System, method and computer program product for normalizing data obtained from a plurality of social networks

Various embodiments of a system, method and computer program product for normalizing data obtained from a plurality of social networks coupled to a network such as the Internet are disclosed. The system may include an interface adapted to access information from a plurality of social networks. The information that is obtained from each social network may include personal information about with the user as well as social graphs of the user that map the user to his or her friends. A data analyzer may be provided to compare the personal information obtained from the plurality of social networks to determine a normalized set of personal information for the user. The data analyzer may also compare the social graphs to determine a normalized set of friends associated with the user.

TECHNICAL FIELD

Embodiments of the present invention generally relate to analyzing data obtained from a network and, in particular, analyzing information obtained from one or more social networks.

BACKGROUND

Generally speaking, a social network is a social structure made up of a set of actors (such as individuals or organizations) and the dyadic ties between these actors. (See http://en.wikipedia.org/wiki/Social_network). In the context of the Internet and other networks, a social network may be viewed as a set of social relations that link people through a network. Exemplary social networks include, for example, the Facebook social network, Twitter, Google+ (also known as Google Circles), LinkedIn, as well as various information or photo sharing sites such as Flickr and Pinterest.

Analyzing and presenting data obtained across more than one of these social network may be difficult. Each social network may use its own proprietary format for the data they expose through their respective interfaces. A consumer of this data whose goal is to gain a holistic view of one or more user's data across multiple social networks must manually compare the data elements obtained from each social network. This process is cumbersome to say the least. As a result, there is a need to normalize data obtained from a plurality of social networks so analysis and presentation across multiple social networks may be made easier.

In addition, there is class of software known as internet safety software that includes parental control and reputation protection that typically gather information about a user's online activity—including activity on social networks. These types of safety software, however, do not have a way to assess aggregate risk to a user based on an analysis of data associated with the user from the Internet and/or one or more social networks. Aggregating risk could allow easier comprehension of risk to an online user.

SUMMARY

In accordance with the disclosures herein, various embodiments of a system, method and computer program product for normalizing data obtained from a plurality of social networks coupled to a network such as the Internet are described. Such a system may include an interface that is adapted to access a plurality of social networks via a network. The system may also have one or more social network adapters that are adapted to obtain information associated with a user's account from each of the social networks. The information that is obtained from each social network may include personal information about with the user as well as social graphs of the user that map the user to his or her friends (and other entities). A data analyzer may be provided to compare the personal information obtained from the plurality of social networks to determine a normalized set of personal information for the user. The data analyzer may also be adapted to compare the social graphs to determine a normalized set of friends associated with the user. A data store is also provided to store the normalized set of personal information and friends associated with the user.

Accessing the plurality of social networks may be performed using a plurality of interfaces with each interface associated with a corresponding social network of the plurality of social networks. In some embodiments, a social graph may comprise a plurality of nodes including a node for the user as well as a plurality of nodes for friends of the user. When comparing the social graphs, the system may determine a degree of matching between similar friend nodes of the plurality of social graphs and then identify a set of maximum common subgraphs shared between the plurality of social graphs. For each pair of shared friend nodes in the set of maximum common subgraphs, the system may then add a friend to a set of normalized friends that are associated with the user. In addition, a friend may also be added for the set of normalized friends for each node found in the social graphs that is found to be unshared with any of the other social graphs.

Embodiments of the comparison may be conducted via the calculation of Levenshtein distance between similar items information between the social networks—including personal information and social graph nodes.

In addition, various embodiments of a system, method and computer program product for assessing an aggregate risk score for a user of a social network's online activities are also disclosed. The system may include an interface that is adapted to obtain information about online activities concerning (or relating to) a subject via a network such as the Internet. An analyzing component may be provide that is adapted to analyze the collected information in order to find one or more potential dangers to the subject (these potential dangers may be referred to as “warnings”). The analyzing component may then associate a severity level to each identified potential danger and then assigning a weight to each identified potential danger based on its associated severity level and the current age of the identified potential danger (e.g., the difference in time from between the date the potential danger was posted to the Internet and the current date or date that the danger was identified by the social network analyzer). Next, the analyzer may aggregate the weighted identified potential dangers in order to obtain an aggregate online risk score for the subject.

In one embodiment, a notification containing the aggregate risk score may be sent from the system to the subject (and/or other authorized party) via the network. As additional option, the system may afford the subject and/or other authorized party access to the aggregate risk score and may even display the aggregate risk score to the subject (and/or authorized party) via the network.

Embodiments of the system may also be implemented so that information is obtained from one or more social networks coupled to the network. In these embodiment, it may be especially useful to normalize the information obtained from the social networks in order to present a unified set of data for analysis in determining the aggregate risk score.

Potential dangers may include warnings associated with strangers which may be identified by determining whether the author of the information (such as, e.g., a person making an online statement comprising the warning) is a friend within a social network/social graph of the subject. Potential dangers may also include warnings associated with weak friends to the subject. The analysis to identify weak friend warnings may comprise identifying a number of friends in a social network held in common between the subject and an author of the obtained information, and then determining whether the identified number equals and/or exceeds a predetermined threshold number of friends. Potential dangers may also include postings or messages containing words and phrases on a blacklist of suspect or high-risk words including, for example, phone numbers of the subject, drugs-related references, and profanity-related references for example.

DETAILED DESCRIPTION

FIG. 1is a block diagram of an exemplary network-based environment for implementing various embodiments of a social network analyzing service100(“social network analyzer”). As shown inFIG. 1, a social network analyzer100may be coupled to a network such as the Internet102in order to access a wide variety of social networks104a,104b,104c,104d,104ethat are also coupled to the network102. These social networks may include, for example, Facebook104a, Twitter104b, Google+ (also known as Google Circles)104c, LinkedIn104d, as well as various information or photo sharing sites such as Flickr and Pinterest.

