Impersonation detection and abuse prevention machines

Systems and methods for impersonation detection and abuse prevention are disclosed. In example embodiments, a batch server of a social networking service receives a new registration or an update for an account, the account comprising a name and identity-related information. The batch server determines that the name and the identity-related information of the account matches one or more other accounts of the social networking service. The batch server detects a suspicious behavior of the account. The batch server limits, in response to the suspicious behavior, access to the account unless or until an identity of a user of the account is verified.

PRIORITY CLAIM

This application claims priority under 35 U.S.C. § 119 to United States Provisional Patent Application Ser. No. 62/459,731, filed Feb. 16, 2017, and titled, “IMPERSONATION DETECTION AND ABUSE PREVENTION MACHINES,” which is incorporated herein by reference in its entirety.

TECHNICAL FIELD

The present disclosure generally relates to machines configured for impersonation detection and abuse prevention in a social networking service, including computerized variants of such special-purpose machines and improvements to such variants, and to the technologies by which such special-purpose machines become improved compared to other special-purpose machines that provide impersonation detection technology. In particular, the present disclosure addresses systems and methods for impersonation detection and abuse prevention in a social networking service.

BACKGROUND

Impersonation and abuse are common problems in the social networking space. For instance, an impersonator may create a social networking account with a celebrity's name and then make postings in the social networking service as the celebrity, without the celebrity's approval or endorsement. This may harm both the celebrity and the social networking service. As the foregoing illustrates, techniques for impersonation detection and abuse prevention in a social networking service may be desirable.

DETAILED DESCRIPTION

The present disclosure describes, among other things, methods, systems, and computer program products that individually provide various functionality. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the various aspects of different embodiments of the present disclosure. It will be evident, however, to one skilled in the art, that the present disclosure may be practiced without all of the specific details.

Some aspects of the subject technology address the problem in the computer arts of detecting impersonation and preventing abuse in a social networking service. This problem may be solved using the system shown inFIG. 1or using another system with different machines. As used herein, a social networking service may encompass a professional networking service. The phrases “social networking service” and “professional networking service” may be used interchangeably.

FIG. 1illustrates an example social networking system100in which impersonation detection and abuse prevention may be implemented, in accordance with some embodiments. As shown, some machines of the social networking system100are connected to a network120and communicate with one another or with client device(s)110via the network120. The network120may include one or more of the Internet, an intranet, a local area network, a wide area network, a wired network, a wireless network, a cellular network, a Virtual Private Network (VPN), and the like. Each client device110may be a desktop computer, a laptop computer, a mobile phone, a tablet computer, a smart watch, a smart television, and the like. As shown, the social networking service100includes a management server130, a batch server140, a Tier III Identifier Data Repository150, a Social Network Account Data Repository160, a Tier II Identifier Data Repository170, and a Tier I Identifier Data Repository180.

Information about accounts of the social networking service100may be stored in the Social Network Account Data Repository160. Each account may be identified via a name (e.g., first name and last name) and additional identity-related information. The identity-related information may include, for example, a business Apple), an educational institution (e.g., Harvard), a geographic location (e.g., San Francisco, CA), a job title (e.g., chief executive officer), and a header (e.g., any text selected by a user of the account to further identify him/ herself). The Tier II Identifier Data Repository150stores <name, identity-related information> pairs for high-profile individuals who have been targets of impersonation attacks. In some cases, a person associated with the <name, identity-related information> stored in the Tier III Identifier Data Repository150may lack an account in the social networking service100. Alternatively, such a person may have such an account. The Tier II Identifier Data Repository170stores <name, identity-related information> pairs for users who are more likely to be impersonated than the typical user is, for example, executives or board members of large financial companies with more than a threshold number of employees. Thus, tier II users may be proactively protected from impersonation. A third tier of processing, Tier I, is applied to all users of the social networking service whose <name, identity-related information> is stored in the Social Network Account Data Repository160. In some cases, the Social Network Account Data Repository160may include a Tier I Identifier Data Repository180, Alternatively, the Tier I Identifier Data Repository180may be a separate data repository from the Social Network Account Data Repository160, and may store only identifiers (and not other account information).

