Back to results
US 11,637,848 B2Granted
Level of network suspicion detection
AssigneeSnap Inc.
InventorsNeil Shah, Hamed Nilforoshan-Dardashti
Life of this patent
Estimating the term…
Abstract
Systems, devices, media, and methods are presented for determining a level of abusive network behavior suspicion for groups of entities and for identifying suspicious entity groups. A suspiciousness metric is developed and used to evaluate a multi-view graph across multiple views where entities are associated with nodes of the graph and attributes of the entities are associated with levels of the graph.
Claims20
A method for detecting suspicious groups of entities from a dataset of entity and entity attribute information, the method comprising:
- receiving, at a processor, entity identifiers and attribute identifiers associated with entities;
- generating, by the processor, a multi-view graph from the dataset of entity and entity attribute information using the entity identifiers and the attribute identifiers, each node of the multi-view graph corresponding to a respective one of the entity identifiers, each view of the multi-view graph corresponding to a respective one of the attribute identifiers, and each edge between the nodes of a respective view having an edge weight corresponding to attribute value overlap between those nodes in that view;
- repeating, by the processor, the following steps until a predetermined constraint is met:
- identifying, by the processor, a multi-view subgraph within the multi-view graph, the multi-view subgraph including more than one view for the group of entities,
- determining, by the processor, the level of suspicion of the multi-view subgraph,
- revising, by the processor, the multi-view subgraph by adding or subtracting at least one of an entity or a level,
- determining, by the processor, the level of suspicion of the revised multi-view subgraph,
- when the level of suspicion of the revised multi-view subgraph exceeds the level of suspicion of the multi-view subgraph, repeating, by the processor, the revising of the multi-view subgraph and determining the level of suspicion of the revised multi-view subgraph, and
- when the level of suspicion of the revised multi-view subgraph does not exceed the level of suspicion of the multi-view subgraph, recording, by the processor, an identifier and a level of suspicion for a most-recent revised multi-view subgraph;
- and
- presenting, by the processor, recorded identifiers and corresponding levels of suspicion on a display as the suspicious group of entities.
8 more elements
A system for detecting suspicious groups of entities from a dataset of entity and entity attribute information, the system comprising:
- a memory that stores instructions;
- and
- a processor configured by the instructions to perform operations comprising:
- receiving entity identifiers and attribute identifiers associated with entities;
- generating a multi-view graph from the dataset of entity and entity attribute information using the entity identifiers and the attribute identifiers, each node of the multi-view graph corresponding to a respective one of the entity identifiers, each view of the multi-view graph corresponding to a respective one of the attribute identifiers, and each edge between the nodes of a respective view having an edge weight corresponding to attribute value overlap between those nodes in that view;
- repeating the following steps until a predetermined constraint is met:
- identifying a multi-view subgraph within the multi-view graph, the multi-view subgraph including more than one view for the group of entities,
- determining the level of suspicion of the multi-view subgraph,
- revising the multi-view subgraph by adding or subtracting at least one of an entity or a level,
- determining the level of suspicion of the revised multi-view subgraph,
- when the level of suspicion of the revised multi-view subgraph exceeds the level of suspicion of the multi-view subgraph, repeating the revising of the multi-view subgraph and determining the level of suspicion of the revised multi-view subgraph, and
- when the level of suspicion of the revised multi-view subgraph does not exceed the level of suspicion of the multi-view subgraph, recording an identifier and a level of suspicion for a most-recent revised multi-view subgraph;
- and
- presenting recorded identifiers and corresponding levels of suspicion on a display as the suspicious group of entities.
11 more elements
A non-transitory processor-readable storage medium storing processor-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations for detecting suspicious groups of entities from a dataset of entity and entity attribute information, the operations comprising:
- receiving entity identifiers and attribute identifiers associated with entities;
- generating a multi-view graph from the dataset of entity and entity attribute information using the entity identifiers and the attribute identifiers, each node of the multi-view graph corresponding to a respective one of the entity identifiers, each view of the multi-view graph corresponding to a respective one of the attribute identifiers, and each edge between the nodes of a respective view having an edge weight corresponding to attribute value overlap between those nodes in that view;
- repeating the following steps until a predetermined constraint is met:
- identifying a multi-view subgraph within the multi-view graph, the multi-view subgraph including more than one view for the group of entities,
- determining the level of suspicion of the multi-view subgraph,
- revising the multi-view subgraph by adding or subtracting at least one of an entity or a level,
- determining the level of suspicion of the revised multi-view subgraph,
- when the level of suspicion of the revised multi-view subgraph exceeds the level of suspicion of the multi-view subgraph, repeating the revising of the multi-view subgraph and determining the level of suspicion of the revised multi-view subgraph, and
- when the level of suspicion of the revised multi-view subgraph does not exceed the level of suspicion of the multi-view subgraph, recording an identifier and a level of suspicion for a most-recent revised multi-view subgraph;
- and
- presenting recorded identifiers and corresponding levels of suspicion on a display as the suspicious group of entities.
8 more elements
Dependencies are inferred from the claim text.