With reference toFIG. 2, in order to normalize data collected from a plurality of social networks, a social network analyzer100may include a network interface202adapted for interfacing with one or more networks including the Internet, for example, in order to allow the social network analyzer100to communicate over the network(s) with other sites or nodes connected to the network. In one embodiment, the network interface may be adapted for communicating using TCP/IP as well as HTTP and HTTPS protocols.

The social network analyzer100may also be provided with a social network application protocol interface204(“social network API”) for communicating with various social networks104a,104b,104c,104d. As shown inFIG. 2, the social network API204may include a plurality of social network adapters206a,206b,206c,206d. Each social network adapter206a,206b,206c,206dis adapted for communicating with an associated social network so that each social network adapter may retrieve information from its associated social network—including information and data about individual users of the social network. For example, the social network API204may include a Facebook adapter206athat is adapted for communicating with the Facebook social network104ain order to access and retrieve information from Facebook about users of the Facebook social network. Similarly, a Twitter adapter206bmay be provided that is adapted for communicating with the Twitter social network104bin order to access and retrieve information from Twitter about users of the Twitter social network, and so on. In one embodiment, the social network adapters206a,206b,206c,206dmay be implemented as plug-ins (or similar add-on functionalities) so that social network adapters can be selectively added and removed from the social network API204as needed. This way, the social network API204may be customized to access various combinations of social networking sites and given the ability add new adapters when new social networks are introduced in the future.

The social network analyzer100may also include a data analyzing component208(“data analyzer”) that is adapted to perform various analyses on the data collected by the social network API204and social network adapters206206a,206b,206c,206dfrom the various social networking sites. For example, the data analyzer208may be implemented (either alone or in conjunction with the social network adapters) in order to perform various procedures in order to normalize and map the collected data as set forth herein.

The social network analyzer100may be provided with or coupled to a data storage device210(the “normalized database”) in which data may be stored and retrieved by the social network analyzer100. Data stored in the data storage device210may include the raw data retrieved from the social network sites, data normalized and/or mapped by social network analyzer, as well as data created during analysis and presentment post-normalization. The social network analyzer100may also include an analytics API212that allows other applications and users to access, retrieve and store data in the storage device210. Thus, via the analytics API212, outside applications and third party users may obtain access to the data stored in the storage device for analysis and presentation. In one embodiment, the analytics API X0X512 may be accessible to users and other third parties via the network102.

FIG. 3depicts an illustrative process for collecting and normalizing data from a plurality of social networks using a social network analyzer100. In this example, data is collected from two social networks: Facebook104a(www.facebook.com) and Twitter104b(www.twitter.com). Via a network (such as, e.g., the Internet102), the social network analyzer100requests data (via request for data paths302,304) from the two social networks104a,104babout user or subscriber to each of the social networks (i.e., someone or entity that maintains an account with each social networks). As shown inFIG. 3, the requests can be made, for example, by the respective social network adapters206a,206bassociated with the selected social networks104a104b. For example, the social network adapter 206afor Facebook may issue a request for data to Facebook104aabout a person who has a user account with Facebook while the social network adapter206bfor Twitter may issue a request for data to Twitter104babout a Twitter account held by that same person. As another option, the respective social network adapters may simply request data about user accounts from a list or set of users maintained by or provided to social network analyzer100. In any event, the requests for data may be made by the social network adapters206a,206busing the protocols and/or APIs made available typically by the various social networks in order to allow third parties to access data about users/subscribers of the given social network. In response to the request from the respective social network adapters of the social network analyzer, each of the social networks returns the requested data about the user (as shown by return paths306,308).

The returned data is typically provided in a propriety format or arrangement that may be unique to the given social network (see paths310,312). Accordingly, the social network analyzer100is adapted to convert or modify the returned data so that the data collected from the various social networks is conformed to a unified model that allows the data from the various sources to be combined together into a unified data set for the associated individual. With reference toFIG. 3, this normalization of the data returned from each social network may be carried out all or in part by the corresponding social network adapter receiving the data. For example, the data returned from Facebook104amay be normalized (all or in part) by the Facebook social network adapter206a(path310) and the data returned from Twitter104bmay be normalized (all or in part) by the Twitter social network adapter206b(path312). In one embodiment, all or part of the process to normalize the collected data may be carried out by the data mapper208of the social network analyzer100. As shown inFIG. 3, the normalized data (as well as the original data received from social networks) may be stored in a data repository210from where it can be retrieved for further analysis314or display/presentment316. In one embodiment, third parties may be able to access the data stored in the normalization database210via the analytics API212of the social network analyzer100.

Generally speaking, the normalization of the data obtained from each social network involves mapping the various data elements of the collected data to a normalized data model. An exemplary normalized social network data model400is depicted inFIG. 4. The data model400comprises a number of attributes or elements402,404,406,408,30. It should be understood to one of ordinary skill in the art that attributes may be added or removed to the data model and/or other suitable models may be implemented. Accordingly, for purposes of discussion herein, the attributes illustrated inFIG. 4may also be referred to as the core attributes of the normalized data model. As shown inFIG. 4, each of the attributes comprises a number of properties or sub-elements that may be extracted or derived from the data obtained from the various social networks. It should be understood to one of ordinary skill in the art that not all social networks maintain data for all of the properties.

