US20210166331A1 - Method and system for risk determination - Google Patents

Method and system for risk determination Download PDF

Info

Publication number
US20210166331A1
US20210166331A1 US17/263,967 US201817263967A US2021166331A1 US 20210166331 A1 US20210166331 A1 US 20210166331A1 US 201817263967 A US201817263967 A US 201817263967A US 2021166331 A1 US2021166331 A1 US 2021166331A1
Authority
US
United States
Prior art keywords
social media
entity
interest
risk
computer
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
US17/263,967
Other languages
English (en)
Inventor
Rostyslav Buglak
David BLOCKOW
Matthew Lowry
Aaron Lane
Brenton Cooper
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Fivecast Pty Ltd
Original Assignee
Fivecast Pty Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from AU2018902753A external-priority patent/AU2018902753A0/en
Application filed by Fivecast Pty Ltd filed Critical Fivecast Pty Ltd
Publication of US20210166331A1 publication Critical patent/US20210166331A1/en
Assigned to FIVECAST PTY LTD reassignment FIVECAST PTY LTD ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BLOCKOW, DAVID, BUGLAK, Rostyslav, COOPER, BRENTON, LANE, AARON, LOWRY, MATTHEW
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/01—Social networking
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G06Q10/063—Operations research, analysis or management
    • G06Q10/0635—Risk analysis of enterprise or organisation activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2457—Query processing with adaptation to user needs
    • G06F16/24578—Query processing with adaptation to user needs using ranking
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/20—Natural language analysis
    • G06F40/279—Recognition of textual entities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/018—Certifying business or products
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0609—Buyer or seller confidence or verification
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/03—Credit; Loans; Processing thereof
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/08—Insurance
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/10—Services
    • G06Q50/26—Government or public services
    • G06Q50/265—Personal security, identity or safety
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/10—Office automation; Time management
    • G06Q10/105—Human resources

