IP address based detection of spam account generation

• US 8,646,077 B1
• Filed: 12/28/2009
• Issued: 02/04/2014
• Est. Priority Date: 12/29/2008
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Shen, Honghai
• Primary Examiner(s): SHAW, YIN CHEN
• Application Number:
  US12/648,246
• Time in Patent Office: 1,499 Days
• Field of Search: 726/2, 726 22- 24, 709223-225, 709/206
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself

Abstract

A computer implemented method for detecting and preventing spam account generation is disclosed. Upon receiving an account creation request from a client, the server analyzes various types of data including past and current account creation information and data associated with the account creation request such as IP address, username, password, cookie, and response time. Based on the analysis result, the server assigns a spam score to the account creation request and compares the spam score with certain predefined thresholds. If the spam score is above a first threshold, the server may refuse the account creation request. If the spam score is within a certain range, the server may limit the access to the account associated with the account creation request. If the spam score is below a second threshold, the server may put no limit on access to (i.e., enable normal use of) the account.

Claims

1. A computer implemented method, comprising:

at a server having one or more processors and memory storing one or more programs executed by the one or more processors;

receiving an account creation request from an IP address;

determining a first count of accounts created in response to requests from the IP address during a first time period;

determining a second count of predefined account access operations by accounts created in response to prior account creation requests from the IP address during a second time period, wherein a higher second count represents a lower likelihood that an account created in response to the account creation request from the IP address will be used for sending spam;

associating a score, based at least in part on the first count and second count, with the account creation request; and

performing an action associated with the account creation request based at least in part on the score, wherein the action includes at least one of refusing the account creation request, modifying an account created in response to the account creation request, accepting the account creation request, and maintaining the account created in response to the account creation request.

2. The computer implemented method of claim 1, wherein performing an action associated with the account creation request based at least in part on the score includes modifying the account created in response to the account creation request, and wherein modifying the account created in response to the account creation request comprises an action selected from the group consisting of disabling the account and limiting account access.

3. The computer implemented method of claim 2, wherein modifying the account created in response to the account creation request comprises limiting account access and wherein limiting account access includes at least one of:

requiring a response to a human interaction proof for access to the account, limiting access time to the account, limiting use of account functions, and limiting transmission from the account.

4. The computer implemented method of claim 1, further comprising determining if the score meets a predetermined criterion, wherein performing the action includes determining the action to be performed in accordance with an outcome of the determination of whether the score meets the predefined criterion.

5. The computer implemented method of claim 1, wherein the predefined account access operations include logins to accounts by respective users.

6. The computer implemented method of claim 1, wherein the first time period and second time period are the same.

7. The computer implemented method of claim 1, wherein the first count is an average, over the first time period, of accounts created in response to requests from the IP address during each of a plurality of first time intervals, and wherein the first time period is longer than each of the first time intervals.

8. The computer implemented method of claim 1, wherein the first count is a weighted average of accounts created in response to requests from the IP address per time interval, during successive time intervals of the first time period, wherein a third count of accounts created in response to requests from the IP address during a recent time interval is accorded a higher weight than a fourth count of accounts created from the IP address during a less recent time interval.

9. The computer implemented method of claim 1, wherein the second count is a weighted average of account access operations associated with the IP address per time interval, during successive time intervals of the second time period, and wherein a fifth count of account access operations for accounts created during a recent time interval is accorded a lower weight than a sixth count of account access operations for accounts created during a less recent time interval.

10. The computer implemented method of claim 1, wherein the account creation request is associated with a username, the method further comprising:

determining a fifth count of accounts that are associated with usernames similar to the username associated with the account creation request, as determined in accordance with one or more predefined similarity rules, and that were created in response to requests from the IP address during a time interval; and

wherein the score is further based at least in part on the fifth count.

11. The computer implemented method of claim 10, wherein a respective similarity rule of the one or more predefined similarity rules identifies a respective username as being similar to the username associated with the account creation request when the respective username and the username associated with the account creation request have a common prefix or a common suffix.

12. The computer implemented method of claim 1, further comprising:

storing, in an index, a plurality of records associated with a plurality of IP addresses, each record including;

a count of user accounts associated with a respective IP address of the plurality of IP addresses, and

a unique identifier associated with each user account, wherein the IP address is in the plurality of IP addresses.

13. The computer implemented method of claim 1, further comprising:

storing, in a user account database, a plurality of records associated with a plurality of user accounts, each record for a respective user account in the plurality of user accounts and including;

a unique identifier associated with the respective user account,

an account request matrix storing information for one or more account requests associated with the respective user account, and

information regarding account access operations associated with the respective user account.

14. The computer implemented method of claim 13, wherein the account request matrix includes:

a unique request identifier for each account request associated with the respective user account,

user identification information associated with the respective user account, and

an IP address from which each account request associated with the respective user account was received.

15. The computer implemented method of claim 13, wherein associating the score further comprises:

determining at least one of an account creation distribution of user account creation requests associated with the IP address over time and an account access distribution of user account access operations associated with the IP address over time; and

assigning the score, based in part on the at least one of the account creation distribution and the account access distribution.

16. The computer implemented method of claim 15, further comprising:

accessing the user account request database to determine the at least one of the account creation distribution and the account access distribution.

17. A computer system, comprising:

one or more processors;

memory; and

one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including;

instructions for receiving an account creation request from an IP address;

instructions for determining a first count of accounts created in response to requests from the IP address during a first time period;

instructions for determining a second count of predefined account access operations by accounts created in response to prior account creation requests from the IP address during a second time period, wherein a higher second count represents a lower likelihood that an account created in response to the account creation request from the IP address will be used for sending spam;

instructions for associating a score, based at least in part on the first count and second count, with the account creation request; and

instructions for performing an action associated with the account creation request based at least in part on the score, wherein the action includes at least one of refusing the account creation request, modifying an account created in response to the account creation request, accepting the account creation request, and maintaining the account created in response to the account creation request.

19. The computer system of claim 17, wherein the action associated with the account creation request based at least in part on the score includes modifying the account created in response to the account creation request, and wherein modifying the account created in response to the account creation request comprises an action selected from the group consisting of:

disabling the account, and limiting account access.

18. A non-transitory computer readable storage medium and one or more computer programs embedded therein, the one or more computer programs comprising instructions, which when executed by a computer system, cause the computer system to:

receive an account creation request from an IP address;

determine a first count of accounts created in response to requests from the IP address during a first time period;

determine a second count of predefined account access operations by accounts created in response to prior account creation requests from the IP address during a second time period, wherein a higher second count represents a lower likelihood that an account created in response to the account creation request from the IP address will be used for sending spam;

associate a score, based at least in part on the first count and second count, with the account creation request; and

perform an action associated with the account creation request based at least in part on the score, wherein the action includes at least one of refusing the account creation request, modifying an account created in response to the account creation request, accepting the account creation request, and maintaining the account created in response to the account creation request.

20. The computer readable storage medium of claim 18, wherein the action associated with the account creation request based at least in part on the score includes modifying the account created in response to the account creation request, and wherein modifying the account created in response to the account creation request comprises an action selected from the group consisting of:

disabling the account, and limiting account access.