The Social Network Item402is a base attribute from which other core attributes may derive. The Social Network Item402may include two properties or sub-elements: SiteName and NetworkIdentifier. SiteName identifies the social network from which the data was obtained. Typically, the SiteName may comprise an alpha-numeric character string uniquely associated with the corresponding social network. As an example, the SiteName for the Facebook social network104amay simply be the character string “facebook.” The NetworkIdentifier uniquely identifies data in the associated social network and, typically, identifies a unique identifier (“unique ID”) of a particular core attribute—such as, for example, a particular user/entity. In one embodiment, the Network Identifier may comprise the URL of the social network (e.g., www.facebook.com, www.twitter.com, etc.)

As indicated inFIG. 4, the User Data404, Comment Data, Post Data408, and Photo Data410attributes derive from the Social Network Item402attribute. As a result, by virtue of this derivation, each of these attributes404,406,408,410contain the SiteName and NetworkIdentifier properties of the Social Network Item402.

User Data attribute404of the normalized data model may be used to represent a particular user. The UserData attribute404may comprise a number of properties including, for example: (i) Full Name, (ii) Age; (iii) ImageUrl; (iv) Gender; (v) ProfileUrl; and (vi) Location.

Comment Data406may be used to represent a comment posted to a social network and may include the following properties: (i) Text; (ii) Comment Date; and (iii) FromNetworkIdentifier. The FromNetworkIdentifier property uniquely identifies the author of the comment.

The Post Data attribute408may be used to represent a post on a social network. Post Data408may include the following properties: (i) Message; (ii) DatePosted; (iii) PostType; and (iv) ActorNetworkIdentifier. The PostType property identifies the type of post (e.g., a wall post, blog post, etc.) The ActorNetworkIdentifier property uniquely identifies the author of the post.

Photo Data410may be used to represent a photo found on a social network. The Photo Data410attribute may include the following properties: (i) Caption; (ii) NetworkDateCreated; (iii) NetworkDateModified; and (iv) ImageUrl. The ImageUrl property refers to the public URL of the image on the social network.

Table 1 provides a summary of the various properties of the attributes shown inFIG. 4. The Uses column identifies exemplary potential uses of each of the properties for presentment316and/or analysis314. It should be understood by one of ordinary skill in the art that there may be other uses of the properties in the context of the various embodiments disclosed herein.

FIG. 5is a process flow diagram for a mapping data collected from a plurality of social networks to a single user in accordance with an exemplary social network analyzer embodiment. More particularly, the process flow depicted inFIG. 5, illustrates an exemplary process for mapping user data502,504(in this case, user name and profile information) obtained from two illustratively social networks (in this example, Facebook and Twitter social networks—www.facebook.com and www.twitter.com) to a single person in accordance with a normalized data model. As shown inFIG. 5, the user data502,504obtained from Facebook and Twitter is provided to a user data mapper506for comparison analysis A308. As previously described, the data mapper506may comprise the data analyzer208either alone or in conjunction with the social network adapters that were used to obtain the particular user data (e.g., the Facebook and Twitter social network adapters206a,206bin this particular example). The comparison analysis508performed by the data mapper506may utilize a variety of analytical techniques to try and map the collected sets of user data obtained from the various social networks to a single user or entity. For example, in the comparison analysis shown inFIG. 5, the analysis may include a Levenshtein-type distance analysis510(or Levenshtein distance analysis) and a similarity of data analysis512between the Facebook and Twitter sets of user data502,504.

A Levenshtein-type distance analysis may be used to compare the user names of the user data obtained from each of the social networks. In the example depicted inFIG. 5, the data mapper506may conduct a Levenshtein-type distance analysis510of the two user names obtained from the Facebook and Twitter social networks. In this example, the Levenshtein-type distance analysis510may comprise the number of single character edits needed to transform one character string into another character string—in this case the number of single character edits needed to convert the user name (or a least a portion thereof) from the user data obtained from the Facebook social network to the user name (or a corresponding portion thereof) from the user data obtained from the Twitter social network. The larger the number of edits required, the larger the Levenshtein distance between the two compared character strings. Thus, the larger the number of edits required, the further apart the user name obtained from the Facebook social network is from that obtained the Twitter social network. With reference to the example shown inFIG. 5, there are two single character edits between the names “John” and “Johnny”—one for the additional “n” and one for the “y”—so that their Levenshtein distance=2.

The similarity of data analysis512may be used to compare various aspects of the user data collected from the plurality of social networks. For example, similarity analysis may be conducted to determine the similarity (or, at least, a degree of similarity) between comparable aspects of the user data such as, for example, a similarity comparison between date of birth information, phone numbers, and/or various location information (e.g., geographic location, network location, temporal location) obtained from the collected user data. The greater the similarity (or degree of similarity) between the collected sets of user data, the data mapper may determine that the more likely the various sets of user data obtained from the plurality of social networks are associated with a single person/entity. Continuing with the previously discussed John/Johnny example, if the phone numbers, birthdays and/or location information associated with the user name “John” obtained from Facebook is the same as that for “Johnny” obtained from Twitter, the higher the likelihood that “John” and “Johnny” are the same person. On the other hand, if the phone numbers, birthdays and/or location information are different, than the less likely the user data of “John” and “Johnny” are associated with the same person. It should be understood that this similarity analysis may be performed to provide some sort of degree of similarity (e.g., a percentage or rank of similarity) rather than a simple binary analysis (i.e., “match”/“does not match”). For example, if the date of birth information from the user data for “John” is “Jun. 23, 1980” while the date of birth information from the user data for “Johnny” is “June 23” but does not indicate the year, the similarity of data analysis512may still assign a percentage or other degree of confidence indicating a relatively strong similarity between the two birthday dates.