Definitions

  • the present disclosure relates to determining the risk profile of an entity having an associated online social media presence.
  • the present disclosure relates to determining a risk profile of an entity based on their online relationships.
  • Determining the risk profile of entities such as a person, business, organisation or other groups is an important consideration in many areas of commercial and law enforcement activities.
  • One example is characterising the risk profile of an entity to determine whether a commercial transaction should be entered into with the entity such as providing credit or an insurance policy.
  • determining a risk profile is an important consideration as it allows an assessment to be made of the likelihood of future behaviour which may be problematical.
  • law enforcement can also be involved in providing “police” clearances where a cleared entity may be able to provide a range of services such as children related activities. Typically, this involves determining whether clearance should be provided based on past behaviour but it would be advantageous if likely future behaviour could be characterised in this assessment.
  • the present disclosure provides a computer-implemented method for determining a risk profile of an entity of interest, comprising:
  • interrogating the social media account comprises:
  • interrogating the social media platform to identify one or more candidate social media accounts, each candidate social media account comprising candidate information;
  • generating the linked social network data structure comprises:
  • determining data items corresponding to social media activities includes comparing a data item with a previous version of a data item to identify a change in the data item.
  • determining social media interactions includes determining whether the social media account of the entity of interest and another social media account corresponding to another entity have interacted with common content on the social media platform.
  • the risk assessment is based on a textual analysis of the one or more social media interactions.
  • the textual analysis includes a measure of a relevance of the social media interaction in combination with a measure of a sentiment of the one or more social media interactions.
  • the risk assessment is based on an image analysis of the one or more social media interactions.
  • an initial entity risk measure is determined for each of the one or more other social media accounts linked to the social media account of the entity of interest.
  • the individual link risk measure for a link between the entity of interest and an other entity is also based on the initial entity risk measure for the other entity.
  • the method further includes interrogating by the one or more electronic processors additional social media platforms to determine one or more related social media accounts corresponding to the entity of interest.
  • generating the linked social network data structure includes:
  • each of the related social media accounts determining links based on social media interactions between each of the related social media accounts of the entity of interest and further social media accounts on the social media platform or the additional social media platforms corresponding to other entities.
  • the linked network data structure and the risk profile of the entity of interest is updated over time.
  • the present disclosure provides a computer-implemented risk profiling system for determining a risk profile of an entity of interest, comprising:
  • an interrogation server comprising one or more processors configured to interrogate a social media platform to determine a social media account corresponding to the entity of interest;
  • a collection server comprising one or more processors configured to generate a linked social network data structure linking the social media account corresponding to the entity of interest to one or more other social media accounts on the social media platform corresponding to other entities, wherein an individual link is based on one or more social media interactions between the social media account corresponding to the entity of interest and each of the one or more other social media accounts corresponding to other entities;
  • a link analysis server comprising one or more processors configured to assign an individual link risk measure to one or more of the individual links of the linked network data structure, the individual link risk measure based on a risk assessment of the one or more social media interactions upon which the individual link is based on and to then determine the risk profile of the entity of interest based on an aggregated risk measure based on the linked social network data structure comprising the individual link risk measures.
  • interrogating the social media account by the interrogation server comprises:
  • interrogating the social media platform to identify one or more candidate social media accounts, each candidate social media account comprising candidate information;
  • generating the linked social network data structure by the collection server comprises:
  • determining data items corresponding to social media activities includes comparing a data item with a previous version of a data item to identify a change in the data item.
  • determining social media interactions includes determining whether the social media account of the entity of interest and another social media account corresponding to another entity have interacted with common content on the social media platform.
  • the risk assessment is based on a textual analysis of the one or more social media interactions.
  • the textual analysis includes a measure of a relevance of the social media interaction in combination with a measure of a sentiment of the one or more social media interactions.
  • the risk assessment is based on an image analysis of the one or more social media interactions.
  • an initial entity risk measure is determined by the link analysis server for each of the one or more other social media accounts linked to the social media account of the entity of interest.
  • the individual link risk measure for a link between the entity of interest and another entity is also based on the initial entity risk measure for the other entity.
  • the system includes interrogating by the collection server additional social media platforms to determine one or more related social media accounts corresponding to the entity of interest.
  • generating the linked social network data structure by the link analysis server includes:
  • each of the related social media accounts determining links based on social media interactions between each of the related social media accounts of the entity of interest and further social media accounts on the social media platform or the additional social media platforms corresponding to other entities.
  • the linked network data structure and the associated risk profile of the entity of interest is updated by the link analysis server over time.
  • the present disclosure provides a risk profiling system for determining a risk profile of an entity of interest, comprising:
  • processors one or more processors
  • FIG. 1 is a system overview diagram of a risk profiling system for determining the risk profile of an entity of interest in accordance with an illustrative embodiment
  • FIG. 2 is a flowchart of a method for determining a risk profile of an entity of interest in accordance with an illustrative embodiment that may be implemented on the risk profiling system illustrated in FIG. 1 ;
  • FIG. 3 is a flowchart of a method for determining the social media account of the entity of interest in accordance with an illustrative embodiment
  • FIG. 4 is a flowchart of a method for determining a linked social network data structure in accordance with an illustrative embodiment
  • FIG. 5 is a depiction of the entity data structure that characterises an entity having a social media account in accordance with an illustrative embodiment
  • FIG. 6 is domain model of a linked network data structure in accordance with an illustrative embodiment
  • FIG. 7 is a depiction of a social media interaction comprising a post and follow up comment showing the use of textual matching to determine a risk measure in accordance with an illustrative embodiment
  • FIG. 8 is a depiction of a social media activity comprising a post showing the use of textual matching to determine a risk measure in accordance with another illustrative embodiment
  • FIG. 9 is a depiction of a social media activity comprising a post of an image showing the use of an image classifier and text extractor to determine a risk measure in accordance with an illustrative embodiment
  • FIG. 10 is a visual depiction of a linked network data structure showing the links between the entity of interest and other entities in accordance with an illustrative embodiment
  • FIG. 11 is a visual depiction of an enhanced linked network data structure comprising the linked network structure illustrated in FIG. 10 expanded to the next level of links in accordance with an illustrative embodiment
  • FIG. 12 is a depiction of a social media activity comprising a post showing the use of textual matching to determine a risk measure in accordance with another illustrative embodiment
  • FIG. 13 is a depiction of a social media activity comprising a post of an image showing the use of an image classifier and text extractor to determine a risk measure in accordance with an illustrative embodiment
  • FIG. 14 is a depiction of a social media interaction comprising a post of an image and follow up comment and reaction showing the use of text extraction from an image to determine a risk measure in accordance with an illustrative embodiment
  • FIG. 15 is a depiction of a social media interaction comprising a post and follow up comment showing the use of textual matching to determine a risk measure in accordance with an illustrative embodiment
  • FIG. 16 is a visual depiction of a linked network data structure showing the links between the entity of interest and other entities based on the social media activities and interactions illustrated in FIGS. 12 to 15 in accordance with another illustrative embodiment
  • FIG. 17 is a graph of the variation of the risk profile of an entity of interest over time in accordance with an illustrative embodiment.
