Prevention of coalition attacks in social network communities

• US 9,514,494 B2
• Filed: 08/23/2012
• Issued: 12/06/2016
• Est. Priority Date: 08/23/2012
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Bezzi, Michele, Trabelsi, Slim, Montagnon, Gilles
• Primary Examiner(s): Chan, Wing F
• Assistant Examiner(s): WOO, ANDREW M
• Application Number:
  US13/593,179
• Publication Number:
  US 20140059203A1
• Time in Patent Office: 1,566 Days
• Field of Search: 709/223, 709/224
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 50/01 Social networking

Abstract

A report handler may receive abuse reports from reporters alleging policy violations of network use policies by at least one potential victim, and a source analyzer may determine at least one subset of the reporters. A content analyzer may determine a reference to the at least one potential victim in network activities of the at least one subset, and a review requester may generate a notification of a potential coalition attack against the at least one potential victim, based on the reference in the context of the at least one subset.

Claims

1. A system comprising:

at least one processor;

a non-transitory computer readable medium having executable instructions configured to cause the at least one processor to implement;

an abuse report manager configured to cause the at least one processor to monitor a social network for a potential coalition attack against a user of the social network, the potential coalition attack being a potential attack on the user of the social network in which reporters submit abuse reports for purposes of censoring or inconveniencing the user of the social network, the abuse report manager including,

a report handler configured to cause the at least one processor to receive a number of plurality of abuse reports from a number of reporters alleging policy violations of network use policies by the user of the social network, and to determine that the number of plurality of abuse reports exceed a first predetermined threshold;

a source analyzer configured to cause the at least one processor to determine that two or more of the number of reporters share a common interest by analyzing a profiles repository to determine whether the two or more of the number of reporters belong to a same group,

the source analyzer configured to cause the at least one processor to determine whether the number of the reporters belonging to the same group is above a second predetermined threshold;

a content analyzer configured to cause the at least one processor to determine a reference to the user of the social network by analyzing social media content posted by the number of reporters belonging to the same group to determine whether the reference to the user of the social network is contained within a discussion forum that is restricted to group members of the same group; and

a review requester configured to cause the at least one processor to determine whether or not the user of the social network is subject to the potential coalition attack based on the determination that the number of the reporters belonging to the same group is above the second pre-determined threshold and the determination that the reference to the user of the social network is included within the discussion forum of the same group,

the review requester configured to cause the at least one processor to generate a notification of the potential coalition attack against the user of the social network.

2. The system of claim 1, wherein the number of reporters sharing the common interest are social media users visiting a common page.

3. The system of claim 1, wherein the content analyzer is configured to determine the reference as including a uniform resource identifier (URI) identifying the user of the social network.

4. The system of claim 1, wherein the content analyzer is configured to determine the reference to the user of the social network as including content identifying the user of the social network.

5. The system of claim 1, wherein the review requester is configured to generate the notification for transmission thereof to an administrator of the network use policies.

6. The system of claim 1, wherein the review requester is configured to determine that the potential coalition attack is not an actual coalition attack, and is further configured to penalize the user of the social network in accordance with the network use policy.

7. The system of claim 1, wherein the review requester is configured to determine that the potential coalition attack is an actual coalition attack, and further configured to identify the number of reporters involved as having participated therein.

8. A computer-implemented method for causing at least one processor to execute instructions recorded on a computer-readable storage medium, the method comprising:

monitoring a social network for a potential coalition attack against a user of the social network, the potential coalition attack being a potential attack on the user of the social network in which reporters submit abuse reports for purposes of censoring or inconveniencing the user of the social network;

receiving a number of the abuse reports from a number of the reporters alleging policy violations of network use policies by the user, wherein the number of the abuse reports pertaining to the user of the social network exceeds a first predetermined threshold number;

analyzing the number of abuse reports from the number of the reporters and profiles of the number of reporters to determine whether a relationship exists among two or more of the number of the reporters by analyzing a profiles repository to determine whether two or more of the number of the reporters belong to a same group;

determining whether the number of the reporters belonging to the same group is above a second predetermined threshold;

analyzing social media content posted by the two or more of the number of the reporters belonging to the same group to determine whether a reference to the user of the social network is contained within a discussion forum that is restricted to group members of the same group;

determining whether or not the potential victim is subject to the potential coalition attack based on the determination that the reference to the user of the social network is contained within the discussion forum of the same group and the determination that the number of the reporters belonging to the same group is above the second predetermined threshold; and

generating a notification when the potential victim is subject to the potential coalition attack.

9. The method of claim 8, wherein the relationship indicates at least one commonality between the two or more of the number of the reporters.

10. The method of claim 8, wherein the reference to the user includes a uniform resource identifier (URI) identifying the user of the social network associated with the social media content posted by the two or more of the number of the reporters.

11. A computer program product, the computer program product being tangibly embodied on a non-transitory computer-readable medium and comprising instructions that, when executed, are configured to cause at least one processor to:

monitor a social network for a potential coalition attack against a user of the social network, the potential coalition attack being a potential attack on the user of the social network in which reporters submit abuse reports for purposes of censoring or inconveniencing the user of the social network;

receive a number of the abuse reports from a number of the reporters alleging policy violations of network use policies by the user, and determine that the number of the abuse reports exceeds a first predetermined threshold;

analyze the number of the abuse reports of the number of the reporters and profiles of the number of the reporters to determine whether two or more of the number of the reporters are members of a same group based on one or more group profiles stored in a profiles repository;

determine whether the number of the reporters belonging to the same group is above a second predetermined threshold;

analyze social media content posted by the members of the same group to determine whether or not a reference to the user of the social network is contained within a discussion forum that is restricted to the members of the same group; and

generate a notification of the potential coalition attack against the user of the social network based on the determination that the number of the reporters belonging to the group is above the second pre-determined threshold and the determination that the reference to the user of the social network is contained within the discussion forum to the members of the same group.

12. The computer program product of claim 11, wherein the instructions, when executed, are further configured to cause the at least one processor to:

determine that the two or more of the number of the reporters are members of the same group when at least one commonality exists between the two or more of the number of the reporters.

13. The computer program product of claim 11, wherein the instructions, when executed, are further configured to cause the at least one processor to:

generate the notification for transmission thereof to an administrator of the network use policies.