Identifying related user accounts based on authentication data
View Patent ↗In some embodiments, upon detecting malicious activity associated with a user account, a content management system can identify other user accounts related to the malicious user account. The content management system can identify related user accounts by comparing authentication information collected for the malicious user account with authentication information collected for other user accounts. Authentication information can include IP address information, geographic information, device type, browser type, email addresses, and/or referral information, for example. The content management system can compare the content items associated with the malicious user account to content items associated with other user accounts to determine relatedness or maliciousness. After identifying related malicious user accounts, the content management system can block all related malicious user accounts.
1. A computer-implemented method comprising:
scanning, by a content management system, one or more content items stored in one or more databases associated with the content management system, the one or more content items associated with a first user account;
identifying, by the content management system, within the one or more content items, a subset of content items comprising suspicious content;
in response to identifying the subset of content items, identifying, by the content management system, that at least one second user account is related to the first user account based on at least authentication data associated with the first user account and authentication data associated with the second user account, wherein the first user account and the at least one second user account are accessed via a common client device; and
blocking access to the first user account and the at least one second user account on the content management system.
2. The computer-implemented method of claim 1 , wherein identifying, by the content management system, that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
identifying that the second user account is related to the first user account based on at least a portion of a first internet protocol (IP) address associated with the first user account at least partially matches a second IP address associated with the second user account.
3. The computer-implemented method of claim 1 , wherein identifying, by the content management system, that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
identifying that the second user account is related to the first user account based on a common string pattern in a first user account email address and a second user account email address.
4. The computer-implemented method of claim 1 , wherein identifying, by the content management system, that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
generating a hash value for each content item in the subset of content items;
generating one or more second hash values for one or more second content items associated with the second user account; and
identifying a match between the hash value and at least one of the one or more second hash values.
5. The computer-implemented method of claim 1 , wherein identifying, by the content management system, that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
determining a first user device corresponding to the first user account, the first user device comprising first user device type information;
determining a second user device corresponding to the second user account, the second user device comprising second user device type information; and
identifying at least a partial match between the first user device type information and the second user device type information.
6. The computer-implemented method of claim 1 , wherein the authentication data associated with the first account comprises one or more of email address, IP address, geographic region, device type, browser type, or referral information.
7. A system, comprising:
one or more processors; and
a memory having programming instructions stored thereon, which, when executed by the one or more processors, performs one or more operations comprising:
scanning one or more content items stored in one or more databases associated with the system, the one or more content items associated with a first user account;
identifying, within the one or more content items, a subset of content items comprising suspicious content;
in response to identifying the subset of content items, identifying that at least one second user account is related to the first user account based on at least authentication data associated with the first user account and authentication data associated with the second user account, wherein the first user account and the at least one second user account are accessed via a common client device; and
initiating remedial action with respect to the first user account and the at least one second user.
8. The system of claim 7 , wherein identifying that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
identifying that the second user account is related to the first user account based on at least a portion of a first internet protocol (IP) address associated with the first user account at least partially matches a second IP address associated with the second user account.
9. The system of claim 7 , wherein identifying that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
identifying that the second user account is related to the first user account based on a common string pattern in a first user account email address and a second user account email address.
10. The system of claim 7 , wherein identifying that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
generating a hash value for each content item in the subset of content items;
generating one or more second hash values for one or more second content items associated with the second user account; and
identifying a match between the hash value and at least one of the one or more second hash values.
11. The system of claim 7 , wherein identifying that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
determining a first user device corresponding to the first user account, the first user device comprising first user device type information;
determining a second user device corresponding to the second user account, the second user device comprising second user device type information; and
identifying at least a partial match between the first user device type information and the second user device type information.
12. The system of claim 7 , wherein the authentication data associated with the first account comprises one or more of email address, IP address, geographic region, device type, browser type, or referral information.
13. A non-transitory computer readable medium comprising one or more sequences of instructions, which, when executed by one or more processors, cause the one or more processors to perform operations, comprising:
scanning, by a content management system, one or more content items stored in one or more databases associated with the content management system, the one or more content items associated with a first user account;
identifying, by the content management system, within the one or more content items, a subset of content items comprising suspicious content;
in response to identifying the subset of content items, identifying, by the content management system, that at least one second user account is related to the first user account based on at least authentication data associated with the first user account and authentication data associated with the second user account, wherein the first user account and the at least one second user account are accessed via a common client device; and
blocking access to the first user account and the at least one second user account on the content management system.
14. The non-transitory computer readable medium of claim 13 , wherein identifying, by the content management system, that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
identifying that the second user account is related to the first user account based on at least a portion of a first internet protocol (IP) address associated with the first user account at least partially matches a second IP address associated with the second user account.
15. The non-transitory computer readable medium of claim 13 , wherein identifying, by the content management system, that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
identifying that the second user account is related to the first user account based on a common string pattern in a first user account email address and a second user account email address.
16. The non-transitory computer readable medium of claim 13 , wherein identifying, by the content management system, that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
generating a hash value for each content item in the subset of content items;
generating one or more second hash values for one or more second content items associated with the second user account; and
identifying a match between the hash value and at least one of the one or more second hash values.
17. The non-transitory computer readable medium of claim 13 , wherein identifying, by the content management system, that at least the second user account is related to the first user account based on at least the authentication data associated with the first user account and the authentication data associated with the second user account, comprises:
determining a first user device corresponding to the first user account, the first user device comprising first user device type information;
determining a second user device corresponding to the second user account, the second user device comprising second user device type information; and
identifying at least a partial match between the first user device type information and the second user device type information.