Some aspects of the subject technology are implemented using the management server130and the batch server140of the social networking service100. The management server130is a fast online server, which operates in real-time. The batch server140might not operate in real-time and operates via batch processing (e.g., using the Map Reduce algorithm). In some cases, the batch server140operates during off-peak hours when the network traffic is lower and accesses the network120, the Social Network Account Data Repository160, the Tier II Identifier Data Repository170, and the Tier I Identifier Data Repository180once every threshold time period (e.g., once per day or once per week). The batch server140may operate via Extract, Transform, Load (ETL) or other data warehousing techniques. One or more of the Tier III Identifier Data Repository150, the Social Network Account Data Repository160, the Tier II Identifier Data Repository170, and the Tier I Identifier Data Repository180may be implemented as a database or any other data storage unit.

In accordance with some implementations, the batch server140receives (e.g., from the client device110or from the Social Network Account Data Repository160) a new registration or an update for an account. For example, a new account for “John Q. Sample” at “ABC Corporation” in “Nashville, Tennessee” may be created from the client device110, or an existing account holder may change his/her name, business or geographic location using the client device110. The account has a name and identity-related information. The batch server140determines that the name and the identity-related information of the account matches one or more other accounts of the social networking service, for example, by comparing the name and the identity-related information with <name, identity-related information> pairs of accounts in the Social Network Account Data Repository160. The batch server140additionally detects a suspicious behavior by the account. The suspicious behavior may include one or more of: accessing the account from a machine used to access or create multiple different accounts, creating the account from a country different from a country where the user of the account is typically located, having an invalid email address associated with the account, and the account being blocked by another account. The batch server140limits, in response to the suspicious behavior, access to the account unless or until an identity of the user of the account is verified. ‘Verifying information associated with the user or the user's business may be used as criteria for whitelisting, preventing the user account from being blocked, In some cases, these might not be used retroactively to unblock users. Users can appeal a determination by submitting official proof of identification (e.g., passport) to the social networking service100to verify that their identity matches their profile data. If the identity of the user is verified, the account is added to a whitelist.

In real-time upon receiving the new registration or the update for the account, the management server130determines if the name and the identity-related information of the account correspond to a tier III identifier from the Tier III Identifier Data Repository150. The Tier III Identifier Data Repository150is coupled with the management server130. In a case where the name and the identity-related information correspond to the tier III identifier: the management server130blocks access to the account unless or until an identity of a user of the account is verified. The verification may include, for example, an employee of the user or the user's business providing a scan or a copy of a passport or identity card of the user to the customer service department of the social networking service100to verify that the account is legitimate. After verification, the account is added to a whitelist. Other verifying information can also be used for whitelisting.

After receiving the new registration or the update for the account and in parallel with the processing of the batch server140discussed above, the batch server140determines if the name and the identity-related information of the account correspond to a tier II identifier from the Tier II Identifier Data Repository170, The Tier II Identifier Data Repository170is coupled with the batch server140. In a case where the name and the identity-related information correspond to the tier II identifier: the batch server140limits access to the account unless or until an identity of a user of the account is verified. If the identity of the user is verified, the account is added to a whitelist. In some cases, the Tier II Identifier Data Repository170is populated based on users at risk for impersonation, such as users with high seniority at large companies in industries often targeted for impersonation,

As a result of the technique described above, impersonation of people identified in the Tier III Identifier Data Repository150is prevented in real-time, to reduce anger by and damage to the reputations of the people and their associated businesses and ill-will toward the social networking service100. Impersonation of people identified in the Tier II Identifier Data Repository170or users identified in the Social Network Account Data Repository (e.g., tier I) is identified more slowly using the batch server140(e.g., by daily batch processing). Thus, such impersonation is still prevented but more slowly and by using less aggressive measures and less expensive computing resources.

