IP Library Granted Patent US 11,397,869
Granted Patent B2
US 11,397,869 · App. 17/249,425 · Granted Jul 26, 2022

Methods and systems for detecting impersonating social media profiles

Inventor: Kavan B. McEachern (Baltimore, MD)
Assignee: ZeroFOX, Inc.
G06K9/6201G06V10/462
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,397,869
App. No.
17/249,425
Granted
Jul 26, 2022
Kind
B2
Abstract

A method may include generating a first scaled variant pyramid associated with a first image and a second scaled variant pyramid associated with a second image; determining a pair of best-matching variants; detecting a first plurality of keypoints in the first variant and a second plurality of keypoints in the second variant; generating a descriptor for each keypoint of the first plurality of keypoints to create a first plurality of keypoint descriptors; generating a descriptor for each keypoint of the second plurality of keypoints to create a second plurality of keypoint descriptors; for each keypoint of the first plurality of keypoints, identifying a keypoint match from the second plurality of keypoints; determining that a number of keypoint matches is above a threshold number; and in response to determining that the number of keypoint matches is above the threshold number, determining that the first image matches the second image.

Claims (85)

1. A method for determining whether two images match performed by a server, the method comprising:

generating a first scaled variant pyramid associated with a first image and a second scaled variant pyramid associated with a second image, each scaled variant pyramid comprising a plurality of scaled variants of the associated image;

determining a pair of best-matching variants, the pair of best-matching variants comprising a first variant from the first scaled variant pyramid and a second variant from the second scaled variant pyramid that best-matches the first variant;

detecting a first plurality of keypoints in the first variant and a second plurality of keypoints in the second variant;

generating a descriptor for each keypoint of the first plurality of keypoints to create a first plurality of keypoint descriptors, each descriptor of the first plurality of keypoint descriptors being associated with a keypoint of the first plurality of keypoints;

generating a descriptor for each keypoint of the second plurality of keypoints to create a second plurality of keypoint descriptors, each descriptor of the second plurality of keypoint descriptors being associated with a keypoint of the second plurality of keypoints;

for each keypoint of the first plurality of keypoints, identifying a keypoint match from the second plurality of keypoints;

determining that a number of keypoint matches is above a threshold number; and

in response to determining that the number of keypoint matches is above the threshold number, determining that the first image matches the second image.

2. The method of claim 1 , wherein identifying the keypoint match comprises:

determining, via a locality-sensitivity hash (LSH) algorithm and based on the first and second pluralities of keypoint descriptors, a first and second degree nearest neighbor, each nearest neighbor comprising a keypoint of the second plurality of keypoints;

performing a ratio test on the first and second degree nearest neighbors to calculate a ratio;

determining that the ratio is above a threshold value; and

in response to determining that the ratio is above the threshold value, determining that the keypoint of the first plurality of keypoints and the keypoint of the first degree nearest neighbor constitute the keypoint match.

3. The method of claim 2 , wherein the threshold ratio is between 0.55 and 0.6.

4. The method of claim 1 , wherein determining the pair of best-matching variants comprises, for each scaled variant of the first scaled variant pyramid:

calculating an absolute value of a difference of squares between the scaled variant of the first scaled variant pyramid and each scaled variant of the second scaled variant pyramid; and

identifying the scaled variant of the first scale variant pyramid and the scaled variant of the second scale variant pyramid with a lowest absolute value as the pair of best-matching variants.

5. The method of claim 1 , wherein detecting the first and second pluralities of keypoints comprises, for each pixel in the first and second variant:

assigning an intensity value to the pixel and a plurality of surrounding pixels;

determining whether the intensity value of each pixel of the plurality of surrounding pixels is greater than, less than, or the same as the intensity of the pixel; and

in response to determining that a pre-defined threshold number of pixels of the plurality of surrounding pixels have intensities one of greater than or less than the intensity value of the pixel, determining that the pixel is a keypoint.

6. The method of claim 1 , wherein detecting the first and second pluralities of keypoints and generating a descriptor comprises using an oriented features from accelerated segment test and rotated binary robust independent elementary features (ORB) algorithm.