  • FIG. 18 is a system overview diagram of a risk profiling system 1000 for determining the risk profile of an entity of interest based on their social media presence according to another illustrative embodiment.
  • FIG. 1 there is shown a system overview diagram of a risk profiling system 100 for determining the risk profile of an entity of interest based on their social media presence according to an illustrative embodiment.
  • entity is defined to include, but not be limited to, individuals, groups of individuals, organisations, businesses or any other commercial or legal structure.
  • social media platform is defined to be an online software system comprising an online community where an entity can create a social media account and which includes online communication channels directed to community interaction, content sharing and collaboration allowing entities to interact with each other online.
  • Risk profiling system 100 includes a user interface 140 which is connected to a computer system 110 comprising an electronic processor and a database 150 for the storage of electronic information.
  • Computer system 110 which may comprise one or more processors is connected to the Internet 120 by a network connection and is configured to interrogate social media platform 130 which operates in the Internet 120 .
  • user interface 140 comprises a web browser 141 that connects to a complementary web portal interface served by computer system 110 over a secure HTTPS connection.
  • network connections shown are exemplary and other ways of establishing a communications link between the computers can be used.
  • the existence of any of various well-known protocols, such as TCP/IP, Frame Relay, Ethernet, FTP, HTTP and the like, is presumed, and the computer can be operated in a client-server configuration to permit a user to retrieve web pages from a web-based server.
  • any of various conventional web browsers can be used to display and manipulate data on web pages.
  • method 200 for determining a risk profile of an entity of interest based on their social media presence according to an illustrative embodiment.
  • method 200 may be implemented on the risk profiling system 100 illustrated in FIG. 1 or the risk profiling system 1000 illustrated in FIG. 18 .
  • the online social media platform is interrogated to determine a social media account that corresponds to the entity of interest.
  • an interrogation server 111 eg, see FIG. 1
  • the entity of interest is entered by way of user interface 140 consisting of a web browser 141 that connects to the interrogation server by way of a HTTPS connection 110 A.
  • the entity of interest is defined by a known entity identifier such as an associated URL, username or handle for the social media platform and the social media account of the entity of interest may be determined on this basis.
  • entity selection information characterising the entity of interest is provided to risk profiling system 100 , the entity selection information including, but not limited to: email address, mobile phone number, age, date of birth, entity image, real world name (eg, first name, surname), alias, location (eg, city, state, country), company, industry, social media association (eg, liked groups, employers), real world associations (eg, wife, friend), or any combination of the above.
  • entity selection information characterising the entity of interest is provided to risk profiling system 100 , the entity selection information including, but not limited to: email address, mobile phone number, age, date of birth, entity image, real world name (eg, first name, surname), alias, location (eg, city, state, country), company, industry, social media association (eg, liked groups, employers), real world associations (eg, wife, friend), or any combination of the above.
  • the social media platform is then interrogated by carrying out a search to identify candidate social media accounts based on the entity selection information.
  • the following candidate information may be retrieved from a candidate social media account including, but not limited to:
  • the candidate social media accounts are then ranked by interrogation server 111 .
  • a similarity measure is determined for each candidate account depending on the degree of similarity between the entity selection information and the candidate information which may also be expressed as a confidence level that the candidate social media account is a match to the social media account of the entity of interest.
  • the degree of similarity is determined based on the type of candidate information such as set out below:
  • the degree of similarity or confidence level is determined based on a normalised, weighted sum of the individual degrees of similarity for each of the information types referred to above.
  • the degree of similarity may be determined by a learnt classification model operating over the above information types.
  • classification models may be used.
  • a classification model is trained on features derived from the above information types, where the features are represented as vectors in a multi-dimensional feature vector space.
  • the classification model is then trained to place similar social media accounts closer to each other in the feature vector space and dissimilar social media accounts further apart in the feature vector space.
  • the trained classification model is then applied to the candidate social media accounts to obtain a ranked list of candidate social media accounts based on the proximity to the input entity selection information.
  • the social media account corresponding to the entity of interest is selected from the set or list of ranked candidate social media accounts.
  • the top ranked candidate social media account is automatically determined to be the social media account of the entity of interest.
  • the highest ranked candidate social media accounts are presented to an operator for selection of the social media account corresponding to the entity of interest.
  • a selection of social media accounts that are ranked above a predetermined threshold would be nominated as individual entities of interest to which the following risk assessment process would be applied for each case.
  • the user interface 140 via web browser 141 also provides the capability to:
  • interrogation server 111 includes a firewall. As would be appreciated, this configuration allows for remote access to the risk profiling system 100 .
  • interrogation server 111 communicates with social media platform by network connection 110 B which may include an optional firewall 160 B and/or virtual private network (VPN) server in order to obfuscate the IP address of the interrogation server 111 .
  • VPN virtual private network
  • risk profiling system 100 includes a HTTPS proxy server 112 (eg, see FIG. 1 ) configured to operate on data processor 110 which allows an operator to browse the Internet via a browser plugin in web browser 141 using the same VPN connection as the interrogation server 111 .
  • This facility provides IP obfuscation for any web browsing by the operator configuring risk profiling system 100 .
  • a linked social network data structure is determined that links the social media account of the entity of interest to one or more other social media accounts on the social media platform where the link is based on a social media interaction between the entity of interest's social media account and the other social media accounts.
  • a collection server 113 configured to operate on computer system 110 functions to collect data items from the social media account of the entity of interest to populate an entity data structure 300 corresponding to the entity of interest for storage in database 150 .
  • the social media account 320 includes one or more data items 330 which may include entity details that describe the entity 310 and further include configuration details pertaining to the social media platform.
  • Data items 330 may also include multimedia data such as text, images, videos and audio and derived data items that are unique to the social media platform such as social media account metadata comprising profile information including, but not limited to: gender, age, nationality, place of residence, place of birth, education, marital status and religion.
  • collection server 113 classifies data items 330 as social media activities 340 that are performed by the entity 310 on the social media platform including, but not limited to, social media activities such as posts, reposts, shares, comments, replies, joining groups, adding and removing friends/followers or reactions (eg, likes).
  • social media activities such as posts, reposts, shares, comments, replies, joining groups, adding and removing friends/followers or reactions (eg, likes).
  • the classification of a data item 330 as a social media activity 340 may occur as a result of comparing a data item with a previous version of a data item in order to identify changes.
  • a comparison of a data item 330 listing the friends or connections of an entity on a social media account may be compared to an earlier version to generate one or more “Added a Friend/Connection/Follower” social media activities for that data item 330 depending on the number of friends or connections added since the previous collection.
  • a visual change in an entity's profile picture may be classed as a social media activity.
  • a change in membership in respect of an online community such as a group, organisation or like may be classed as a social media activity.
  • a change in the volume of content or interactions over a predetermined time such as a significant increase/decrease or halt in activity may be classed as a social media activity.
  • an actual activity such as an entity changing location (eg, going on holiday) will be classed as a social media activity.
  • collection server 113 identifies and classifies social media activities determined in the previous step as social media interactions.
  • a social media interaction is a social media activity 340 associated with an entity 310 which concerns an interaction between the entity of interest and another social media account that corresponds to another entity.
  • Examples of social media interactions include, but are not limited to:
