Differentiating between good and bad content in a user-provided content system

#This invention relates to differentiating between good content and bad content in a user-provided content system based on features identified in the content.

#Systems allow users to interact with each other by sending messages to each other. For example, a social networking system allows users of the social networking system to interact with other users via status updates, wall posts, or private messages. Messages comprise data, which represents the content of the messages, and metadata, which represents information describing the messages. The data sent in a message is also called content, and the system that allows users to send messages is called a user-provided content system. Metadata associated with a message can comprise information describing the sender of the message, the recipient of the message, attributes of an interface used to send the message, attachments to the message, a level of urgency or importance of the message, and the like. Some messages are intended to be private messages delivered to either one recipient or a small set of recipients whereas other messages are broadcast messages intended for a large number of recipients. For example, a wall post message in a social networking system can be accessed by all friends of the recipient in the social networking system or even friends of the friends of the recipient subject to the privacy settings of the users.

#Messages allow a user to send information to other users. For example, a user aware of an event may send information describing the event to other users. Similarly a user can share an interesting webpage with other users by sending them the uniform resource locator (URL) of the webpage in a message. A user may share an interesting document with other users by sending the document as an attachment to a message. A user may share an application with other users by sending an executable file of the application as an attachment to a message.

#FIG. 1 is a diagram illustrating overall system environment for determining whether incoming messages are indicative of good or bad content, in accordance with an embodiment of the invention.

#FIG. 2 illustrates a spike in a feature as determined by an increase in frequency of occurrences of the feature in messages, in accordance with an embodiment of the invention.

#FIG. 3 illustrates the system architecture for determining whether incoming messages are indicative of good or bad content, in accordance with an embodiment of the invention.

#The figures depict various embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein.

#A message comprises data or content sent with the message as well as metadata associated with the message. Metadata associated with the message can comprise information associated with the sender and receiver, time the message is sent or received, annotations associated with the message including a level of urgency, level of importance, security information and the like. The information associated with a message can be analyzed to determine features of the message. A feature is a property of one or more messages that characterizes the messages and distinguishes them from messages that lack the feature. A feature can be a portion of information associated with a message. A feature can be a pattern that occurs in information associated with messages. Examples of features of message include a particular string or a regular expression that is part of the message, an internet protocol (IP) address associated with a sender of a message, a time of transmission of the message, and the like. Some messages include a particular URL string as part of the message that can be considered a feature. For example, a user can send invitations to an event by sending messages that contain URL of a website describing the event. A number of messages may be sent from a computing device with a particular IP address. Examples of features in these messages include the IP address of the sender, the netblock of the sender, the settings of the computer or application used for sending the messages and the like. A number of messages may be sent by one or more computers in a short time interval. The interval of time during which these messages are sent is a feature occurring in these messages. In an embodiment, a short time interval is a time interval that has a length below a threshold value.

#Messages sent within a particular time interval can be analyzed to determine a frequency of occurrence of the feature in messages. A histogram can be generated for different features based on the number of occurrences of each feature in messages sent during a time interval. For example, in a particular time interval a number of messages may be sent containing a specific universal resource locator (URL). The changes in the frequency of messages associated with a feature are analyzed over time. A sudden increase in the occurrences of a feature in a given time interval is identified as a spike in the feature. A feature that is associated with a spike is considered a suspicious feature and is further analyzed to determine whether the feature is indicative of bad content or good content in messages.