FIG. 6is a process flow diagram for normalizing a single user's social graph information obtained from the user's a plurality of social networks using a social network analyzer in accordance with an illustrative embodiment. In the illustrative example depicted inFIG. 6, the social network analyzer100obtains social graphs602,604(also known as sociograms or friend graphs) from a user's data collected from the two exemplary social networks—the Facebook and Twitter social networks—discussed in the previous example with reference toFIG. 5. The social graphs602,604are provided to the data mapper606for normalization.

In operation608, the data mapper606analyzes each of the provided social graphs602,604to assign weights to the nodes of the social graphs in order indicate the degree of match of each friend found present in the two social graphs. This operation is further discussed with reference toFIG. 7. InFIG. 7, two exemplary social graphs of a single user are illustrated—a first social graph702of the user obtained from the Facebook social network and a second social graph704of the user obtained from the Twitter social network. In each social graph702,704, individuals or entities are represented as circular nodes. The nodes of the first social graph702are labeled with an “f” to indicate that they are associated with the first social graph702and the nodes of the second social graph704each labeled with an “t” to indicate that they are part of the second social graph704. The two nodes labeled with the designation “So” are the source nodes of the social graphs. The source nodes “fSo” and “tSo” are those nodes that are associated with the user whose user data has been obtained from the two social networks and analyzed by the social network analyzer100. The other nodes in each social graph702,704are those individuals or entities that are friends of the user (i.e., friends of the user identified as the source node). As depicted in the illustrative embodiment shown inFIG. 7, there are five “friend” nodes—fA, fB, fC, fD, fE—in the first social graph702, and six “friend” nodes—fA, fB, fC, fD, fE′, fX—in the second social graph704.

Using the two illustrative social graphs depicted inFIG. 7, in order to assign weights to the nodes in accordance with operation608, the data mapper606, compares the nodes of the first social graph702to those of the second social graph704in an attempt to match nodes common to both social graphs702,704. This matching may be attempted for source nodes, friend nodes, or both types of nodes. In accordance with one embodiment, the data mapper may iterate through the nodes of both social graphs702,704and compare the user names (or other identifiers) of each node in one social graph to the user names of the nodes in the other social graph. Those nodes that have user names (or corresponding identifiers) in the two social graphs702,704that are exact matches are paired together and are each given a weight of “1” (representing a percentage of 100%). For example, inFIG. 7, the nodes-pairs fSo(1)-tSo(1), fA(1)-tA(1), fB(1)-tB(1), fC(1)-tC(1), and fD(1)-tD(1) all have been given a weight of “1”. In accordance with the illustrative embodiment that matches nodes by user name, this indicates that the user names of source nodes fSo and tSo have been determined to be exact matches, the user names of friend nodes fA and tA have been determined to be exact matches, the user names of friend nodes fB and tB have been determined to be exact matches, the user names of friend nodes fC and tC have been determined to be exact matches, and the user names of friend nodes fD and tD have been determined to be exact matches (as indicated by the “(1)” displayed in each of these nodes). For example, if nodes fA and tA both share the exact same user name “John Smith”, then the data mapper606would assign a confidence score of “1” to both nodes fA and tA. It should be understood, that with at least with respect to source nodes, other techniques or information may be used for determining whether a node in one social graph matches a node in the other social graph. For instance, the data matching techniques discussed with reference toFIG. 5may be used to determine whether a node matches another node.

For those nodes in one social graph that are determined not to have an exactly matching node in the other social graph, the data mapper606may assign a value lower than “1” to these nodes with decreasing values indicating a lower probability of a match between the two nodes. For example, inFIG. 7, node pair fE(0.5)-tE′(0.5) have been given a weigh of “0.5” indicating a particular degree of matching. This value may be calculated using, for example, the methods discussed with reference toFIG. 5such as, for instance, a Levenshtein distance analysis between the user names of nodes fE and tE′. As shown inFIG. 7, those nodes determined not to have any corresponding node or that do not match any other node—such as node tX in the second social graph—are given no weigh (i.e., 0 weight).

After weights have been assigned to the node/nodes-pairs, the data mapper may then analyze the social graphs702,704in operation610to identify the set of maximum common subgraphs based on the determined weights (per operation608) in the social graphs. In the two exemplary social graphs ofFIG. 7, there are two maximum common subgraphs. These two maximum common subgraphs802,804are illustrated inFIG. 8. The first maximum common subgraph802found in both social graphs702,704comprises the subgraph between nodes So, A, B, and E and the second maximum common subgraph804comprises the subgraph between nodes C and D.

In operation612, the data mapper506iterates through the subgraphs in the set of maximum common subgraphs found between the two social graphs702,702in operation610and calculates the total weight in each subgraph. Continuing with example depicted inFIG. 7andFIG. 8, the weights of nodes So, A, B, and E comprise a first maximum common subgraph802are added together to a obtain a sum of 3.5 (1+1+1+0.5=3.5) for the first subgraph802. Similarly, the weights of nodes C and D comprising the second maximum common subgraph804are added together to obtain a sum of 2 (1+1=2) for the second subgraph804.

For each common subgraph802,804, the average weight of the nodes comprising the subgraph is calculated by dividing the sum of the weights of the nodes in the subgraph by the number of nodes in the that subgraph. For example, the average node weight in the four-node subgraph802is 0.875 ((sum weight of nodes of subgraph)/(number of nodes in subgraph)=3.5/4=0.875) and the average node weight in the two-node subgraph804is 1 ((sum weight of nodes of subgraph)/(number of nodes in subgraph)=2/2=1).

