PROTECTING AGAINST SUSPECT SOCIAL ENTITIES

• US 20140325662A1
• Filed: 07/09/2014
• Published: 10/30/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: ZeroFOX, Inc. (ZeroFox Holdings, Inc.)
• Original Assignee: ZeroFOX, Inc. (ZeroFox Holdings, Inc.)
• Inventors: Foster, James C., Francis, Robert, Blair, Evan, Cullison, Christopher B.
• Granted Patent: US 9,191,411 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method includes identifying data on a social network that is associated with a suspect social entity, and determining one or more characteristics of the identified data. A reference to the identified data is generated for each of the one or more characteristics. One or more of the generated references are compared to one or more stored references, where the one or more stored references are associated with a protected social entity. A profile score for the suspect social entity is determined based on the comparison. Determining the profile score includes identifying a match between one or more of the generated references and one or more of the stored references.

Claims

1. A method comprising:

identifying, by one or more processors, data on a social network that is associated with a suspect social entity;

determining one or more characteristics of the identified data;

generating, for each of the one or more characteristics, a reference to the identified data;

comparing one or more of the generated references to one or more stored references, wherein the one or more stored references are associated with a protected social entity;

determining, based on the comparison, a profile score for the suspect social entity, wherein determining the profile score comprises identifying a match between one or more of the generated references and one or more of the stored references.

2. The method of claim 1 wherein the social entity is an imposter of the protected social entity.

3. The method of claim 1 further comprising:

comparing the profile score for the suspect social entity to a threshold; and

initiating a security action if the profile score exceeds the threshold.

4. The method of claim 3 wherein initiating the security action comprises:

generating an alert; and

providing the alert to the protected social entity.

5. The method of claim 4 wherein the alert identifies the suspect social entity.

6. The method of claim 4 wherein providing the alert to the protected social entity comprises providing a computer-based alert to the protected social entity.

7. The method of claim 6 wherein providing a computer-based alert to the protected social entity comprises emailing the protected social entity.

8. The method of claim 6 wherein providing a computer-based alert to the protected social entity comprises providing a web-based alert to the protected social entity.

9. The method of claim 4 wherein the alert indicates fraud, impersonation, or social engineering.

10. The method of claim 1, wherein the one or more characteristics of the data are selected from the group consisting of name, date of birth, gender, location, email address, education, and organization.

11. The method of claim 1, wherein the one or more characteristics include an image, and wherein generating a reference to the image comprises deriving data from the image.

12. The method of claim 11, wherein deriving data from the image comprises hashing the image for comparison.

13. The method of claim 11, wherein deriving data from the image comprises determining one or more facial characteristics of an individual included in the image.

14. A system comprising:

one or more processing devices; and

one or more non-transitory computer-readable media coupled to the one or more processing devices having instructions stored thereon which, when executed by the one or more processing devices, cause the one or more processing devices to perform operations comprising;

identifying, by one or more processors, data on a social network that is associated with a suspect social entity;

determining one or more characteristics of the identified data;

generating, for each of the one or more characteristics, a reference to the identified data;

comparing one or more of the generated references to one or more stored references, wherein the one or more stored references are associated with a protected social entity;

determining, based on the comparison, a profile score for the suspect social entity, wherein determining the profile score comprises identifying a match between one or more of the generated references and one or more of the stored references.

15. The system of claim 14 wherein the social entity is an imposter of the protected social entity.

16. The system of claim 14 further comprising:

comparing the profile score for the suspect social entity to a threshold; and

initiating a security action if the profile score exceeds the threshold.

17. The system of claim 16 wherein initiating the security action comprises:

generating an alert; and

providing the alert to the protected social entity.

18. The system of claim 17 wherein the alert identifies the suspect social entity.

19. The system of claim 17 wherein providing the alert to the protected social entity comprises providing a computer-based alert to the protected social entity.

20. The system of claim of 19 wherein providing the alert to the protected social entity comprises emailing the protected social entity.

21. The system of claim 19 wherein providing computer-based alerts to the protected social entity comprises providing a web-based alert to the protected social entity.

22. The system of claim 17 wherein the alert indicates fraud, impersonation, or social engineering.

23. The system of claim 14, wherein the one or more characteristics of the data are selected from the group consisting of name, date of birth, gender, location, email address, education, and organization.

24. The system of claim 14, wherein the one or more characteristics include an image, and wherein generating a reference to the image comprises deriving data from the image.

25. The system of claim 24, wherein deriving data from the image comprises hashing the image.

26. The system of claim 24, wherein deriving data from the image comprises determining one or more facial characteristics of an individual included in the image.

27. A non-transitory computer-readable storage device encoded with a computer program, the program comprising instructions that when executed by a data processing apparatus cause the data processing apparatus to perform operations comprising:

identifying, by one or more processors, data on a social network that is associated with a suspect social entity;

determining one or more characteristics of the identified data;

generating, for each of the one or more characteristics, a reference to the identified data;

comparing one or more of the generated references to one or more stored references, wherein the one or more stored references are associated with a protected social entity;

determining, based on the comparison, a profile score for the suspect social entity, wherein determining the profile score comprises identifying a match between one or more of the generated references and one or more of the stored references.