Spammy app detection systems and methods
A spammy app detection system may search a database for any new social media application discovered during a recent time period. A spammy app detection algorithm can be executed on the spammy app detection system on an hourly basis to determine whether any of such applications is spammy (i.e., posting to a social media page anomalously). The spammy app detection algorithm has a plurality of stages. When a new social media application fails any of the stages, it is identified as a spammy app. The spammy app detection system can update the database accordingly, ban the spammy application from further posting to a social media page monitored by the spammy app detection system, notify an entity associated with the social media page, further process the spammy application, and so on. In this way, the spammy app detection system can reduce digital risk and spam attacks.
1. A method, comprising:
sending, by a spammy app detection system executing on a processor, a request to a network server for updates on a page monitored by the spammy app detection system;
receiving, by the spammy app detection system from the network server, the updates on the page monitored by the spammy app detection system;
analyzing, by the spammy app detection system, the updates on the page monitored by the spammy app detection system;
determining, by the spammy app detection system based at least on the analyzing, that a new app is interacting with the page monitored by the spammy app detection system;
processing, by the spammy app detection system, the new app through a plurality of spammy app detection stages, including:
determining whether the new app is a known fraudulent application;
determining whether a poster of the new app is a known spammy user;
determining whether the new app is similar to a known fraudulent application, the determining including comparing the new app with the known fraudulent application and
determining whether a name of the new app is a variation of a name of the known fraudulent application; and
determining whether the new app is posting anomalously to the page through a plurality of user accounts;
identifying, by the spammy app detection system, the new app as a benign application in response to the new app passing the plurality of spammy app detection stages, or as a spammy app in response to the new app failing any of the plurality of spammy app detection stages.
2. The method according to claim 1 , further comprising:
storing the new app in a database prior to processing the new app through the plurality of spammy app detection stages.
3. The method according to claim 1 , further comprising:
determining a day in a past month where the new app posts more than N times;
determining an author posting more than M times in the day in the past month;
determining a window of time in the day having highest number of posts by the author;
determining whether the author posted more than X times in the window of time in the day;
determining active content the author used to post more than X times in the window of time in the day; and
marking the active content the author used to post more than X times in the window of time in the day as spammy.
4. The method according to claim 1 , further comprising:
examining historical data of the page, the historical data including a monthly total of posts to the page;
determining, utilizing the monthly total of posts, a month having at least a double of the monthly total of posts;
identifying, within the month, a day in which a daily total of posts has increased by at least a first number of predetermined times from a daily total of posts in a previous day;
determining whether an author has posted more than a second number of predetermined times in the day;
determining, within the day, an hour during which the author has highest number of posts; and
identifying an application as a spammy application, the application used by the author to post more than a third number of predetermined times in one minute in the hour.
5. The method according to claim 1 , wherein the updates received by the spammy app detection system from the network server include at least one of a property indicating a network computing platform, a unique identifier given by the network computing platform to the new app, an application display name for the new app, a creation date indicating a date when an entry is created for the new app in a database, or an update date indicating a last time when the entry is updated.
6. The method according to claim 1 , wherein determining whether the new app is similar to a known fraudulent application further comprises:
determining whether a name of the poster of the new app is a variation of a known spammy user.
7. A spammy app detection system, comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor to perform:
sending a request to a network server for updates on a page monitored by the spammy app detection system;
receiving, from the network server, the updates on the page monitored by the spammy app detection system;
analyzing the updates on the page monitored by the spammy app detection system;
determining, based at least on the analyzing, that a new app is interacting with the page monitored by the spammy app detection system;
processing the new app through a plurality of spammy app detection stages, including:
determining whether the new app is a known fraudulent application;
determining whether a poster of the new app is a known spammy user;
determining whether the new app is similar to a known fraudulent application, the determining including comparing the new app with the known fraudulent application and determining whether a name of the new app is a variation of a name of the known fraudulent application; and
determining whether the new app is posting anomalously to the page through a plurality of user accounts;
identifying the new app as a benign application in response to the new app passing the plurality of spammy app detection stages, or as a spammy app in response to the new app failing any of the plurality of spammy app detection stages.