  • the entity of interest may be commenting or otherwise interacting with social media content such as a post from a group or forum page or an otherwise unrelated entity on the social media platform and another entity also interacts with the same social media content by, for example, also commenting on the same post.
  • This social media activity is then also classified as a social media interaction between the entity of interest and the other entity on the basis that they have both interacted with common content on the social media platform.
  • the collection server 113 generates the linked social network data structure centred about the entity of interest and comprising links to each of the other social media accounts corresponding to other entities where a link requires there to be at least one social media interaction between the social media account of the entity of interest and the linked social media account of the other entity.
  • Linked social network data structure 410 consists of one or more entities 420 including the entity of interest and other entities that are connected to the entity of interest by links 450 which comprise the linked social network structure 410 .
  • the links 450 that connect the entities are based on the social media interactions 440 which are a subset of the social media activities 430 performed by the entity of interest that involve at least one other entity.
  • the link connecting entities is comprised of, or characterises, all the social media interactions 440 between those two entities.
  • the process of generating the linked social network structure 410 will also involve automatically populating respective entity data structures 300 for the other entities that are linked to the entity of interest. In this manner, selection of an entity of interest will then automatically generate a linked social network data structure comprising other entities as well as their associated populated entity data structures which in turn may characterise links between these other entities.
  • an individual link risk measure is assigned to links of the linked network data structure where the individual link risk measure is based on a risk assessment of the one or more social media interactions upon which the link is based on.
  • a link analysis server 114 configured to operate on computer system 110 carries out this process (eg, see FIG. 1 ).
  • the risk assessment comprises a textual analysis of any text forming part of the data item that forms the basis for the social media interaction. This can also include text extracted from images by optical character recognition techniques.
  • the textual analysis includes matching words or phrases to a predetermined list of words/phrases that are of interest. In one example, the predetermined lists of words/phrases may be divided into different categories of interest for the risk profiling activity.
  • a social media interaction 500 comprising a comment 521 made by a related entity 520 to a post 511 on a social media post made by the entity of interest 510 .
  • the term “ISLAMIC STATE” has been identified by textual matching 530 and further the term “KUFFAR” was identified in the comment made by the related entity.
  • Textual matching may be divided into a number of categories and in this example, the term “ISLAMIC STATE” has been categorised in the “islamic state” category and the term “kuffar” has been categorised in the “Derogation” category.
  • a social media activity 600 comprising a post 611 made by an entity 610 on a social media platform.
  • the indicated quote 612 was identified by textual matching 630 to a list of texts categorised into different libraries.
  • the indicated quote 612 was categorised as belonging to a publication or text in the library “Library-Ideology” 631 .
  • the textual analysis includes determining a risk measure for a given social media interaction in the form of a binary score associated with the presence or absence of words from a predetermined list of words or phrases such as quotes from relevant texts.
  • the textual analysis includes determining a risk measure for a given social media interaction in the form of a continuous score between zero and one that measures the relevance of this interaction to a category of interaction subject topics (eg, “drugs”, “alcohol” or “ideology”).
  • a given category is first characterised by a set of predetermined words/phrases relevant to that category. Each of these words/phrases is then represented in a high dimensional vector space constructed so that contextually and semantically similar words are located near to each other.
  • the textual content of the social media interaction is then projected into this high dimensional vector space and the risk measure is then determined by calculating a distance measure in this high dimensional vector space normalised between zero and one.
  • the textual analysis includes determining a combination risk measure for a given social media interaction in the form of a continuous score between zero and one that measures the relevance of the social media interaction to a category of interaction subject topics (eg, “drugs”, “alcohol” or “ideology”) combined with a continuous score between zero and one that measures a specific sentiment for the social media interaction (eg, “happy”, “fearful”, “angry”).
  • a sentiment classifier is trained using a training corpus comprising a set of social media posts with their associated reactions (eg, like, love, hate etc.). These reactions are then used as a substitute for human labels defining positive, negative or neutral sentiment for a given social media posts. The words and phrases in those posts and the associated reactions are then used to train the sentiment classifier to recognise the sentiment of input text arising from the social media interaction.
  • the risk assessment comprises an image analysis of any images forming part of the data item that forms the basis for the social media interaction to determine whether the images contain objects from a predetermined list of objects of interest.
  • the image analysis determines whether the images contain logos from a predetermined list of logos of interest.
  • the image analysis determines whether the images contain faces from a predetermined list of faces of interest.
  • a social media activity 700 comprising a post 710 made by an entity on a social media platform comprising an image 711 which has been classified by an image classifier 730 to determine whether it contains any objects of interest.
  • the image classifier 730 has determined that the image contains a number of objects of interest 731 in this case in the category “mujahideen” 732 .
  • image classifier 730 has also extracted text 740 present in the image.
  • each social media interaction may be assigned a risk measure following risk assessment of the social media interaction and then any link between two entities based on one or more social media interactions may be assigned an individual link risk measure based on the determined risk measures for the one or more social media interactions that form the basis for the link between the entity of interest and the other entity.
  • the individual link risk measure may comprise a number of sub-measures pertaining to different risk assessment categories such as a sub-measure directed in one example to “ideology” and a sub-measure direct to “weapons” which may be reviewed separately.
  • the sub-measure is determined for each social media interaction across all risk assessment categories to allow identification of high risk social media interactions that could occur.
  • the individual link risk measure may include a risk measure based on the number of social media interactions between entities that occur for a predetermined time period or any changes in this number over successive time periods.
  • the individual link risk measure may include a weighted sum where the weight is attributed to the type of social media interaction from the perspective of the entity of interest based on a degree of interaction measure of the social media interaction.
  • the degree of interaction measure would be higher if the entity of interest posted the content as opposed to commenting on the content.
  • the degree of interaction measure would be higher for commenting on the content compared to the case of the entity of interest reposting the content without comment which in turn would have a higher degree of interaction measure as compared to the situation of where the entity of interest just “liked” the content.
  • each social media activity for each entity in the linked social network data structure is assigned an activity risk measure based on the data item forming the basis for the social media activity.
  • each entity may be assigned an initial entity risk measure based on the social media activities they enter into on the social media platform without regard to whether those social media activities are related to an interrelationship between two or more entities.
  • This initial entity risk measure may then be used to weight the individual link risk measure.
  • the individual link risk measure for a link between the entity of interest and another entity based on their social media interactions where the other entity has initial entity risk measure that is high based on an assessment of their general social media activities on the social media platform would be weighted higher than the same individual link risk measure where the other party has a low initial entity risk measure.
  • an initial entity risk measure may be assigned to or prescribed for an entity, as a result enhancing the individual link risk measure for any entity of interest that has a social media interaction with this entity.
  • FIG. 10 there is shown a visual depiction of a linked network data structure 800 according to an illustrative embodiment.
  • the entity of interest (EOI) 810 is linked to the other entities (E1, E2 and E3) where an individual link is based on one or more social media interactions as has been previously described.
  • EOI 810 is linked to other entities E1, E2, and E3, by respective links 841 , 842 and 843 .
  • the number of social media interactions between an entity and another entity is shown by the weight or thickness of the line with a thicker line representing more social media interactions between the linked entities.
  • the line in this example is dashed.
  • the size of the box indicating an entity in the linked network data structure 800 will reflect this initial entity risk measure which may be used to weight the individual link risk measure as described above.
