Detection and prevention of unwanted content on cloud-hosted services
View Patent ↗The problem of abuse of privileges at cloud-hosted service sites is addressed by associating each user, preferably across multiple cloud-hosted service sites, with an individual “suspiciousness” score that may vary over time as additional user actions are detected and evaluated. Knowledge of the user is employed to better analyze the appropriateness or acceptability of user actions on the site.
1. A method, comprising:
creating, by one or more computing devices, a database record for a first user, the database record including a plurality of profile fields and data in at least one of the profile fields;
assigning, by the one or more computing devices, an initial risk score to the first user based on the data in the at least one of the profile fields;
identifying, by the one or more computing devices, a cluster of second users based on the similarities of database records associated with the second users and the database record for the first user;
assigning, by the one or more computing devices, a cluster-based score to the first user, the cluster-based score associated with the cluster of the second users and indicating a receptiveness to an advertisement; and
taking, by the one or more computing devices, an action to the first user based on the initial risk score and the cluster-based score of the first user.
2. The method of claim 1 , wherein the taking the action to the first user further comprises taking the action to an activity conducted by the first user.
3. The method of claim 2 , wherein the action is further based on an activity-level risk score.
4. The method of claim 3 , wherein the activity-level risk score is based on characteristics of the activity.
5. The method of claim 1 , wherein the action is blocking the first user.
6. The method of claim 1 , wherein the plurality of profile fields comprise at least one of a username, a geographical location of the first user, and a prior action associated with the first user's computing device.
7. The method of claim 1 , wherein the initial risk score is based at least in part on a probability that a username was computationally generated.
8. A computer program product comprising a non-transitory computer useable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to:
create a database record for a first user, the database record including a plurality of profile fields and data in at least one of the profile fields;
assign an initial risk score to the first user based on the data in the at least one of the profile fields;
identify a cluster of second users based on the similarities of database records associated with the second users and the database record for the first user;
assign a cluster-based score to the first user, the cluster-based score associated with the cluster of the second users and indicating a receptiveness to an advertisement; and
take an action to the first user based on the initial risk score and the cluster-based score of the first user.
9. The computer program product of claim 8 , wherein the take the action to the first user further comprises take the action to an activity conducted by the first user.
10. The computer program product of claim 9 , wherein the action is further based on an activity-level risk score.
11. The computer program product of claim 10 , wherein the activity-level risk score is based on characteristics of the activity.
12. The computer program product of claim 8 , wherein the action is blocking the first user.
13. The computer program product of claim 8 , wherein the plurality of profile fields comprise at least one of a username, a geographical location of the first user, and a prior action associated with the first user's computing device.
14. The computer program product of claim 8 , wherein the initial risk score is based at least in part on a probability that a username was computationally generated.
15. A system comprising
one or more processors; and
a memory storing instructions that, when executed, cause the system to:
create a database record for a first user, the database record including a plurality of profile fields and data in at least one of the profile fields;
assign an initial risk score to the first user based on the data in the at least one of the profile fields;
identify a cluster of second users based on the similarities of database records associated with the second users and the database record for the first user;
assign a cluster-based score to the first user, the cluster-based score associated with the cluster of the second users and indicating a receptiveness to an advertisement; and
take an action to the first user based on the initial risk score and the cluster-based score of the first user.
16. The system of claim 15 , wherein the take the action to the first user further comprises take the action to an activity conducted by the first user.
17. The system of claim 16 , wherein the action is further based on an activity-level risk score.
18. The system of claim 17 , wherein the activity-level risk score is based on characteristics of the activity.
19. The system of claim 15 , wherein the action is blocking the first user.
20. The system of claim 15 , wherein the plurality of profile fields comprise at least one of a username, a geographical location of the first user, and a prior action associated with the first user's computing device.
21. The system of claim 15 , wherein the initial risk score is based at least in part on a probability that a username was computationally generated.