PREVENTION OF COALITION ATTACKS IN SOCIAL NETWORK COMMUNITIES

• US 20140059203A1
• Filed: 08/23/2012
• Published: 02/27/2014
• Est. Priority Date: 08/23/2012
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Trabelsi, Slim, Bezzi, Michele, Montagnon, Gilles
• Granted Patent: US 9,514,494 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 50/01 Social networking

Abstract

A report handler may receive abuse reports from reporters alleging policy violations of network use policies by at least one potential victim, and a source analyzer may determine at least one subset of the reporters. A content analyzer may determine a reference to the at least one potential victim in network activities of the at least one subset, and a review requester may generate a notification of a potential coalition attack against the at least one potential victim, based on the reference in the context of the at least one subset.

Claims

1. A system including instructions recorded on a non-transitory computer readable storage medium and executable by at least one processor, the system comprising:

a report handler configured to cause the at least one processor to receive abuse reports from reporters alleging policy violations of network use policies by at least one potential victim;

a source analyzer configured to cause the at least one processor to determine at least one subset of the reporters;

a content analyzer configured to cause the at least one processor to determine a reference to the at least one potential victim in network activities of the at least one subset; and

a review requester configured to cause the at least one processor to generate a notification of a potential coalition attack against the at least one potential victim, based on the reference in the context of the at least one subset.

2. The system of claim 1, wherein the report handler is further configured to determine receipt of at least a threshold number of the abuse reports.

3. The system of claim 1, wherein the source analyzer is configured to determine the subset including determining that at least a threshold number of the reporters are members of a preexisting group defined with respect to at least one common interest.

4. The system of claim 1, wherein the source analyzer is configured to determine the subset based on common page visits of the abuse reporters.

5. The system of claim 1, wherein the source analyzer is configured to determine the subset based on individual user profiles of the abuse reporters.

6. The system of claim 1, wherein the source analyzer is configured to determine the subset based on content of posts published by the abuse reporters.

7. The system of claim 1, wherein the content analyzer is configured to determine the reference as including a uniform resource identifier (URI) identifying the at least one potential victim.

8. The system of claim 1, wherein the content analyzer is configured to determine the reference as including content identifying the at least one potential victim.

9. The system of claim 1, wherein the network activities include publications of posts by the abuse reporters.

10. The system of claim 1, wherein the network activities include communication between the abuse reporters.

11. The system of claim 1, wherein the review requester is configured to generate the notification for transmission thereof to an administrator of the network use policies.

12. The system of claim 1, wherein the review requester is configured to determine that the potential coalition attack is not an actual coalition attack, and is further configured to penalize the at least one potential victim in accordance with the network use policy.

13. The system of claim 1, wherein the review requester is configured to determine that the potential coalition attack is an actual coalition attack, and further configured to identify the abuse reporters involved as having participated therein.

14. A computer-implemented method for causing at least one processor to execute instructions recorded on a computer-readable storage medium, the method comprising:

receiving abuse reports from reporters alleging policy violations of network use policies by at least one potential victim;

determining at least one subset of the reporters;

determining a reference to the at least one potential victim in network activities of the at least one subset; and

generating a notification of a potential coalition attack against the at least one potential victim, based on the reference in the context of the at least one subset.

15. The method of claim 14, wherein determining the at least one subset includes determining at least one commonality between members of the reporters forming the subset.

16. The method of claim 14, wherein determining the reference includes determining a uniform resource identifier (URI) identifying the at least one potential victim associated with posts of the subset.

17. A computer program product, the computer program product being tangibly embodied on a non-transitory computer-readable medium and comprising instructions that, when executed, are configured to cause at least one processor to:

receive abuse reports from reporters alleging policy violations of network use policies by at least one potential victim;

determine at least one subset of the reporters;

determine a reference to the at least one potential victim in network activities of the at least one subset; and

generate a notification of a potential coalition attack against the at least one potential victim, based on the reference in the context of the at least one subset.

18. The computer program product of claim 17, wherein the instructions, when executed, are further configured to cause the at least one processor to:

determine the at least one subset including determining at least one commonality between members of the reporters forming the subset.

19. The computer program product of claim 17, wherein the network activities include publications of posts by the abuse reporters.

20. The computer program product of claim 17, wherein the instructions, when executed, are further configured to cause the at least one processor to:

generate the notification for transmission thereof to an administrator of the network use policies.