PROCESS AND MECHANISM FOR IDENTIFYING LARGE SCALE MISUSE OF SOCIAL MEDIA NETWORKS

• US 20150120583A1
• Filed: 10/25/2013
• Published: 04/30/2015
• Est. Priority Date: 10/25/2013
• Status: Active Application

• Current Assignee: Mitre Corporation
• Original Assignee: Mitre Corporation
• Inventors: ZARRELLA, Jeffrey
• Application Number:
  US14/063,555
• Publication Number:
  US 20150120583A1
• Time in Patent Office: Days
• US Class Current: 705/317
• CPC Class Codes: G06F 16/906 Clustering; Classification
• CPC Class Codes: G06Q 30/018 Certifying business or products
• CPC Class Codes: G06Q 50/01 Social networking

Abstract

The described systems and methods compare behavior between multiple users of social media services to determine coordinated activity. An index is created and used to extract uncommon features from social media messages. A collision between users is detected when their messages have the same uncommon feature. A number and/or frequency of collisions may indicate a probability that users are engaged in coordinated activity. A comparison of user accounts with multiple collisions may be executed to identify similar content as coordinated activity. A visualization tool constructs a network graph that shows relationships between users in social networks, and can be used to discover coordinated users engaged in misuse of social media.

Claims

1. A method for preparing a dataset of uncommon features, comprising:

retrieving a dataset comprising a plurality of social media messages stored in a memory, wherein the plurality of social media messages are authored by a plurality of users of one or more social media services;

extracting, using a processor, a plurality of features from the plurality of social media messages, wherein each of the extracted features is associated with a user that authored a social media message comprising the extracted feature; and

determining that the extracted features are uncommon features when a count for each of the extracted features exceeds a first threshold and is less than a second threshold.

2. The method of claim 1, wherein the uncommon features are stored in a dataset of uncommon features, and an uncommon feature is removed from the dataset of uncommon features when another extracted feature is determined as an uncommon feature and a quantity of uncommon features stored in the dataset of uncommon features exceeds a third threshold.

3. The method of claim 1, wherein the one or more social media services comprise FACEBOOK or TWITTER.

4. The method of claim 1, wherein the plurality of social media messages are authored by a plurality of users of two or more social media services.

5. The method of claim 4, wherein the social media messages from the two or more social media services are reformatted into a common format before features are extracted.

6. The method of claim 1, wherein each of the extracted features is passed through a hashing algorithm to convert each of the extracted features into hash values.

7. A method for detecting coordinated social media activity, comprising:

providing a dataset comprising a plurality of uncommon features stored in a memory; and

determining, using a processor, a number of collisions for social media messages authored by two or more users, wherein each collision is detected as an uncommon feature from the plurality of uncommon features that is present in a message authored by each of the two or more users.

8. The method of claim 7, further comprising:

comparing user account information of the two or more users when their number of collisions exceeds a first threshold.

9. The method of claim 8, further comprising:

determining whether or not the two or more users are coordinated when a degree of similarity between their user account information exceeds a second threshold.

10. The method of claim 9, wherein the user account information comprises social media messages and user profile information.

11. The method of claim 7, further comprising:

determining a feature count for each of the plurality of uncommon features, wherein the feature count for each uncommon feature is incremented when the uncommon feature is detected in social media messages that are authored by more than one user.

12. The method of claim 11, wherein an uncommon feature is removed from the dataset comprising the plurality of uncommon features when a feature count for the uncommon feature exceeds a third threshold.

13. The method of claim 7, further comprising:

visualizing, on a display, a network graph that represents relationships between the two or more users, wherein nodes represent users and lines connecting nodes represent collisions between the users.

14. The method of claim 13, further comprising a histogram that shows different degrees of similarity between user account information.

15. The method of claim 7, wherein a hashing algorithm is applied on each detected collision to obtain a hash value.

16. A method for visualizing users that are suspected of engaging in coordinated activity in social media, comprising:

generating, on a display, a network graph of a plurality of users that are suspected of engaging in coordinated activity, wherein each node in the network graph represents a user and each line connecting nodes represents a quantity of features identified in social media messages that are authored by users represented by the nodes connected by each line.

17. The method of claim 16, further comprising:

changing a threshold value of a degree of similarity between the users that are represented by the nodes, wherein increasing the threshold value decreases a quantity of nodes in the network graph, and decreasing the threshold value increases the quantity of nodes in the network graph.

18. The method of claim 17, further comprising:

identifying users engaging in coordinated activity based on a quantity of nodes and their connecting lines in the network graph, and the threshold value.

19. A system for preparing a dataset of uncommon features, comprising:

a memory for storing a dataset comprising a plurality of social media messages, wherein the plurality of social media messages are authored by a plurality of users of one or more social media services; and

a processor for extracting a plurality of features from the plurality of social media messages, wherein each of the extracted features is associated with a user that authored a social media message comprising the extracted feature, and

for determining that the extracted features are uncommon features when a count for each of the extracted features exceeds a first threshold and is less than a second threshold.

20. The system of claim 19, wherein the uncommon features are stored in a dataset of uncommon features, and an uncommon feature is removed from the dataset of uncommon features when a quantity of uncommon features stored in the dataset of uncommon features exceeds a third threshold.

21. The system of claim 19, wherein the plurality of social media messages are authored by a plurality of users of two or more social media services that are configured to communicate with the plurality of users over the Internet.

22. A system for detecting coordinated social media activity, comprising:

a memory that stores a dataset comprising a plurality of uncommon features stored in a memory; and

a processor for determining a number of collisions for social media messages authored by two or more users, wherein each collision is detected as an uncommon feature from the plurality of uncommon features that is present in a message authored by each of the two or more users.

23. The system of claim 22, wherein the processor is configured to compare user account information of the two or more users when the number of collisions exceeds a first threshold.

24. The system of claim 23, wherein the processor is configured to determine whether or not the two or more users are coordinated when a degree of similarity between their user account information exceeds a second threshold.

25. The system of claim 23, wherein the user account information comprises social media messages and at least one of user profile information and metadata.