Detecting spam events in event management systems
In one embodiment, a method includes accessing event information and payment information associated with an event listing on an event management system, and calculating a spam risk score for the event listing.
1. A method comprising, by one or more computing devices:
accessing event information associated with a first event listing of an online event management system, wherein the online event management system is operable to register one or more attendees for an event corresponding to the first event listing, and wherein the event is associated with a first event organizer account;
accessing information identifying one or more remote hosts associated with the first event organizer account, each remote host being external to the online event management system;
identifying one or more second event organizer accounts based on the one or more identified remote hosts, wherein each of the identified second event organizer accounts is associated with at least one of the remote hosts associated with the first event organizer account; and
calculating by a spam-detection model a spam risk score for the first event listing based at least in part on a pattern of behavior associated with the first event organizer account and the one or more second event organizer accounts.
2. The method of claim 1 further comprising
identifying one or more second event listings created with the one or more second event organizer accounts; and wherein the spam risk score is calculated based further on the one or more second event listings.
3. The method of claim 1 wherein the event information comprises a number of hypertext links in the first event listing.
4. The method of claim 1 wherein the pattern of behavior comprises an observed timing of creation of the first event organizer account and the one or more second event organizer accounts.
5. The method of claim 1 wherein the pattern of behavior comprises an observed timing of creation of the first event organizer account and an event creation rate for the first event organizer account.
6. The method of claim 1 wherein calculating the spam risk score for the first event listing is further based on a geographic location associated with the first event organizer account.
7. The method of claim 1 wherein the information identifying the one or more remote hosts is an Internet Protocol (IP) address.
8. The method of claim 1 wherein the information identifying the one or more remote hosts is a hardware signature.
9. The method of claim 1 further comprising
deactivating the first event listing if the calculated spam risk score for the first event listing is greater than a threshold score.
10. The method of claim 9 wherein deactivating the event listing comprises disabling registration for the event.
11. The method of claim 9 wherein deactivating the event listing comprises deleting the event listing.
12. The method of claim 9 wherein deactivating the event listing comprises disabling access to the event listing for users of the online event management system.
13. The method of claim 1 wherein calculating the spam risk score for the first event listing is further based on the event information of the first event listing.
14. The method of claim 1 wherein calculating the spam risk score for the first event listing is further based on the account information of the first event organizer account and the one or more second event organizer accounts.
15. The method of claim 14 wherein the account information of an event organizer account comprises a history of events that the corresponding user has attended or registered to attend.
16. The method of claim 1 wherein the spam risk score represents a probability that the first event listing is spam.
17. The method of claim 1 wherein the spam risk score represents the rank of the risk of spam associated with the first event listing in relation to other event listings.
18. The method of claim 1 further comprising generating the spam-detection model using a regression-based M5P algorithm that is trained by a data set of selected factors, wherein one or more of the factors includes variable thresholds.
19. An apparatus comprising: one or more processors; and a memory coupled to the processors comprising instructions executable by the processors, the processors operable when executing the instructions to:
access event information associated with a first event listing of an online event management system, wherein the online event management system is operable to register one or more attendees for an event corresponding to the first event listing, and wherein the event is associated with a first event organizer account;
access information identifying one or more remote hosts associated with the first event organizer account, each remote host being external to the online event management system;
identify one or more second event organizer accounts based on the one or more identified remote hosts, wherein each of the identified second event organizer accounts is associated with at least one of the remote hosts associated with the first event organizer account; and
calculate by a spam-detection model a spam risk score for the first event listing based at least in part on a pattern of behavior associated with the first event organizer account and the one or more second event organizer accounts.
20. One or more computer-readable non-transitory storage media embodying instructions that are operable when executed to cause one or more processors to:
access event information associated with a first event listing of an online event management system, wherein the online event management system is operable to register one or more attendees for an event corresponding to the first event listing, and wherein the event is associated with a first event organizer account;
access information identifying one or more remote hosts associated with the first event organizer account, each remote host being external to the online event management system;
identify one or more second event organizer accounts based on the one or more identified remote hosts, wherein each of the identified second event organizer accounts is associated with at least one of the remote hosts associated with the first event organizer account; and
calculate by a spam-detection model a spam risk score for the first event listing based at least in part on a pattern of behavior associated with the first event organizer account and the one or more second event organizer accounts.