To be detected as a potential impersonator, the name or identity-related information fields may correspond exactly to the name or identity-related information of an entity in one of the data repositories150,160or170, or the name may be a variation of the name or identity-related information of such an entity. For example, “John Q. Smith” and “Mr, Smith” may be identified as corresponding to one another. “ABC Bank” and “ABC Insurance” may be identified as corresponding to one another. However, “DEF Bank of Florida” and “DEF Bank of Alabama,” may map to different companies if the data repositories150,160or170store information indicating that these two companies are different. Alternatively, these two companies may still be mapped to the same company in the data repositories150,160or170if it is uncertain whether the name/ company variation is significant or not. For example, if “Apple Corporation” and “Apple Industrial LLC” are different companies, a “Steve Jobs” at “Apple Industrial LLC” may still be tagged as a fake account if there is concern that people may confuse “Steve Jobs” at “Apple Industrial LLC” with “Steve Jobs” at “Apple Corporation,”

In identifying names and identity-related information, the management server130or the batch server140may standardize the name, such as by ignoring punctuation, capitalization, and spaces.

It should be noted that, in some cases, the same name may be associated with multiple different identity-related information. For example, a person may have an employer, a job title, and a geographic location, each of which corresponds to the person's identity-related information.

FIG. 2is a flow chart illustrating an example method200for impersonation detection and abuse prevention implemented at the management server130, in accordance with some embodiments.

At operation210, the management server130receives (e.g., from the client device110or the Social Network Account Data Repository160) a new registration or an update for an account including a name and identity-related information.

At operation220, the management server130determines if the name and the identity-related information are in the Tier III Identifier Data Repository150(e.g., indicating that the account holder has the same name and identity-related information as a high-profile individual). If so, the method200continues to operation230.

At operation230, upon determining that the name and the identity-related information are in the Tier III Identifier Data Repository150, the management server130blocks access to the account unless or until an identity of a user of the account is verified/whitelisted. If the identity of the user is verified, the account is whitelisted to prevent future blocking or limiting of access.

The management server130carries out the operations220and230in real-time after receiving the new registration or the update of operation210. The term “real-time” may include operations being completed without any intentional delay by the management server130. However, in some cases, there may still be some delay, for example, due to network traffic, poor connectivity, poorly functioning processors, and the like. A real-time operation may be completed within 0.1 seconds, within 1 second, within 10 seconds, within 1 minute, within 1 hour, etc.

In some cases, the social networking service 100 hires people to populate the Tier III Identifier Data Repository150with names and identity-related information of high-profile users or individuals who are not users. In some cases, the Tier III Identifier Data Repository150is populated based on complaints provided to the social networking service100based on accounts allegedly impersonating users or other individuals. In some cases, the social networking service100also populates the Tier III Identifier Data Repository150using automated procedures such as by pulling impersonated or otherwise abused <name, identity-related information> pairs from the Social Network Account Data Repository160.

FIG. 3is a flow chart illustrating an example method300for impersonation detection and abuse prevention implemented at a batch server140, in accordance with some embodiments.

At operation310, the batch server140receives (e.g., from the client device110or the Social Network Account Data Repository160) a new registration or an update for an account including a name and identity-related information. The batch server140may access the Social Network Account Data Repository160and receive all new registrations or updates once per threshold time period (e.g., day, two days, week, etc.). The operations of the batch server140described here may occur simultaneously with or later than the operations of the management server130in the method200. After operation310, the method300continues to operation320A or320B. The operation320A may be completed simultaneously and in parallel with the operation320B and330B. Alternatively, the operation320A may be completed before or after the operations320B and330B.

At operation320A, the batch server140determines if the name and the identity-related information are in the Tier II Identifier Data Repository170(e.g., indicating that the account holder has the same name and identity-related information as a public figure, such as an executive or leader of a large bank or finance company). If so, the method300continues to operation340.

At operation320B, the batch server140determines if the name and the identity-related information of the account matches one or more other accounts of the social networking service100, for example, based on data in the Social Network Account Data Repository160. If so, the method300continues to operation330B.

At operation330B, the batch server140determines if a suspicious behavior of the account is detected. The suspicious behavior may include one or more of: accessing the account from a machine used to access or create multiple different accounts, creating the account from a country different from a country where the user of the account is typically located, having an invalid email address associated with the account, and the account being blocked by another account. If the suspicious behavior of the account s detected, the method300continues to operation340.

At operation340, the batch server140blocks access to the account unless or until the identity of a user of the account is verified/whitelisted. If the identity of the user is verified, the account is whitelisted to prevent future blocking or limiting of access.