In decision614, the average weight of each common subgraph is compared by the data mapper against a threshold value. If the average node weight for any of the common subgraphs is determined in decision614to be less than the threshold, then the YES path is followed to operation616. In operation616, the nodes with lower weights are removed from the common subgraphs. These removed lower-weight nodes as well as any unpaired/matched nodes from the analyzed social graphs are stored as separate friends in the unified social graph data model. In operation618the remaining portion of the common subgraph(s) are stored as a single, normalized social graph. Similarly, if in decision614, the average node weight for all of the common subgraphs are determined to be greater or equal than the threshold, then the NO path is followed to operation620in which all of the nodes of the common subgraphs are stored as the single, normalized social graph (with any unmatched nodes being stored as separate friend nodes in the combined, normalized social graph).

Continuing with the illustrative embodiment depicted inFIG. 7andFIG. 8, if the average node weight threshold is 0.9, for example, then the average node weight for the four-node subgraph802is less than the threshold (0.875<0.9) and the average node weight for the two-node subgraph804is above the threshold (1>0.9). Accordingly, the YES path is followed to operation616and node “E” of the common four-node subgraph802, is removed from the subgraph because it is the node with the lowest weight in the subgraph (i.e., a weight of 0.5 versus a weight of 1 for nodes A, B, and So). Nodes fE and tE, as well as unpaired node tX are then stored as separate friends of So in the normalized data model of the user So's social graphs. Each of the remaining nodes—A, B, C and D—are each stored as single friend nodes of So in the normalized data model of user's So's social graphs. As a result, the normalized data model of the social graphs for the user So across two social graphs “f”702and “t”704in this example would be A, B, C, D, fE, tE, and X. With reference toFIG. 2andFIG. 3, the normalized data model for social graphs “f”702and “t”704may be stored in the normalized data store210for subsequent presentment316via the analytics API212, for example.

FIG. 9is a block diagram of an implementation of the social network analyzer100that may be implemented to assess a level of risk to a user of social networks. As previously discussed with reference toFIG. 2, the social network analyzer100may include a network interface202adapted for interfacing with one or more networks102including the Internet, for example, in order to allow the social network analyzer100to communicate over the network(s) with other sites or nodes connected to the network—including social networking sites. The social network analyzer100may also have a social network API204that, as previously discussed with reference toFIG. 2, may include a plurality of social network adapters adapted for communicating with an associated social network so that each social network adapter may retrieve information from its associated social network—including information and data about individual users of the social network.

In addition, the social network analyzer100may also include a risk score analyzing component900(“risk score analyzer”) that is adapted to perform various analyses on data collected from the network102about a person or entity involved in social networking. In accordance with one embodiment, the risk score analyzer900may be implemented or be combined with at least a part of the data analyzer/mapper208depicted inFIG. 2. It should also be understood to one in the art that embodiments of the social network analyzer100may be practiced where either the risk score analyzer900is implemented without the presence of the data analyzer208, and vice versa. Moreover, it should be understood to one in the art that embodiments may be implemented where separate social network analyzers are implemented with at least one social network analyzer implementing the risk score analyzer900and at least one other social network analyzer implementing the data analyzer208. Further, it should also be understood that the risk score analyzer900may be implemented separately from the social network analyzer100. For example, the analysis provided by the risk score analyzer900may comprise at least a portion of the further analysis314as previously mentioned with reference toFIG. 3. In such an embodiment, the risk score analyzer900may obtain data and other information from the social network analyzer100via the analytics API212shown inFIG. 2.

The risk score analyzer900may be used to provides a means for assessing the level of risk of a person's activities online in the aggregate by calculating a risk score for the person's online activities. The risk score analyzer900may use the following inputs in order to calculate such as risk score:Input 1—Warnings about the person: The person's online information may be collected and analyzed for any potential dangers to the person's potential safety and/or reputation. Such online information may be obtained, for example, from a website that discloses personal information about the person in question.Input 2—Warning Severity Matrix: A function (“S(w)”) which assigns a severity level to each given warning.Input 3—Severity Weighing Matrix: A function (“M(w, s, a)”) which assigns a weight to each warning based on the warning's age and severity level.

The risk score analyzer900may use at least a portion of these inputs to calculate an aggregate risk score (or simply a “risk score”) for the person being analyzed. In accordance with one embodiment, the risk score may be calculated in the following manner. For each warning, the risk score analyzer900may use the Warning Severity Matrix to assign a severity level to the warning. The severity level may be a numerical value (e.g., For a warning “a”, the risk score analyzer900may assign a severity level equal to a value “x”). The risk score analyzer may then use the Severity Weighing Matrix to assess a weighted score to the warning based on its assigned severity level and, as a further option, the age of the warning. The risk score analyzer900may then calculate the risk score for the person as the aggregate of the weighted scores for all the warnings associated with that person. The aggregate function may be, for example, an average of the weighted scores or the sum of the weighted scores for that person.

As previously discussed, the social network analyzer100may also be provided with or coupled to a data storage device210in which data may be stored and retrieved by the social network analyzer100and the various components thereof including the risk score analyzer900. Thus, data stored in the data storage device210may include the raw data retrieved from the network and the social network sites, data input to and/or output from the risk score analyzer900including the Warning Severity Matrix, Severity Weighing Matrix, and information about warnings, severity levels, weightings, ages, risk scores discussed herein.