  • the box outline is dashed.
  • the visual depiction illustrated in FIG. 10 is but one example.
  • colour coding may also be used to indicate where various risk measure thresholds have been exceeded.
  • the linked network data structure 800 of FIG. 10 is highly simplified to illustrate the principles of the present disclosure and in a real use case there may be large number of links to other social media accounts corresponding to other entities.
  • visual depictions of the linked network data structure in accordance with the example illustrated in FIG. 8 allow an operator to extremely rapidly determine the level of risky engagement between an entity of interest and other entities in the social media network of the entity of interest.
  • an enhanced linked network data structure 900 comprising the linked network structure (Level 1), ie E1, E2 and E3, illustrated in FIG. 10 expanded to the next level of links (Level 2), ie E4, E5, E6, E7, E8, E9, E10, E11, E12, E13 and E14, according to an illustrative embodiment.
  • Level 1 linked network structure
  • Level 2 next level of links
  • a further level of links is determined to generate enhanced linked network data structure 900 by determining social media interactions between the entity at the first level and entities at the second level and then assigning individual link risk measures to each of these links based on risk assessment of the respective social media interactions.
  • the links between Level 1 and Level 2 may be used to determine the initial entity risk measure for those entities on Level 1 which will further feed in to determining the individual link measures between the Level 1 entities and the entity of interest. In this way, entities that are more than one level removed from the entity of interest may be utilised in determining the risk profile of the entity of interest. As would be appreciated, the process may be repeated again to generate the next level of linked entities (ie, Level 3) and so on.
  • the filtered linked network data structure is based on the type of social media interaction.
  • the filtered linked network data structure is based on a social media interaction where one entity has followed another entity.
  • the filtered linked network data structure is based on a social media interaction where one entity has reacted to a social media post or activity by another entity.
  • the filtered linked network data structure is based on a social media interaction where one entity has commented on a social media post or activity of another entity.
  • the risk profile for the entity of interest is determined based on an aggregated risk measure combining the individual link risk measures determined between the entity of interest and the linked entities based on the linked social network data structure now comprising the individual link risk measures.
  • the risk profile may be based on risk measures aggregated over different risk assessment categories or topics such as “ideology” and “weapons” as has been previously described so that these may be separately examined.
  • the link analysis server 114 configured to operate on computer system 110 , functions to determine the risk profile.
  • FIGS. 12 to 15 there are shown depictions of a number of social media activities and interactions and an associated linked network data structure 1600 illustrated in FIG. 16 relating to determining a risk profile based on antisocial behaviour such as alcohol consumption and gambling.
  • FIG. 12 there is shown a social media activity 1200 comprising a post 1211 by an entity of interest 1210 .
  • the terms “poker” and “drinks” have been identified in the “Alcohol” 1221 and “Gambling” 1222 categories which are of interest in this risk assessment exercise.
  • FIG. 13 there is shown a social media activity 1300 by the entity of interest 1210 comprising a post 1315 including text 1313 and an image 1314 .
  • the term “drink” has been identified in the “Alcohol” category 1221 .
  • image 1314 is a picture of fridge full of alcohol.
  • Image classifier 1330 has determined a number of relevant objects 1331 in the category “distilled beverage” 1332 .
  • image classifier has also extracted text 1340 from the image which is an alcohol brand which has been identified in the “Alcohol” category 1221 .
  • a social media interaction 1400 comprising a reaction 1451 in the form of “like” and a comment 1452 (not shown) in relation to a social media activity comprising a post 1415 by an entity of interest 1210 including text 1413 and an image 1414 .
  • textual matching did not identify relevant material in the text 1413 of the post 1415 and the image classifier did not identify any objects in the image 1414 which is a betting transaction record, however, the image classifier extracted the text 1440 from image 1414 and the term “bet” has been identified in the “Gambling” category 1222 .
  • FIG. 15 there is shown a social media interaction 1500 comprising a comment 1573 made by a related entity 1570 to a post 1513 on a social media post made by the entity of interest 1210 .
  • the term “booze” has been identified by textual matching 1530 and has been further identified or classified in the “Alcohol” category 1221 .
  • FIG. 16 there is shown a visual depiction of a linked network data structure 1600 based on social media activities and interactions of the type illustrated in FIGS. 12 to 15 comprising in this example two levels similar to FIG. 11 .
  • each of the entities including the entity of interest 1610 is represented by a profile picture or image related to the entity.
  • each of the individual links is based on one more social medial interactions.
  • the thickness of the link indicates that number of social media interactions between the linked entities and the darkness of the link corresponds to the individual link risk measure for the link connecting the entities.
  • the assessed risk of an entity exceeds a threshold based on their social media activities the entities name is highlighted explicitly as shown for entities 1681 , 1682 , 1683 .
  • entity 1682 relates to a venue that provides alcohol and gambling services.
  • the linked network data structure is updated on a periodic basis resulting in the associated risk profile of the entity of interest being updated over time.
  • FIG. 17 there is shown a graph 1700 of the variation of the risk profile or score 1710 of an entity of interest over time according to an illustrative embodiment. As would be appreciated, this allows the risk trajectory 1720 of an entity of interest to be tracked and inspected to determine whether there has been a change in behaviour that could trigger follow up or reclassification of the entity of interest.
  • the updated risk profile may be used to determine changes in behaviour at a category or topic level and further define combined measures which detect changes in more than one selected categories.
  • a risk profiling system in accordance with the present disclosure may be expanded to operate over additional social media platforms.
  • entity selection information may be used to identify and match to candidate social media accounts on the additional social media platforms.
  • information from the already identified social media account may be used preferentially as entity selection information to identify and match to candidate social media accounts on the additional social media platforms.
  • a matching candidate social media account on a further social media platform may be assessed by measuring the similarity between the account metadata of the entity of interest on the first social media platform with that of the candidate social media account on the further social media platform.
  • the assessment may be based on the degree of similarity of the account content between the two social media accounts on the different social media platforms.
  • the assessment may be based on a degree of similarity of the social networks between the two social media accounts on the different social media accounts.
  • the assessment may be based on a similarity measure comprising multiple weighted sub-measures of similarity.
  • social media activities may be determined and the social media interactions between the entity of interest and other entities on the additional social media platforms may be classified and form the basis of links between the entity of interest and the other entities.
  • the social media interaction will involve two different social media platforms, eg, an article posted on a first social media platform by the entity of interest could be shared by another entity on a second social media platform where they have a social media account.
  • Some other types of interactions between different social media platforms include, but are not limited to the following:
  • FIG. 18 there is shown a system overview diagram of a risk profiling system 1000 for determining the risk profile of an entity of interest based on their social media presence according to another illustrative embodiment.
  • the various computer modules, servers and databases and data stores described both above and below may be implemented on a computer system 1010 which may comprise any combination of multiple different individual hardware or software processors configured to run the various computing tasks that are described in functional terms below.
  • the computing system is based on a web architecture where the webserver 1018 functions to provide the middle tier between the Internet 1020 and the operator 1090 of the risk profiling system 1000 .
  • the user interface 1040 of the risk profiling system 1000 consists of webpages or content served by the webserver and is accessed by a standard web browser as a “web” application 1041 by the operator 1090 .
  • the web based architecture allows an operator 1090 to access the application from any device with a modern web browser, eg, a desktop PC or tablet. As such, this architecture does not require an operator 1090 to install specific software to use the application. It also provides flexibility when deploying the application as the server-side component may be deployed either on hardware managed by the operator's 1090 organisation, or in a cloud environment and managed on their behalf
