In particular embodiments, processor702may include one or more internal registers for data, instructions, or addresses. This disclosure contemplates processor702including any suitable number of any suitable internal registers, where appropriate. Where appropriate, processor702may include one or more arithmetic logic units (ALUs); be a multi-core processor; or include one or more processors702. Although this disclosure describes and illustrates a particular processor, this disclosure contemplates any suitable processor.

In particular embodiments, memory704includes main memory for storing instructions for processor702to execute or data for processor702to operate on. As an example and not by way of limitation, computer system700may load instructions from storage706or another source (such as, for example, another computer system700) to memory704. Processor702may then load the instructions from memory704to an internal register or internal cache. To execute the instructions, processor702may retrieve the instructions from the internal register or internal cache and decode them. During or after execution of the instructions, processor702may write one or more results (which may be intermediate or final results) to the internal register or internal cache. Processor702may then write one or more of those results to memory704. In particular embodiments, processor702executes only instructions in one or more internal registers or internal caches or in memory704(as opposed to storage706or elsewhere) and operates only on data in one or more internal registers or internal caches or in memory704(as opposed to storage706or elsewhere). One or more memory buses (which may each include an address bus and a data bus) may couple processor702to memory704. Bus712may include one or more memory buses, as described below. In particular embodiments, one or more memory management units (MMUs) reside between processor702and memory704and facilitate accesses to memory704requested by processor702. In particular embodiments, memory704includes random access memory (RAM). This RAM may be volatile memory, where appropriate. Where appropriate, this RAM may be dynamic RAM (DRAM) or static RAM (SRAM). Moreover, where appropriate, this RAM may be single-ported or multi-ported RAM. This disclosure contemplates any suitable RAM. Memory704may include one or more memories704, where appropriate. Although this disclosure describes and illustrates particular memory, this disclosure contemplates any suitable memory.

In particular embodiments, storage706includes mass storage for data or instructions. As an example and not by way of limitation, storage706may include a hard disk drive (HDD), a floppy disk drive, flash memory, an optical disc, a magneto-optical disc, magnetic tape, or a Universal Serial Bus (USB) drive or a combination of two or more of these. Storage706may include removable or non-removable (or fixed) media, where appropriate. Storage706may be internal or external to computer system700, where appropriate. In particular embodiments, storage706is non-volatile, solid-state memory. In particular embodiments, storage706includes read-only memory (ROM). Where appropriate, this ROM may be mask-programmed ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), electrically alterable ROM (EAROM), or flash memory or a combination of two or more of these. This disclosure contemplates mass storage706taking any suitable physical form. Storage706may include one or more storage control units facilitating communication between processor702and storage706, where appropriate. Where appropriate, storage706may include one or more storages706. Although this disclosure describes and illustrates particular storage, this disclosure contemplates any suitable storage.

In particular embodiments, communication interface710includes hardware, software, or both providing one or more interfaces for communication (such as, for example, packet-based communication) between computer system700and one or more other computer systems700or one or more networks. As an example and not by way of limitation, communication interface710may include a network interface controller (NIC) or network adapter for communicating with an Ethernet or other wire-based network or a wireless NIC (WNIC) or wireless adapter for communicating with a wireless network, such as a WI-FI network. This disclosure contemplates any suitable network and any suitable communication interface710for it. As an example and not by way of limitation, computer system700may communicate with an ad hoc network, a personal area network (PAN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), or one or more portions of the Internet or a combination of two or more of these. One or more portions of one or more of these networks may be wired or wireless. As an example, computer system700may communicate with a wireless PAN (WPAN) (such as, for example, a BLUETOOTH WPAN), a WI-FI network, a WI-MAX network, a cellular telephone network (such as, for example, a Global System for Mobile Communications (GSM) network), or other suitable wireless network or a combination of two or more of these. Computer system700may include any suitable communication interface710for any of these networks, where appropriate. Communication interface710may include one or more communication interfaces710, where appropriate. Although this disclosure describes and illustrates a particular communication interface, this disclosure contemplates any suitable communication interface.

In particular embodiments, bus712includes hardware, software, or both coupling components of computer system700to each other. As an example and not by way of limitation, bus712may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a front-side bus (FSB), a HYPERTRANSPORT (HT) interconnect, an Industry Standard Architecture (ISA) bus, an INFINIBAND interconnect, a low-pin-count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCIe) bus, a serial advanced technology attachment (SATA) bus, a Video Electronics Standards Association local (VLB) bus, or another suitable bus or a combination of two or more of these. Bus712may include one or more buses712, where appropriate. Although this disclosure describes and illustrates a particular bus, this disclosure contemplates any suitable bus or interconnect.