8. The spammy app detection system of claim 7 , wherein the stored instructions are further translatable by the processor to perform:
storing the new app in a database prior to processing the new app through the plurality of spammy app detection stages.
9. The spammy app detection system of claim 7 , wherein the stored instructions are further translatable by the processor to perform:
determining a day in a past month where the new app posts more than N times;
determining an author posting more than M times in the day in the past month;
determining a window of time in the day having highest number of posts by the author;
determining whether the author posted more than X times in the window of time in the day;
determining active content the author used to post more than X times in the window of time in the day; and
marking the active content the author used to post more than X times in the window of time in the day as spammy.
10. The spammy app detection system of claim 7 , wherein the stored instructions are further translatable by the processor to perform:
examining historical data of the page, the historical data including a monthly total of posts to the page;
determining, utilizing the monthly total of posts, a month having at least a double of the monthly total of posts;
identifying, within the month, a day in which a daily total of posts has increased by at least a first number of predetermined times from a daily total of posts in a previous day;
determining whether an author has posted more than a second number of predetermined times in the day;
determining, within the day, an hour during which the author has highest number of posts; and
identifying an application as a spammy application, the application used by the author to post more than a third number of predetermined times in one minute in the hour.
11. The spammy app detection system of claim 7 , wherein the updates received by the spammy app detection system from the network server include at least one of a property indicating a network computing platform, a unique identifier given by the network computing platform to the new app, an application display name for the new app, a creation date indicating a date when an entry is created for the new app in a database, or an update date indicating a last time when the entry is updated.
12. The spammy app detection system of claim 7 , wherein determining whether the new app is similar to a known fraudulent application further comprises:
determining whether a name of the poster of the new app is a variation of a known spammy user.
13. A computer program product for spammy app detection, the computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor of a spammy app detection system for:
sending a request to a network server for updates on a page monitored by the spammy app detection system;
receiving, from the network server, the updates on the page monitored by the spammy app detection system;
analyzing the updates on the page monitored by the spammy app detection system;
determining, based at least on the analyzing, that a new app is interacting with the page monitored by the spammy app detection system;
processing the new app through a plurality of spammy app detection stages, including:
determining whether the new app is a known fraudulent application;
determining whether a poster of the new app is a known spammy user;
determining whether the new app is similar to a known fraudulent application, the determining including comparing the new app with the known fraudulent application and determining whether a name of the new app is a variation of a name of the known fraudulent application; and
determining whether the new app is posting anomalously to the page through a plurality of user accounts;
identifying the new app as a benign application in response to the new app passing the plurality of spammy app detection stages, or as a spammy app in response to the new app failing any of the plurality of spammy app detection stages.
14. The computer program product of claim 13 , wherein the instructions are further translatable by the processor for:
determining a day in a past month where the new app posts more than N times;
determining an author posting more than M times in the day in the past month;
determining a window of time in the day having highest number of posts by the author;
determining whether the author posted more than X times in the window of time in the day;
determining active content the author used to post more than X times in the window of time in the day; and
marking the active content the author used to post more than X times in the window of time in the day as spammy.
15. The computer program product of claim 13 , wherein the instructions are further translatable by the processor for:
examining historical data of the page, the historical data including a monthly total of posts to the page;
determining, utilizing the monthly total of posts, a month having at least a double of the monthly total of posts;
identifying, within the month, a day in which a daily total of posts has increased by at least a first number of predetermined times from a daily total of posts in a previous day;
determining whether an author has posted more than a second number of predetermined times in the day;
determining, within the day, an hour during which the author has highest number of posts; and
identifying an application as a spammy application, the application used by the author to post more than a third number of predetermined times in one minute in the hour.
16. The computer program product of claim 13 , wherein the updates received by the spammy app detection system from the network server include at least one of a property indicating a network computing platform, a unique identifier given by the network computing platform to the new app, an application display name for the new app, a creation date indicating a date when an entry is created for the new app in a database, or an update date indicating a last time when the entry is updated.
17. The computer program product of claim 13 , wherein determining whether the new app is similar to a known fraudulent application further comprises:
determining whether a name of the poster of the new app is a variation of a known spammy user.