  • a “thick-client” architecture where the user interface is provided by a desktop application or app installed on the operator's device. This would still require a server component to support the functionality but can provide an enhanced user experience that is more integrated with the device capabilities or operating system that the application is installed on.
  • risk profile system 1090 includes a reverse proxy 1087 which functions as an intermediary between the operator 1090 who may be accessing the risk profiling system 1000 remotely by the Internet and the webserver application 1018 of the risk profiling system 1000 .
  • network traffic is secured between the user interface 1040 and reverse proxy 1087 by adopting the secure HTTPS (HTTPS) protocol while network traffic between webserver 1018 and the reverse proxy 1087 need not be encrypted as it is internal to the risk profiling system 1000 and uses the standard HTTP protocol.
  • HTTPS secure HTTPS
  • network traffic between webserver 1018 and the reverse proxy 1087 need not be encrypted as it is internal to the risk profiling system 1000 and uses the standard HTTP protocol.
  • HTTPS secure HTTPS
  • the network traffic between the web application 1041 and the server 1018 employs a Representational State Transfer (REST) API that defines a set of messages and operations that can be exchanged over HTTP.
  • This API is used to configure the risk profiling system 1000 and retrieve the results of the risk profile determinations.
  • the REST API provides an interface to the risk profiling system 1000 and may be accessed by different user facing applications, eg, an iOS app could be developed that uses the same API calls as the web application 1041 .
  • risk profiling system 1000 accesses the internet 1020 by a third party VPN provider that provides access to the Internet 1020 by a VPN server 1080 to which risk profiling system 1000 connects to by a VPN client 1085 forming in this example a component or module of the risk profiling system 1000 .
  • all of the network traffic between the internet 1020 and the risk profiling system 1000 may be encrypted by virtue of the secure socket layer (SSL) connection between the VPN client 1085 and the VPN server 1080 and the HTTPS links between the VPN server 1080 and the Internet 1020 .
  • an operator 1090 may also access the Internet generally through their access to the risk profiling system 1000 by the web browser based user interface 1040 as will be described below.
  • Risk profiling system 1000 communicates via the VPN Server/Client arrangement 1080 , 1085 to interrogate social media platforms 1022 (eg SMP 1 , SMP 2 , . . . , SMP N) as described above.
  • risk profiling system 1000 can also connect to various cloud based application programing interfaces 1023 (eg, API 1 , API 2 , . . . , AMP N) to provide specialised based machine learning and artificial intelligence type processing available on the Internet to risk profiling system 1000 .
  • a cloud based API may provide a translation capability.
  • a cloud based API may provide an image object classification capability.
  • VPN Server/Client arrangement 1080 , 1085 also functions to obfuscate the source IP address of the risk profiling system 1000 to provide anonymity for risk profiling system 1000 and operator 1090 .
  • Risk profiling system 1000 further includes an interrogation server 1011 operable to interrogate social media platforms 1022 as has been described above.
  • interrogation server 1011 comprises a webscraping module 1070 that can instantiate multiple instances of a web browser 1071 .
  • Webscraping module 1070 interfaces to the risk profiling system 1000 by a driver interface 1072 that processes interrogation requests from the risk profiling system 1000 into equivalent HTTP requests operable on each of the social media platforms 1022 . In this manner, content is “scraped” from the social media platforms 122 for further processing.
  • the interrogation server 1011 employs user-provided credentials to access the social media platforms. These credentials can be an API key or a username and password for authenticating to the social media platform's web interface. For API keys, the application makes API requests to collect data from the social media platform. For credentials where there is a username and password, the webscraping module 1070 starts a web browser 1071 and programmatically controls it to login using the provided credentials, browse to the appropriate page and read content from the page. From the social media platform's perspective, the application appears to be a user browsing their service. This web-scraping collection method provides access to all content visible to a logged in user which may be more than would be available via API-based collection methods to the particular social media platform.
  • credentials can be an API key or a username and password for authenticating to the social media platform's web interface.
  • the application makes API requests to collect data from the social media platform.
  • the webscraping module 1070 starts a web browser 1071 and programmatically controls it to login using the provided credentials, browse to
  • the content from the webscraping module 1070 is stored on a distributed fault tolerant no-SQL database 151 that provides data distribution across a cluster of nodes for data replication purposes.
  • database 151 is a RIAK based database.
  • the database could be a Redis key-value store or any S3-compatible object store.
  • risk profiling system 1000 further includes a HTTPS proxy server 1012 that allows the operator 1090 to connect to the Internet 1021 by VPN Server and Client 1080 , 1085 arrangement using the same IP address as the risk profiling system 1000 .
  • the web browser employed by operator 1090 includes an SSL proxy extension or plugin 1042 which connects by HTTPS to the HTTPS proxy server 1012 .
  • this allows the operator 1090 to both securely and anonymously browse the general Internet 1020 while operating risk profiling system 1000 , while presenting the same IP address as the risk profiling system 1000 to the social media platforms.
  • Risk profiling system 1000 includes a collection server 1013 that functions to process the content returned by webscraping module 1070 and stored in database 1051 as collected data items and then populate an entity data structure that corresponds to the entity of interest as has been described above.
  • Collection server 1013 also functions to classify or identify collected data items as a social media activity and then further as a social media interaction where the social media activity concerns an interaction between the entity of interest and another social media account corresponding to another entity.
  • the other social media account may be on a different social media platform (eg, SMP 2 ) as compared to the social media platform that is being examined for the entity of interest (eg, SMP 1 ).
  • Risk profiling system 1000 further includes a link analysis server 1014 that functions to generate the linked social network data structure assign the individual link risk measures and then determine the risk profile of the entity of interest as has been described above.
  • the data associated with the entity data structure and the linked social network data structure determined by risk profiling system 1000 is stored in a no-SQL database 152 which in this example is a 3-node ElasticsearchTM cluster.
  • Elasticsearch is a database or datastore optimised for searching large collections of semi-structured documents. Elasticsearch constructs an inverted index that allows the application to efficiently lookup content in text fields, eg, searching for a word in the text of posts on social media.
  • the datastore supports “fuzzy” searches, eg, by synonyms or misspellings.
  • the datastore is SolrTM.
  • link analysis server 1014 may connect to cloud based APIs 1023 to assist in the analysis task by VPN Server/Client arrangement 1080 , 1085 .
  • risk profiling system 1000 being based on a webserver architecture, also includes command and control module 1019 , that functions to implement the risk profiling method in accordance with the present disclosure.
  • Data associated with the application state of the risk profiling system 1000 such as processor status, pending task details and log and error data are stored in a standard relational database 1053 .
  • Risk profiling system 1000 in this embodiment further includes a support module 1048 that allows an operator to access the system through a SSH link to monitor and maintain the risk profile system 1000 .
  • the SSH connection allows an operator 1090 to login to the webserver 1018 from a remote location to facilitate maintenance.
  • SSH access provides a terminal where the operator 1090 can execute commands to, eg, patch or reboot the webserver 1018 .
  • the web application 1041 provides an operator 1090 with an administrator role access to additional features that can support operational maintenance, eg, monitoring running tasks.
  • a single component may be replaced by multiple components, and multiple components may be replaced by a single component, to perform a given function or functions. Except where such substitution would not be operative to practice embodiments of the present disclosure, such substitution is within the scope of the present disclosure.
  • any of the servers described in the present disclosure may be implemented as logical processes on a single computer processor or alternatively distributed amongst a group of networked servers that are located and configured for cooperative functions.
  • Various embodiments of the systems and methods of the present disclosure may employ one or more electronic computer networks to promote communication among different components, transfer data, or to share resources and information.
  • Such computer networks can be classified according to the hardware and software technology that is used to interconnect the devices in the network, such as optical fibre, Ethernet, wireless LAN, HomePNA, power line communication or G.hn.
  • the computer networks may also be embodied as one or more of the following types of networks: local area network (LAN); metropolitan area network (MAN); wide area network (WAN); virtual private network (VPN); storage area network (SAN); or global area network (GAN), among other network varieties.
  • LAN local area network
  • MAN metropolitan area network
  • WAN wide area network
  • VPN virtual private network
  • SAN storage area network
  • GAN global area network

