Systems and Methods for Detecting Spam
In one embodiment, a method includes a social-networking system receiving requests from client devices of a plurality of users to perform user actions. The system may determine that a first user action of the user actions performed by a first user of the plurality of users is undesirable. The system may access user information associated with the first user and action information associated with the first user action. A first signature associated with the first user may be generated based on the user information and the action information. The system may compare the first signature with signatures associated with user actions performed on the social-networking system to identify a set of matching user actions. The set of matching user actions may be labeled as being undesirable. A machine-learning model may be trained using information associated with the set of matching user actions.
1 . A method, comprising:
by a computing system, receiving requests from client devices of a plurality of users to perform user actions;
by the computing system, determining that a first user action of the user actions performed by a first user of the plurality of users is undesirable;
by the computing system, accessing user information associated with the first user and action information associated with the first user action, the action information comprising information associated with:
the request for performing the first user action;
a network communication protocol used for transmitting that request; and
one or more timestamps associated to the user action denoting a time over which the user action occurred;
by the computing system, generating a first signature associated with the first user based on the information associated with the first user and the action information associated with the first user action;
by the computing system, comparing the first signature with signatures associated with a plurality of user actions performed by other users to identify a set of matching user actions selected from the plurality of user actions, wherein the plurality of other user actions occur after the time of the signature of the first user action; and
by the computing system, labeling the set of matching user actions as being undesirable.
2 . The method of claim 1 , wherein the action information associated with the first user action comprises information associated with other user actions performed by the first user.
3 . The method of claim 1 , wherein the determining that the first user action is undesirable is based on activity patterns of the first user.
4 . The method of claim 1 , wherein the information associated with the first user comprises: a country from which the first user transmitted the request for the first user action, system information of the client device used by the first user, or network address of the client device.
5 . The method of claim 1 , wherein the information associated with the request for performing the first user action comprises metadata associated with an HTTP request.
6 . The method of claim 1 , wherein the network communication protocol comprises an encryption protocol.
7 . The method of claim 1 , further comprising:
after a time period since the determination that the first user action is undesirable, performing remediation action associated with the first user;
wherein the time period is determined based on a predetermined timing scheme.
8 . The method of claim 1 , further comprising:
by the computing system, monitoring additional actions associated with the set of matching user actions.
9 . The method of claim 8 , wherein the additional actions comprise an additional action performed by a user who performed one of the matching user actions.
10 . The method of claim 8 , wherein the additional actions comprise an action performed in response to one of the matching user actions.
11 . The method of claim 1 , further comprising:
by the computing system, receiving a second request to perform a second user action;
by the computing system, determining that the second user action is undesirable;
by the computing system, generating a second signature associated with the second user action;
by the computing system, determining that the second signature matches the first signature; and
by the computing system, based on the determination that the second user action is undesirable and the determination that the second signature matches the first signature, reporting the second user action as being undesirable.
12 . The method of claim 1 , further comprising:
by the computing system, receiving a second request to perform a second user action;
by the computing system, determining that the second user action is undesirable;
by the computing system, generating a second signature associated with the second user action;
by the computing system, determining that the second signature matches the first signature; and
by the computing system, based on the determination that the second user action is undesirable and the determination that the second signature matches the first signature, performing one or more remediation actions.
13 . The method of claim 12 , wherein the one or more remediation actions comprise: removing content associated with the second user action from being published, requesting a second user associated with the second user action to change a password, or requesting the second user associated with the second user action to respond to an authentication question.
14 . The method of claim 12 , further comprising:
by the computing system, determining a rate at which content associated with the second user action is viewed or responded to by other users;
wherein the performing of the one or more remediation actions is prioritized against other remediation actions based on the determined rate.
15 . The method of claim 1 , further comprising:
by the computing system, training a machine-learning model using information associated with the set of matching user actions, wherein the machine-learning model is trained to predict whether a given user action is undesirable.
16 . One or more computer-readable non-transitory storage media comprising software that is operable when executed by a computer system to:
receive requests from client devices of a plurality of users to perform user actions;
determine that a first user action of the user actions performed by a first user of the plurality of users is undesirable;
access user information associated with the first user and action information associated with the first user action, the action information comprising information associated with:
the request for performing the first user action;
a network communication protocol used for transmitting that request; and
one or more timestamps associated to the user action denoting a time over which the user action occurred;
generate a first signature associated with the first user based on the information associated with the first user and the action information associated with the first user action;
compare the first signature with signatures associated with a plurality of user actions performed by other users to identify a set of matching user actions selected from the plurality of user actions, wherein the plurality of other user actions occur after the time of the signature of the first user action; and
label the set of matching user actions as being undesirable.
17 . The media of claim 16 , wherein the information associated with the request for performing the first user action comprises metadata associated with an HTTP request.
18 . The media of claim 16 , wherein the network communication protocol comprises an encryption protocol.
19 . A system comprising:
one or more processors; and
one or more computer-readable non-transitory storage media coupled to one or more of the processors and comprising instructions operable when executed by one or more of the processors to cause the system to:
receive requests from client devices of a plurality of users to perform user actions;
determine that a first user action of the user actions performed by a first user of the plurality of users is undesirable;
access user information associated with the first user and action information associated with the first user action, the action information comprising information associated with:
the request for performing the first user action;
a network communication protocol used for transmitting that request; and
one or more timestamps associated to the user action denoting a time over which the user action occurred;
generate a first signature associated with the first user based on the information associated with the first user and the action information associated with the first user action;
compare the first signature with signatures associated with a plurality of user actions performed by other users to identify a set of matching user actions selected from the plurality of user actions, wherein the plurality of other user actions occur after the time of the signature of the first user action; and
label the set of matching user actions as being undesirable.
20 . The system of claim 19 , wherein the information associated with the request for performing the first user action comprises metadata associated with an HTTP request.