FIG. 10is a flowchart of a process1000for assigning a risk score to a user of social networks in accordance with an illustrative embodiment. In operation1002, information about a person's (or entity's) online activities is collected from the network. This collection may be performed using the social network analyzer100and/or the components thereof as discussed herein. In one embodiment, the collected information may include information associated with the person (who may also be referred to herein as the “subject”, “subject person” or “user”) collected from one or more social networks such as, for example, Facebook, Twitter, Google+, MySpace, Formspring, Instagram, and the like. The collected information may include, for example: (i) postings, comments and other messages made by the subject person; (ii) postings, comments and other messages made by other users known to the subject person (e.g., friends or associates of the subject person); (iii) postings, comments and other messages direct to the subject person (i.e., postings not made by the subject person); and (iv) images, photos, videos posted by the subject person or that have been tagged to indicate that user is included therein or associated therewith. In accordance with one embodiment, the subject person may authorize the social network analyzer100to collect his or her information from a particular social network. For example, the person may grant to the social network analyzer100permission to fetch his or her posts, comments, friends list, photos, videos, etc. from the Facebook social network. The social network analyzer100may then utilize the appropriate aspects of its social network API to access and retrieve the authorized information from the Facebook social network—with the social network allowing access to this data (based on the subject person's permissions) via the social network's API, for example. The collected information may also be stored in the data store200of the social network analyzer100.

In operation1004, risk score analyzer900analyzes all of the collected data (or at least a portion of the collected data) in order to identify any potential warnings/threats that may be contained in the collected information. As shown in box306, some exemplary warnings may include: (i) a message from a stranger (e.g., a message from someone that is not a “friend” or “approved” by the subject person and/or a person that is not known to the subject person); (ii) a post containing one or more keywords (e.g., words that have been flagged as defamatory, threatening, inappropriate, obscene, etc.); and (iii) a “weak friend” of the subject person.

In operation1008, the risk score analyzer900utilizes the Warning Severity Matrix (“function S(w)”) to assign a severity level (or criticality level) for each of the warnings/threats identified in operation1004. In one embodiment, Warning Severity Matrix may comprise a table or similar data structure containing a variety of different types or kinds of warnings/threats and a corresponding level of severity assigned to each type of warning (see, e.g., box1010). Table 2 illustrates an exemplary Warning Severity Matrix for a set of illustrative types of warnings.

TABLE 2Type of Warning/ThreatsSeverity LevelWarnings from a Stranger (such as, e.g.,Non-CriticalMessages, Postings, Comments from aStranger to or directed to the SubjectPerson)Warnings associated with a Weak Friend ofNon-Criticalthe Subject PersonWarnings containing the Phone Number ofCriticalthe Subject PersonWarnings containing a Mention orCriticalReference to DrugsWarnings containing a particular SlangCritical or Non-CriticalTerm(depending on the SlangTerm)

As shown in Table 2, each type of warning has an severity level associated with it—some warnings are classified as “Critical” and others as “Non-Critical”. In some embodiments, the level of criticality may be multi-tiered (such as, e.g., “Very Critical”, “Critical”, “Moderately Concerning”, “Concerning”, “Non-Critical”) or on a numerical sliding scale (such as e.g., “100” being the most critical and “0” being the least critical—i.e., non critical and/or unimportant).

The severity levels associated with the various types of warnings can be customized to suit the particular application or subject person. As depicted in the example in Table 2, messages from strangers and weak friend warnings have been assigned a “Non-Critical” severity level and warnings containing a particular phone number (in this case a phone number of the subject person) or a reference to a drug(s) (e.g., illicit drugs) have been assigned “Critical” severity level. In the case of warnings containing a certain phone number, these warnings may be critical because of the high potential of misuse or abuse of the phone number by others (such as, e.g., threatening or harassing calls). In the case of warnings mentioning drugs, such warnings may be critical because they may indicate the occurrence or threat of potentially illegal, threatening or risky behavior (such as, e.g., threats of violence/intimidation, sexual content/language). As shown in Table 2, warnings containing certain slang terms may be assigned a higher level of severity than those containing other slang terms. As another example, different levels of severity can be assigned to a warning carrying a mention of alcohol for adult and child subjects (e.g., less critical for adults and more critical for children). As a further example, different While the social network analyzer100may set these values, in some embodiments, the social network analyzer100may allow the subject person (or other user—e.g., a parent or guardian) to customize the setting of the severity levels to suit their particular needs or desires. This may be accomplished by including a network-accessible interface to the subject person or authorized user to adjust the settings of the severity levels and even add additional types of warnings to the matrix.

Because the types of warnings may evolve over time, the social network analyzer100may—depending on the circumstances or implementation—periodically or continually update the contents of the Warning Severity Matrix over time as new types of warnings come up. For example, slang terms/phrases are constantly changing and their significance can be more or less important (or critical) over time and/or generation (such as e.g., teenagers' use versus parents' use of the term or phrase). In order to keep up with the constantly evolving severity levels, the social network analyzer100may utilized crowd-sourcing to identify and input new warnings and potential severity levels for these warnings into the Warning Severity Matrix. This input may be accomplished by providing third-parties access to the Warning Severity Matrix via an appropriate API to the social network analyzer100such as, for example, via the analytics API212.

Next, in operation1012, the risk score analyzer900utilizes the Severity Weighing Matrix (“function M(w, s, a)”) to assign a weighed score to each collected warning. The weighed score may be based on the particular type of warning, the severity level assigned to that warning (per operation1008) as well as the age of the warning. In one embodiment, the age of the warning may be determined from the date that the warning was created and/or last modified online.

Block1014inFIG. 10contains illustrative weights assigned to some exemplary phone number-containing warnings, drug-related warnings, and warnings with sexual content. As shown inFIG. 10, a warning comprising a phone number posted to a site on current or present day (i.e., “today” or the same day that warning is obtained by the social network analyzer100) may be given a higher weight, for example, a weight=1.0 because it has a critical severity level and this warning/information is current (i.e., very recent). In contrast, a phone number warning posted some time period before the current/present day may be a lower weight. For example, as shown in lock1014, a phone number warning posted a month ago may be given a slightly lower weight=0.9 than a current phone number warning because of its age.