7. The method of claim 1 , wherein the threshold number of matching keypoints is four, five, or six.

8. The method of claim 1 , wherein generating the descriptor for each keypoint of the first plurality of keypoints and generating the descriptor for each keypoint of the second plurality of keypoints comprises, for each keypoint:

assigning a bit value of 1 to a plurality of pixels surrounding the keypoint with an intensity greater than the keypoint;

assigning a bit value of 0 to a plurality of pixels surrounding the keypoint with an intensity less than or equal to the keypoint;

creating an intensity centroid for the plurality of pixels;

detecting a corner based on the intensity of each of the plurality of pixels; and

generating a vector based on the intensity centroid and the corner, the vector being the descriptor.

9. The method of claim 8 , wherein the descriptor is a vector with a length of two hundred and fifty six.

10. The method of claim 9 , wherein determining a nearest neighbor comprises calculating a Euclidean distance between a descriptor of the first plurality of keypoint descriptors and at least one descriptor of the second plurality of descriptors.

11. A method for determining whether a first image matches a second image performed by a server, the method comprising:

generating a scaled variant pyramid for each of the first image and the second image to obtain a first scaled variant pyramid associated with the first image and a second scaled variant pyramid associated with the second image, each scaled variant pyramid comprising a plurality of scaled variants of an associated image;

determining a pair of best-matching variants, the pair of best-matching variants comprising a first variant from the first scaled variant pyramid and a second variant from the second scaled variant pyramid that best-matches the first variant;

detecting a first plurality of keypoints in the first variant and a second plurality of keypoints in the second variant;

generating a descriptor for each keypoint of the first plurality of keypoints to create a first plurality of keypoint descriptors, each descriptor of the first plurality of keypoint descriptors being associated with a keypoint of the first plurality of keypoints;

generating a descriptor for each keypoint of the second plurality of keypoints to create a second plurality of keypoint descriptors, each descriptor of the second plurality of keypoint descriptors being associated with a keypoint of the second plurality of keypoints;

for each keypoint of the first plurality of keypoints, identifying a keypoint match from the second plurality of keypoints;

determining that a number of keypoint matches is above a threshold number;

analyzing the first and second image to generate a match prediction via a difference hash (dHash) algorithm; and

in response to determining that the number of keypoint matches is above the threshold number and generating a match prediction that indicates a match, determining that the first image matches the second image.

12. The method of claim 11 , wherein analyzing the first and second image to generate a match prediction via the dHash algorithm comprises:

for each of the first and second image:

down-sampling the image to reduce a size of the image;

reducing colors of the image to a grayscale color scheme;

for each pixel, computing a difference in intensity between adjacent pixels; and

assigning a bit value to each pixel based on the difference to create a difference hash; and

comparing the difference hash of each image to generate a match prediction.

13. The method of claim 11 , wherein identifying the keypoint match comprises:

determining, via a locality-sensitivity hash (LSH) algorithm and based on the first and second pluralities of keypoint descriptors, a first and second degree nearest neighbor, each nearest neighbor comprising a keypoint of the second plurality of keypoints;

performing a ratio test on the first and second degree nearest neighbors to calculate a ratio;

determining that the ratio is above a threshold value; and

in response to determining that the ratio is above the threshold value, determining that the keypoint of the first plurality of keypoints and the keypoint of the first degree nearest neighbor constitute the keypoint match.

14. The method of claim 13 , wherein the threshold ratio is between 0.55 and 0.6.

15. The method of claim 11 , wherein determining the pair of best-matching variants comprises, for each scaled variant of the first scaled variant pyramid:

calculating an absolute value of a difference of squares between the scaled variant of the first scaled variant pyramid and each scaled variant of the second scaled variant pyramid; and

identifying the scaled variant of the first scale variant pyramid and the scaled variant of the second scale variant pyramid with a lowest absolute value as the pair of best-matching variants.

16. The method of claim 11 , wherein detecting the first and second pluralities of keypoints comprises:

for each pixel in the first and second variant:

assigning an intensity value to the pixel and a plurality of surrounding pixels;

determining whether the intensity value of each pixel of the plurality of surrounding pixels is greater than, less than, or the same as the intensity of the pixel;

in response to determining that a pre-defined threshold number of pixels of the plurality of surrounding pixels have intensities one of greater than or less than the intensity value of the pixel, determining that the pixel is a keypoint.