In some cases, the social networking service 100 hires people or uses automated algorithms to populate the Tier II Identifier Data Repository170by identifying high seniority people at large companies. The social networking service100examines its data for users that have high seniority at large companies in certain industries, verifies that they have a real identity, and then protects their profile data via the Tier II protection approach.

Aspects of the subject technology block accounts (which might be used for impersonating other people) from the social networking service100. While such blocking may be useful to prevent damage to the reputations of the people who are impersonated and of the social networking service100, such blocking may result in displeasure by people who are unable to legitimately use the social networking service100. To prevent blocking of legitimate users, aspects of the subject technology make use of whitelisting. A whitelist of legitimate accounts that are not to be blocked from the social networking service100may be stored in a data repository accessible to the management server130and the batch server140. For example, the whitelist may be stored at the Social Network Account Data Repository160. Alternatively, certain accounts in the Social Network Account Data Repository160may be tagged as being whitelisted. In one example, the subject technology includes maintaining, at a data repository coupled with the management server or the batch server, a set of whitelisted accounts, and foregoing limiting access to the set of whitelisted accounts in response to suspicious behavior.

For example, if a young man named “Walt Disney” (not the founder of Disney Company) moves to Orlando, Florida, the young man may be blocked from the social networking service100, as “Walt Disney/ Orlando, Florida” might be listed in the Tier III Identifier Data Repository150, the Tier II Identifier Data Repository170or the Tier I Identifier Data Repository180. Once Walt Disney's identity is verified (e.g., manually or electronically) per the requirements discussed in conjunction withFIGS. 2-3, Walt Disney's account is whitelisted (e.g., added to a whitelist or tagged as being whitelisted), so that Walt Disney is no longer prevented from using the social networking service100per the methods200or300.

Aspects of the subject technology may be described in the context of various tiers of users in a social networking service. Each tier corresponds to a different level of protection from impersonation detection and abuse. Tier I includes all users of the social networking service. Tier II includes at-risk users of the social networking service (e.g., the CEO of a large regional bank in California). Tier III includes previously targeted and high-profile users of the social networking service (e.g., the President of the United States). These tiers are described in conjunction withFIGS. 4-6.

FIG. 4is a flow chart illustrating an example Tier I protection enforcement method400, in accordance with some embodiments. The method400may be implemented at the batch server140.

At operation410, the batch server140takes all user profiles. At operation420, the batch server140extracts profile entities (e.g., name and identity-related information) from the user profiles. At operation430, the batch server140finds users with profile entity duplicity and prior abuse on the profile entity. At operation440, the batch server140determines if a user found at operation430has suspicious activity. If so, at operation450, the batch server140determines if the user identified at operation440meets whitelist criteria. If not, at operation460, the batch server140blocks user account access.

FIG. 5Ais a flow chart illustrating an example Tier II protected entities generation method500A, in accordance with some embodiments. The method500A may be implemented at the batch server140.

At operation510A, the batch server140takes all user profiles. At operation520A, the batch server140infers seniority data from the user profiles (e.g., from information specified in the user profiles). If seniority data exists, at operation530A, the batch server140determines if the user has high seniority and a good reputation (e.g., no or few (e.g., relative to total number of posts) complaints or blocking). If so, at operation540A, the batch server140determines if the user works for a large company (e.g., more than a predefined number of employees) in a highly targeted industry (e.g., technology, music, media, or banking). if so, at operation550A, the batch server140extracts profile entities (e.g., name and identity-related information) from the profile. At operation560A, the Tier II protected profile entities are saved to the Tier II Identifier Data Repository170.

FIG. 513is a flow chart illustrating an example Tier II protection enforcement method500B, in accordance with some embodiments. The method500B may be implemented at the batch server140.

At operation510B, the batch server140takes all user profiles. At operation520B, the batch server extracts profile entities (e.g., name and identity-related information) from the profiles. At operation530B, the batch server140determines if a user matches any of the Tier II protected profile entities in the Tier II Identifier Data Repository170. If so, at operation540B the batch server140determines if the user meets whitelist criteria. If not, at operation550B, the batch server140blocks the user's account access.

FIG. 6Ais a flow chart illustrating an example Tier III protected entities generation method600A, in accordance with some embodiments. The method600A may be implemented at the batch server140.