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Human Resources & Organizations (AREA)
  • Economics (AREA)
  • Strategic Management (AREA)
  • Marketing (AREA)
  • General Business, Economics & Management (AREA)
  • Tourism & Hospitality (AREA)
  • Development Economics (AREA)
  • Finance (AREA)
  • Accounting & Taxation (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Primary Health Care (AREA)
  • Educational Administration (AREA)
  • General Engineering & Computer Science (AREA)
  • Computational Linguistics (AREA)
  • Computing Systems (AREA)
  • Operations Research (AREA)
  • Computer Security & Cryptography (AREA)
  • Technology Law (AREA)
  • Game Theory and Decision Science (AREA)
  • Quality & Reliability (AREA)
  • Databases & Information Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Artificial Intelligence (AREA)
  • Audiology, Speech & Language Pathology (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
US17/263,967 2018-07-30 2018-10-15 Method and system for risk determination Pending US20210166331A1 (en)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
AU2018902753A AU2018902753A0 (en) 2018-07-30 Method and system for risk determination
AU2018902753 2018-07-30
PCT/AU2018/000196 WO2020023990A1 (fr) 2018-07-30 2018-10-15 Procédé et système de détermination de risque

Publications (1)

Publication Number Publication Date
US20210166331A1 true US20210166331A1 (en) 2021-06-03

Family

ID=69230441

Family Applications (1)

Application Number Title Priority Date Filing Date
US17/263,967 Pending US20210166331A1 (en) 2018-07-30 2018-10-15 Method and system for risk determination

Country Status (5)

Country Link
US (1) US20210166331A1 (fr)
EP (1) EP3815028A4 (fr)
AU (1) AU2018435480A1 (fr)
CA (1) CA3106262A1 (fr)
WO (1) WO2020023990A1 (fr)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220182840A1 (en) * 2020-12-09 2022-06-09 Nec Corporation Transmission apparatus recognition apparatus, learning apparatus, transmission apparatus recognition method, and, learning method
US20220201028A1 (en) * 2019-05-17 2022-06-23 Nippon Telegraph And Telephone Corporation Caution-needed ip address estimation apparatus, monitoring system, caution-needed ip address providing method and program
US11838309B1 (en) * 2020-08-19 2023-12-05 Roger Martin System and method for risk evaluation and reputational scoring of social media accounts