17. The method of claim 11 , wherein generating the descriptor for each keypoint of the first plurality of keypoints and generating the descriptor for each keypoint of the second plurality of keypoints comprises, for each keypoint:

assigning a bit value of 1 to a plurality of pixels surrounding the keypoint with an intensity greater than the keypoint;

assigning a bit value of 0 to a plurality of pixels surrounding the keypoint with an intensity less than or equal to the keypoint;

creating an intensity centroid for the plurality of pixels;

detecting a corner based on the intensity of each of the plurality of pixels; and

generating a vector based on the intensity centroid and the corner, the vector being the descriptor.

18. The method of claim 11 , wherein detecting the first and second pluralities of keypoints and generating a descriptor comprises using an oriented features from accelerated segment test and rotated binary robust independent elementary features (ORB) algorithm.

19. The method of claim 18 , wherein determining a nearest neighbor comprises calculating a Euclidean distance between a descriptor of the first plurality of keypoint descriptors and at least one descriptor of the second plurality of descriptors.

20. A method for detecting impersonating social media profiles comprising:

receiving a source image from a protected entity;

detecting a candidate impersonating profile of the protected entity based on information other than image data;

obtaining a comparison image from the candidate impersonating profile;

generating a scaled variant pyramid for each of the comparison image and the source image to obtain a first scaled variant pyramid associated with the comparison image and a second scaled variant pyramid associated with the source image, each scaled variant pyramid comprising a plurality of scaled variants of an associated image;

determining a pair of best-matching variants, the pair of best-matching variants comprising a first variant from the first scaled variant pyramid and a second variant from the second scaled variant pyramid that best-matches the first variant;

detecting a first plurality of keypoints in the first variant and a second plurality of keypoints in the second variant;

generating a descriptor for each keypoint of the first plurality of keypoints to create a first plurality of keypoint descriptors, each descriptor of the first plurality of keypoint descriptors being associated with a keypoint of the first plurality of keypoints;

generating a descriptor for each keypoint of the second plurality of keypoints to create a second plurality of keypoint descriptors, each descriptor of the second plurality of keypoint descriptors being associated with a keypoint of the second plurality of keypoints;

for each keypoint of the first plurality of keypoints, identifying a keypoint match, the identifying comprising:

determining, via a locality-sensitivity hash (LSH) algorithm, at least one nearest neighbor, each nearest neighbor comprising a keypoint from the second plurality of keypoints; and

analyzing the keypoint and the at least one nearest neighbor to identify the keypoint match;

determining that a number of keypoint matches is above a threshold number; and

in response to determining that the number of keypoint matches is above the threshold number, determining that the comparison image matches the source image.

Assignments (7)
RELEASE OF SECURITY INTEREST Recorded May 16, 2024
From: STIFEL BANK
To: ZEROFOX, INC.
Reel/Frame 067429/0328 →
SECURITY INTEREST Recorded May 13, 2024
From: ZEROFOX, INC.; LOOKINGGLASS CYBER SOLUTIONS, LLC; IDENTITY THEFT GUARD SOLUTIONS, INC.
To: MONROE CAPITAL MANAGEMENT ADVISORS, LLC
Reel/Frame 067396/0304 →
SECURITY INTEREST Recorded Jun 16, 2023
From: ZEROFOX, INC.
To: STIFEL BANK
Reel/Frame 063976/0113 →
RELEASE OF SECURITY INTEREST Recorded Aug 16, 2022
From: ORIX GROWTH CAPITAL, LLC
To: VIGILANTEATI, INC.
Reel/Frame 060821/0137 →
RELEASE OF SECURITY INTEREST Recorded Aug 16, 2022
From: ORIX GROWTH CAPITAL, LLC
To: ZEROFOX, INC.
Reel/Frame 060821/0173 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Sep 8, 2021
From: MCEACHERN, KAVAN B.
To: ZEROFOX, INC.
Reel/Frame 057411/0361 →
SECURITY INTEREST Recorded Jun 8, 2021
From: ZEROFOX, INC.
To: ORIX GROWTH CAPITAL, LLC
Reel/Frame 056471/0629 →
Continuity (2)
Provisional Application 62984952 · Mar 4, 2020
Related Publication 20210279502A1 · Sep 9, 2021