Abstract:
User login information submitted as part of an attempt to log into a computer system is evaluated for unauthorized or illegitimate use based on indicators of suspicious behavior. Example indicators of suspicious behavior include whether the login information is known to have been compromised, whether the login attempt originates from a network source or a physical source that has previously originated an attempt to log in using login information known to have been compromised, and whether multiple login attempts using the login information from multiple users has originated from the source. A suspicion index can be calculated based on the presence of the indicators of suspicious behavior. The system can require enhanced authentication based on the measurement of suspicious behavior.
Abstract:
In one embodiment, a method includes accessing a social graph comprising nodes and a edges connecting the nodes, receiving from a first user a query inputted at a search client, the search client being associated with context data from a page associated with the search client, such that the context data identifies one or more nodes associated with the page, generating search results corresponding to the query, wherein each of the search results corresponds to a node, and scoring the search results based at least in part on the context data associated with the search client. The context data may identify a social context of the page, which can include tags, comments, likes, commenters, and the like.
Abstract:
When a social networking system receives a report of malicious activity, the social networking system calculates disabled connectivity score for a user reporting the activity or identified by the report. The disabled connectivity score indicates how strongly the user is associated with other objects that have been disabled by the social networking system. Hence, the disabled connectivity score provides a measure of the user's trustworthiness that is used to determine a type of action to be taken in response to the report. Examples of actions that may be taken when a report is received include ignoring the report, further reviewing the report, or taking remedial action by disabling or deleting an object maintained by the social networking system that is the subject of the report.
Abstract:
When a social networking system receives a report of malicious activity, the social networking system calculates disabled connectivity score for a user reporting the activity or identified by the report. The disabled connectivity score indicates how strongly the user is associated with other objects that have been disabled by the social networking system. Hence, the disabled connectivity score provides a measure of the user's trustworthiness that is used to determine a type of action to be taken in response to the report. Examples of actions that may be taken when a report is received include ignoring the report, further reviewing the report, or taking remedial action by disabling or deleting an object maintained by the social networking system that is the subject of the report.
Abstract:
A method of operation of a URL spam detection system includes: identifying a feature dimension of a user action on a social networking system to detect anomalies; extracting URL chunks from a content associated with the user action; aggregating a non-content feature of the user action along the feature dimension into a URL distribution store to produce a feature distribution for each of the URL chunks; determining whether the feature distribution of a particular URL chunk within the URL chunks exceeds an expectation threshold for the feature dimension; and classifying the particular URL chunk as an illegitimate URL when the feature distribution exceeds the expectation threshold to restrict access to a particular URL chunk on a social networking system.
Abstract:
In one embodiment, a method includes accessing a data set comprising a list of objects matching a query, a pre-determined static-rank for each object calculated based on a static-scoring algorithm, and a final-rank for each object calculated based on a final-scoring algorithm, and revising the static-scoring algorithm based on a comparison of the static-ranks and the final-ranks of each object listed in the data set, where the static-scoring algorithm is revised in order to reduce a difference between the static-ranks and final-ranks of the objects listed in the data set.
Abstract:
In one embodiment, a method includes accessing a set of queries of an online social network received from one or more users of the online social network, retrieving for each query a number of objects that match at least a portion of the query from one or more data stores associated with the online social network, where each object is associated with a pre-determined static-score based on a static-scoring algorithm, calculating a final-score for each retrieved object based on a final-scoring algorithm, and determining one or more revised static-scores for one or more of the retrieved objects based on a comparison of the final-scores and the static-scores of the retrieved objects.
Abstract:
In one embodiment, a method includes receiving, from a client system, a query inputted by a first user at a search client, the search client being associated with context data from a page associated with the search client. The context data identifies: a type of the page associated with the search client, a social context of the page associated with the search client, and a threshold number of search results for display. The method includes identifying one or more entities matching the query and ranking each of the identified entities based at least in part on the social context and the type of the page associated with the search client. The method includes sending, to the client system, instructions for presenting a search-results interface including the threshold number of search results corresponding to the threshold number of top ranking identified entities.
Abstract:
In one embodiment, a method includes accessing a data set including a list of objects matching a query command and a score for each of the listed objects, where the query command is generated by parsing a query using a parsing algorithm, and where the score for each of the listed objects is calculated based on a scoring algorithm. The method also includes generating multiple subsets of the data set, each subset including one or more of the listed objects, and calculating, for each subset, a measure of score-quality associated with the scores of the objects in the subset and a measure of CPU-power associated with an amount of processing power required for retrieving the objects in the subset. The method also includes revising the parsing algorithm based on a comparison of the measures of score-quality and the measures of CPU-power associated with one or more of the subsets.
Abstract:
In one embodiment, a method includes receiving an indication that a first user has interacted with a first object within a newsfeed of an online social network, the first object including one or more n-grams, and identifying a list of second objects from one or more data stores, each second object matching one or more of the n-grams from the first object and being identified based at least in part on a predetermined static-rank of the second object. The method also includes calculating a final-rank for each of the identified second objects and determining one or more revised static-ranks for one or more of the identified second objects based on a comparison of the final-ranks and the static-ranks of the identified second objects.