At operation610A, a customer service representative of the social networking service100tags profiles in the social networking service100as real or impersonator (fake). At operation620A, the batch server140takes all tagged user profiles. At operation630A, the batch server140extracts profile entities (e.g., name and identity-related information) from the tagged user profiles. At operation640A, the batch server140saves the Tier III protected profile entities to the Tier III Identifier Data Repository150.

FIG,6B is a flow chart illustrating an example Tier III protection enforcement method600B, in accordance with some embodiments. The method600B may be implemented at the management server130.

The method600B begins at operation61013-1with a new user registration at the social networking service100or at operation610B-2with a user profile edit at the social networking service100. At operation62013, the management server130extracts profile entities (e.g., name and identity-related information) from a profile associated with the new user registration or the user profile edit. At operation630B, the management server130checks for a match to the extracted profile entities in the Tier III Identifier Data Repository150. If there is a match, at operation640B, the management server130checks a whitelist. If there is no match with the whitelist, at operation650B, the management server130blocks the user's account access.

The subject technology is described herein in the social/ professional networking context. However, the subject technology may be useful in other contexts also. For example, the subject technology may be useful in a service that provides personal email addresses or any other service that relies on identity verification or identity representation.

MODULES, COMPONENTS, AND LOGIC

MACHINE AND SOFTWARE ARCHITECTURE

The modules, methods, applications, and so forth described in conjunction withFIGS. 1-6Bare implemented in some embodiments in the context of a machine and an associated software architecture. The sections below describe representative software architecture(s) and machine (e.g., hardware) architecture(s) that are suitable for use with the disclosed embodiments.

EXAMPLE MACHINE ARCHITECTURE AND MACHINE-READABLE MEDIUM

The machine700may include processors710, memory/storage730, and I/O components750, which may be configured to communicate with each other such as via a bus702. In an example embodiment, the processors710(e.g., a Central Processing Unit (CPU), a Reduced Instruction Set Computing (RISC) processor, a Complex Instruction Set Computing (CISC) processor, a Graphics Processing Unit ((W U), a Digital Signal Processor (DSP), an ASIC, a Radio-Frequency Integrated Circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, a processor712and a processor714that may execute the instructions716. The term “processor” is intended to include multi-core processors that may comprise two or more independent processors (sometimes referred to as “cores”) that may execute instructions contemporaneously. AlthoughFIG. 7shows multiple processors710, the machine700may include a single processor with a single core, a single processor with multiple cores (e.g., a multi-core processor), multiple processors with a single core, multiple processors with multiples cores, or any combination thereof.

The memory/storage730may include a memory732, such as a main memory, or other memory storage, and a storage unit736, both accessible to the processors710such as via the bus702. The storage unit736and memory732store the instructions716embodying any one or more of the methodologies or functions described herein. The instructions716may also reside, completely or partially, within the memory732, within the storage unit736, within at least one of the processors710(e.g., within the processor's cache memory), or any suitable combination thereof, during execution thereof by the machine700. Accordingly, the memory732, the storage unit736, and the memory of the processors710are examples of machine-readable media.

Communication may be implemented using a wide variety of technologies. The I/O components750may include communication components764operable to couple the machine700to a network780or devices770via a coupling782and a coupling772, respectively. For example, the communication components764may include a network interface component or other suitable device to interface with the network780. In further examples, the communication components764may include wired communication components, wireless communication components, cellular communication components, Near Field Communication (NEC) components, Bluetooth® components (e.g., Bluetooth® Low Energy), Wi-Fi® components, and other communication components to provide communication via other modalities. The devices770may be another machine or any of a wide variety of peripheral devices (e.g., a peripheral device coupled via a USB).

TRANSMISSION MEDIUM

The instructions716may be transmitted or received over the network780using a transmission medium via a network interface device (e.g., a network interface component included in the communication components764) and utilizing any one of a number of well-known transfer protocols (e.g., HTTP). Similarly, the instructions716may be transmitted or received using a transmission medium via the coupling772(e.g., a peer-to-peer coupling) to the devices770. The term “transmission medium” shall be taken to include any intangible medium that is capable of storing, encoding, or carrying the instructions716for execution by the machine700, and includes digital or analog communications signals or other intangible media to facilitate communication of such software.

LANGUAGE