Block1014also depicts four exemplary warnings classified as drugs related. The first drugs-related warning is a message containing a drug reference posted “today” and is given a weight=1.0 because it is a critical warning and is a very recent warning (i.e., a current warning). The second drugs-related warning is a message containing a drug reference posted a month ago and, therefore, may be given a slightly lower weight=0.9 than a current drugs-related message because of its age (as well as it being classified as a critical warning). The third exemplary drugs-related warning is a message containing a drug reference posted “today” by a person classified as a “weak friend” of the subjection person. Although this warning is a drugs-related message (which are classified as a critical warning), because it was posted by a weak friend, it may be given a mid-level weight=0.5 to reduce its importance when compared to a situation where a similar message had been posted by a closer friend of the subject.

The fourth exemplary drugs-related warning is a message containing a drug reference posted to a child today. This message may be given a higher weight=1.0 because it of critical level (because it is a drug-related warning) and it has been directed to a minor. The last warning in block1014is a message or posting containing a reference to sex that has been directed to an adult today. Because it is posted to an adult, sex-related warnings (an even drugs-related warnings) may be given a lower weight, such as for example, a weight=0.7. As indicated by these examples, different weightings may assigned depending on whether the message has been posted by or directed to a minor as opposed to an adult: a child having posts containing words relating to drugs or sex may be considered very risky in certain implementations.

In operation1016, the risk score analyzer900calculates a risk score for the subject person. The risk score may comprise an aggregate of the weighted scores of at least some or all of the weighted warnings. As indicated in block1018, the aggregate score may be calculated as a sum of all or at least a portion of the weighed warnings calculated in operation1012or as an average of all or at least a portion of the weighed warnings, or a combination of sums and averages—as may be deemed suitable for the particular implementation. In some embodiments, the aggregate score may be presented to the subject or a user of the social network analyzer as a single score.

FIG. 11is a flowchart of an exemplary stranger threat analysis process1100that may be utilized during the analysis of warnings in operation1004ofFIG. 10. This process may be performed to messages, postings, comments, etc. made by persons other than the subject person's friends or authorized associated in the social network. In operation1102, the messages are provided to a stranger analyzer1104which may comprise a portion of the risk score analyzer900which scans the message to determine whether the author of the message is a known friend or authorized associate of the subject person. If the author is not a known friend or authorized associate (see decision1106), the message is determined to be a message from a stranger and designated as a stranger warning in operation1108.

FIG. 12is a flowchart of an exemplary keyword threat analysis process that may be implemented to analyze postings and other messages for threatening and other keywords of interest during the analysis of warnings in operation1004ofFIG. 10. This process relates identifying and flagging warnings containing certain abusive words or personal information being posted to the subject person. As shown inFIG. 1200, different comments1202, posts1204, and messages1206may be provided to a keyword analyzer component1208of the risk score analyzer900. The keyword analyzer component1208may rely on a dictionary of blacklisted words1210(and their corresponding regular expressions (see, e.g., block1212)) to identify messages containing any of these blacklisted words (see decision1214) as messages that contain defamatory content, references to drugs, references to sex and/or containing phone numbers associated with the subject person. Those messages identified as having text or words matching one or more words in the blacklist dictionary1210may then be marked as warnings containing the identified words (e.g., drugs related warnings, sex related warnings, warnings containing phone numbers of the subject person, warnings containing other threats or blacklisted words).

FIG. 13is a flowchart of an exemplary relationship strength assessment process1300in order to determine whether a warning is from a weak-friend of the subject person in operation1004ofFIG. 10. In this process1300, authors of messages, postings are identified in operation1302. Along with this information, the friends and authorized associates of the subject person are obtained and provided to a mutual friend analyzer component1304of the risk score analyzer900. The mutual friend analyzer component1304iterates through all the provided friends of the subject person and calculates the number of mutual friends that each friend shares with the subject person in operation1306. If this number each of mutual friends is less than a threshold number of friends (i.e., less than a predetermined number of mutual friends) (see decision1308), then those messages authored by persons with numbers less than the threshold number of mutual friends with the subject person are designated as warnings from weak friends in operation1310.

FIG. 16is an image of an exemplary screen1600that may be presented to an illustrative user of social networks (named “Courtney”) by the social network analyzer100for displaying information relating to a risk score attributed to the user's social network activities. As shown inFIG. 16, the screen1600may provide an overview of the risks arising from the user's online activities. For example, the screen may include an image and/or indicia that indicate the aggregate risk for the user's online activities—shown in this example via an Alert Level image1602. In this exemplary embodiment, the Alert Level image1602displays a color graduated bar ranging—from left to right—a low aggregate risk score range1604, a middle aggregate risk score range1606, and a high aggregate risk score range1608. A pointer1610is also displayed to indicate the aggregate risk score of the user within the displayed range.

The displayed ranges1604,1606,1608may be color coded for assisting visual interpretation of the score. For instance, the low aggregate risk score range1604may be colored green, the middle aggregate risk score range1606may be colored yellow, and the high aggregate risk score range1608may be colored red in a manner similar to a traffic signal with green representing OK or low risk, the yellow representing moderate risk and the red representing high or dangerous risk. In the embodiment shown inFIG. 16the ranges1604,1606,1608are generally equal size in length but it should be understood that the ranges may be of differing lengths as suited for the particular implementation. The overall range of the three displayed ranges may also be associated with particular values such as, for example, an aggregate risk score between a low value=0 (indicating a very low risk) to a value=100 or 100% (indicating a very high risk) the left). Alert Level image may also display indicia1612and/or images that indicate the number of warnings that were analyzed to derive the aggregate risk score (e.g., a number of online items or instances analyzed).