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070005654A1 (en) * 2005-05-20 2007-01-04 Avichai Schachar Systems and methods for analyzing relationships between entities
US20090248465A1 (en) * 2008-03-28 2009-10-01 Fortent Americas Inc. Assessment of risk associated with doing business with a party
AU2010306534A1 (en) * 2009-12-07 2011-06-23 Bloomberg Finance L.P. Unified content scanning and reporting engine
US20120226579A1 (en) * 2011-03-01 2012-09-06 Ha Vida Fraud detection based on social data
US20130238600A1 (en) * 2012-03-07 2013-09-12 Cleanport, BV System, Method and Computer Program Product for Normalizing Data Obtained from a Plurality of Social Networks
KR20150092377A (ko) * 2014-02-03 2015-08-13 주식회사 엘지유플러스 이기종 서비스간 친구추천 제공서버 및 그 친구추천 제공방법, 네트워크 서비스 서버 및 그 서비스 제공방법
CN106033575A (zh) * 2015-03-11 2016-10-19 阿里巴巴集团控股有限公司 风险账户识别方法及装置
US20170206557A1 (en) * 2014-06-23 2017-07-20 The Board Of Regents Of The University Of Texas System Real-time, stream data information integration and analytics system
US20180152471A1 (en) * 2016-11-30 2018-05-31 Agari Data, Inc. Detecting computer security risk based on previously observed communications
CN108616447A (zh) * 2018-04-17 2018-10-02 北京达佳互联信息技术有限公司 社交网络的用户关系引导方法、装置及电子设备

Patent Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070005654A1 (en) * 2005-05-20 2007-01-04 Avichai Schachar Systems and methods for analyzing relationships between entities
US20090248465A1 (en) * 2008-03-28 2009-10-01 Fortent Americas Inc. Assessment of risk associated with doing business with a party
AU2010306534A1 (en) * 2009-12-07 2011-06-23 Bloomberg Finance L.P. Unified content scanning and reporting engine
US20120226579A1 (en) * 2011-03-01 2012-09-06 Ha Vida Fraud detection based on social data
US20130238600A1 (en) * 2012-03-07 2013-09-12 Cleanport, BV System, Method and Computer Program Product for Normalizing Data Obtained from a Plurality of Social Networks
KR20150092377A (ko) * 2014-02-03 2015-08-13 주식회사 엘지유플러스 이기종 서비스간 친구추천 제공서버 및 그 친구추천 제공방법, 네트워크 서비스 서버 및 그 서비스 제공방법
US20170206557A1 (en) * 2014-06-23 2017-07-20 The Board Of Regents Of The University Of Texas System Real-time, stream data information integration and analytics system
CN106033575A (zh) * 2015-03-11 2016-10-19 阿里巴巴集团控股有限公司 风险账户识别方法及装置
US20180152471A1 (en) * 2016-11-30 2018-05-31 Agari Data, Inc. Detecting computer security risk based on previously observed communications
CN108616447A (zh) * 2018-04-17 2018-10-02 北京达佳互联信息技术有限公司 社交网络的用户关系引导方法、装置及电子设备

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220201028A1 (en) * 2019-05-17 2022-06-23 Nippon Telegraph And Telephone Corporation Caution-needed ip address estimation apparatus, monitoring system, caution-needed ip address providing method and program
US11838309B1 (en) * 2020-08-19 2023-12-05 Roger Martin System and method for risk evaluation and reputational scoring of social media accounts
US20220182840A1 (en) * 2020-12-09 2022-06-09 Nec Corporation Transmission apparatus recognition apparatus, learning apparatus, transmission apparatus recognition method, and, learning method

Also Published As

Publication number Publication date
AU2018435480A1 (en) 2021-02-18
EP3815028A4 (fr) 2022-03-09
EP3815028A1 (fr) 2021-05-05
WO2020023990A1 (fr) 2020-02-06
CA3106262A1 (fr) 2020-02-06

Similar Documents

Publication Publication Date Title
US11886555B2 (en) Online identity reputation
Alam et al. Processing social media images by combining human and machine computing during crises
US9589047B2 (en) Categorizing users based on similarity of posed questions, answers and supporting evidence
Gundecha et al. Mining social media: a brief introduction
US20180218015A1 (en) Intelligent internet system with adaptive user interface providing one-step access to knowledge
US10091324B2 (en) Content feed for facilitating topic discovery in social networking environments
US9043358B2 (en) Enterprise search over private and public data
Mena Machine learning forensics for law enforcement, security, and intelligence
Johansson et al. Estimating citizen alertness in crises using social media monitoring and analysis
US11947605B2 (en) Automatically separating claim into elements/limitations and automatically finding art for each element/limitation
US20170017638A1 (en) Meme detection in digital chatter analysis
Cossu et al. A review of features for the discrimination of twitter users: application to the prediction of offline influence
US20140019457A1 (en) System and method for indexing, ranking, and analyzing web activity within an event driven architecture
US20160357756A1 (en) Methods and apparatus for integrating search results of a local search engine with search results of a global generic search engine
US20210166331A1 (en) Method and system for risk determination
US9201962B2 (en) Techniques for identifying and linking related content
US20220358344A1 (en) System and method for generating a user behavioral avatar for a social media platform
Buccafurri et al. A model to support multi-social-network applications
Dongo et al. A qualitative and quantitative comparison between Web scraping and API methods for Twitter credibility analysis
Tundis et al. Similarity analysis of criminals on social networks: An example on Twitter
Valliyammai et al. Semantics-based sensitive topic diffusion detection framework towards privacy aware online social networks
Das et al. Dataset bias: A case study for visual question answering
Wu et al. CEPTM: A Cross‐Edge Model for Diverse Personalization Service and Topic Migration in MEC
Kumar et al. Web Mining and Web Usage Mining for Various Human-Driven Applications
El Mendili et al. Enhancing detection of malicious profiles and spam tweets with an automated honeypot framework powered by deep learning

Legal Events

Date Code Title Description
STPP Information on status: patent application and granting procedure in general

Free format text: APPLICATION DISPATCHED FROM PREEXAM, NOT YET DOCKETED

AS Assignment

Owner name: FIVECAST PTY LTD, AUSTRALIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BUGLAK, ROSTYSLAV;BLOCKOW, DAVID;LOWRY, MATTHEW;AND OTHERS;REEL/FRAME:057031/0330

Effective date: 20210729

STPP Information on status: patent application and granting procedure in general

Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION

STPP Information on status: patent application and granting procedure in general

Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER

STPP Information on status: patent application and granting procedure in general

Free format text: FINAL REJECTION COUNTED, NOT YET MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: FINAL REJECTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION

STPP Information on status: patent application and granting procedure in general

Free format text: NON FINAL ACTION MAILED