Detecting compromised social media accounts by analyzing affinity groups

A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computing device to cause the computing device to:

• receive social media content corresponding to a plurality of social media accounts across a plurality of social media networks;
• determine a plurality of affinity groups based upon the received social media content;
• determine whether or not a particular social media account of the plurality of social media accounts is compromised using the received social media content and the determined plurality of affinity groups, by determining a score for a new post made by the particular social media account based on a correlation with posts made by other social media accounts that are members of one or more same affinity groups as the particular social media account, wherein the score represents a likelihood of the new post having been made by an owner of the particular social media account;
• and
• in response to determining that the particular social media account is compromised, based on the score being lower than a predetermined threshold, provide a notification indicating that the particular social media account is compromised.

A system comprising:

• a hardware processor, a computer readable memory, and a computer readable storage medium associated with a computer device;
• program instructions of a social media content receiver configured to receive social media content corresponding to a plurality of social media accounts across a plurality of social media networks;
• program instructions of an affinity group determiner configured to determine a plurality of affinity groups, each including two or more social media accounts from the plurality of social media accounts, based upon the received social media content;
• and
• program instructions of a compromised account determiner configured to determine whether or not a particular social media account of the plurality of social media accounts is compromised using the received social media content and the determined plurality of affinity groups, by determining a score for a new post made by the particular social media account based on a correlation with posts made by other social media accounts that are members of one or more same affinity groups as the particular social media account, wherein the score represents a likelihood of the new post having been made by an owner of the particular social media account,
• wherein the compromised account determiner, in response to determining that the particular social media account is compromised, based on the score being lower than a predetermined threshold, is configured to provide a notification indicating that the particular social media account is compromised.