The screen1600may also include areas for displaying summaries1614of the different types of warnings analyzed (e.g., friend analysis, public posts, private messages, photo/video analysis) and whether any new warnings of a given type have been analyzed to compute the aggregate risk score displayed in the Alert Level1602since the last time the user accessed the screen1600. The warnings summary area1614may also include selectable links that permit the viewer to access information about the particular warnings that have been analyzed. As represented in the embodiment depicted inFIG. 16, these links may permit selected viewing of new warnings and older warnings.

The screen1600may also display a summary of recent alerted activities1616that provides a summary of warnings broken down by particular social networks with whom the user has an account. For example, in the example shown inFIG. 16, user “Courtney” has accounts with the Facebook, Google+, Twitter and FormSpring social networks so summaries of recent activities and/or warnings for each social network may be displayed in the summary of recent alerted activity1616portion of the screen1600.

The various embodiments of the social network analyzer100with a risk score analyzer900may be utilized to provide a concise and predictable way of assessing a level of risk for a given subject person using a social network in order to assist decision makers, assessors, and even the subject person to more easily understand immediately the level of risk that the subject person may be exposed to. Using the embodiments described herein affords a scoring system that can provide a concise and predictable way of assessing the level of risk that helps to eliminate the need to parse and aggregate the data manually.

Various embodiments may also be implemented to calculate a credit worthiness score. In such an embodiment, the overall risk score calculated from the subject person's social interaction may be used to derive a credit score for that person. The subject person's social graph can be analyzed to assess this score. For example, if the subject person is friends with Warren Buffet, for instance, the subject person may likely have a higher credit score. The credit score calculated in this fashion may be used across geographies since a social graph may be considered universal. Another embodiment may be implemented to assess job applicants or job applications. In such an embodiment, an overall risk score of the applicant may be used to determine the quality and/or reliability of the job applicant. Other embodiments may be implemented by a social network to monitor activity and users of the social network

FIG. 14illustrates an exemplary network system1400with a plurality of components1402that may be used when implementing various embodiments described herein. As shown, such components include a network1404which take any form including, but not limited to a local area network, a wide area network such as the Internet, and a wireless network1405. Coupled to the network1404is a plurality of computers which may take the form of desktop computers1406, laptop or notebook computers1408, hand-held computers1410(including wireless devices1412such as wireless PDA's, e-readers, tablet computers and/or mobile phones/smart phones), or any other type of computing hardware/software. As an option, the various computers may be connected to the network1404by way of one or more servers (and/or network switch(es)/router(s))1414which may be equipped with a firewall for security purposes. It should be noted that any other type of hardware or software may be included in the system and be considered a component thereof.

A representative hardware environment associated with the various components ofFIG. 14is depicted inFIG. 15. In the present description, the various sub-components of each of the components may also be considered components of the system. For example, particular software modules executed on any component of the system may also be considered components of the system. In particular,FIG. 15illustrates an exemplary hardware configuration of a computer1500having a central processing unit1502, such as a microprocessor, and a number of other units interconnected via a system bus1504. The illustrative computer1500shown inFIG. 15may also include a Random Access Memory (RAM)1506, Read Only Memory (ROM)1508, an I/O adapter1510for connecting peripheral devices such as, for example, disk storage units1512and printers1514to the bus1504, a user interface adapter1516for connecting various user interface devices such as, for example, a keyboard1518, a mouse1520, a speaker1522, a microphone1524, and/or other user interface devices such as a touch screen or a digital camera to the bus1504, a communication adapter1526for connecting the computer1500to a communication network1528(e.g., a data processing network, wireless network, etc.) and a display adapter1530for connecting the bus1504to a display device1532. The computer may utilize an operating system such as, for example, a Microsoft Windows operating system (O/S), an Apple O/S, a Linux O/S and/or a UNIX O/S. Those of ordinary skill in the art will appreciate that embodiments may also be implemented on platforms and operating systems other than those mentioned. One of ordinary skilled in the art will also be able to combine software with appropriate general purpose or special purpose computer hardware to create a computer system or computer sub-system for implementing various embodiments described herein. It should be understood the use of the term logic may be defined as hardware and/or software components capable of performing/executing sequence(s) of functions. Thus, logic may comprise computer hardware, circuitry (or circuit elements) and/or software or any combination thereof.

Embodiments of the present invention may also be implemented using computer program languages such as, for example, ActiveX, Java, C, and the C++ language and utilize object oriented programming methodology. Any such resulting program, having computer-readable code, may be embodied or provided within one or more computer-readable media, thereby making a computer program product (i.e., an article of manufacture). The computer readable media may be, for instance, a fixed (hard) drive, diskette, optical disk, magnetic tape, semiconductor memory such as read-only memory (ROM), etc., The article of manufacture containing the computer code may be made and/or used by executing the code directly from one medium, by copying the code from one medium to another medium, or by transmitting the code over a network.

Various systems, methods, and computer program products on a computer readable storage medium for causing a computer to perform a method may be implemented in accordance with the various embodiments described herein. For example, a server may be provided that has a component coupled to a network to permit the receiving, via the network, of one or more messages containing information describing one or more aspects of a malware detected on a remote computer by an antivirus program.

While various embodiments have been described, they have been presented by way of example only, and not limitation. Thus, the breadth and scope of any embodiment should not be limited by any of the above described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.