U.S. patent application number 17/263967 was filed with the patent office on 2021-06-03 for method and system for risk determination.
The applicant listed for this patent is FIVECAST PTY LTD. Invention is credited to David BLOCKOW, Rostyslav BUGLAK, Brenton COOPER, Aaron LANE, Matthew LOWRY.
Application Number | 20210166331 17/263967 |
Document ID | / |
Family ID | 1000005403131 |
Filed Date | 2021-06-03 |
United States Patent
Application |
20210166331 |
Kind Code |
A1 |
BUGLAK; Rostyslav ; et
al. |
June 3, 2021 |
METHOD AND SYSTEM FOR RISK DETERMINATION
Abstract
A method for determining a risk profile of an entity of
interest, comprising interrogating a social media platform to
determine a social media account corresponding to the entity of
interest and generating a linked social network data structure
linking the social media account corresponding to the entity of
interest to one or more other social media accounts on the social
media platform corresponding to other entities, where an individual
link is based on one or more social media interactions between the
social media account corresponding to the entity of interest and
each of the one or more other social media accounts corresponding
to other entities. The method further involves assigning an
individual link risk measure to one or more of the individual links
of the linked network data structure, the individual link risk
measure based on a risk assessment of the one or more social media
interactions upon which the individual link is based on and a risk
profile of the entity of interest based on an aggregated risk
measure based on the linked social network data structure
comprising the individual link risk measures.
Inventors: |
BUGLAK; Rostyslav; (Kent
Town, South Australia, AU) ; BLOCKOW; David; (Kent
Town, South Australia, AU) ; LOWRY; Matthew; (Kent
Town, South Australia, AU) ; LANE; Aaron; (Kent Town,
South Australia, AU) ; COOPER; Brenton; (Kent Town,
South Australia, AU) |
|
Applicant: |
Name |
City |
State |
Country |
Type |
FIVECAST PTY LTD |
Kent Town, South Australia |
|
AU |
|
|
Family ID: |
1000005403131 |
Appl. No.: |
17/263967 |
Filed: |
October 15, 2018 |
PCT Filed: |
October 15, 2018 |
PCT NO: |
PCT/AU2018/000196 |
371 Date: |
January 28, 2021 |
Current U.S.
Class: |
1/1 |
Current CPC
Class: |
G06F 16/24578 20190101;
G06F 40/279 20200101; G06Q 50/01 20130101 |
International
Class: |
G06Q 50/00 20060101
G06Q050/00; G06F 40/279 20060101 G06F040/279; G06F 16/2457 20060101
G06F016/2457 |
Foreign Application Data
Date |
Code |
Application Number |
Jul 30, 2018 |
AU |
2018902753 |
Claims
1. A computer-implemented method comprising: interrogating by one
or more electronic processors of a computer system a social media
platform to determine a social media account corresponding to an
entity of interest; generating by the one or more electronic
processors a linked social network data structure linking the
social media account corresponding to the entity of interest to one
or more other social media accounts on the social media platform
corresponding to other entities, wherein an individual link is
based on one or more social media interactions between the social
media account corresponding to the entity of interest and each of
the one or more other social media accounts corresponding to other
entities; assigning by the one or more electronic processors an
individual link risk measure to one or more of the individual links
of the linked social network data structure, the individual link
risk measure based on a risk assessment of the one or more social
media interactions upon which the individual link is based on; and
determining by the one or more electronic processors the a risk
profile of the entity of interest based on an aggregated risk
measure based on the linked social network data structure
comprising the individual link risk measures.
2. The computer-implemented method of claim 1, wherein
interrogating the social media account comprises: providing entity
selection information characterising the entity of interest;
interrogating the social media platform to identify one or more
candidate social media accounts, each candidate social media
account comprising candidate information; ranking the one or more
candidate social media accounts based on a degree of similarity
between the entity selection information and candidate information
for each candidate social media account to provide a set of ranked
candidate social media accounts; and selecting the social media
account corresponding to the entity of interest from the set of
ranked candidate social media accounts.
3. The computer-implemented method of claim 1, wherein generating
the linked social network data structure comprises: collecting data
items from the social media account; determining data items
corresponding to social media activities; and determining social
media interactions for the social media account based on the social
media activities that relate to an interaction between the entity
of interest and another social media account corresponding to
another entity;
4. The computer-implemented method of claim 3, wherein determining
data items corresponding to social media activities includes
comparing a data item with a previous version of the data item to
identify a change in the data item.
5. The computer-implemented method of claim 1, wherein determining
social media interactions includes determining whether the social
media account of the entity of interest and another social media
account corresponding to another entity have interacted with common
content on the social media platform.
6. The computer-implemented method of claim 1, wherein the risk
assessment is based on a textual analysis of the one or more social
media interactions.
7. The computer-implemented method of claim 6, wherein the textual
analysis includes a measure of a relevance of the one or more
social media interactions in combination with a measure of a
sentiment of the one or more social media interactions.
8. The computer-implemented method of claim 1, wherein the risk
assessment is based on an image analysis of the one or more social
media interactions.
9. The computer-implemented method of claim 1, wherein an initial
entity risk measure is determined for each of the one or more other
social media accounts linked to the social media account of the
entity of interest.
10. The computer-implemented method of claim 9, wherein the
individual link risk measure for a link between the entity of
interest and another entity is also based on the initial entity
risk measure for the other entity.
11. The computer-implemented method of claim 10, further including
interrogating by the one or more electronic processors additional
social media platforms to determine one or more related social
media accounts corresponding to the entity of interest.
12. The computer-implemented method of claim 11, wherein generating
the linked social network data structure includes: for each of the
related social media accounts determining links based on social
media interactions between each of the related social media
accounts of the entity of interest and further social media
accounts on the social media platform or the additional social
media platforms corresponding to other entities.
13. The computer-implemented method of claim 1, wherein the linked
social network data structure and the risk profile of the entity of
interest is updated over time.
14. A computer-implemented system comprising: an interrogation
server comprising one or more processors configured to interrogate
a social media platform to determine a social media account
corresponding to an entity of interest; a collection server
comprising one or more processors configured to generate a linked
social network data structure linking the social media account
corresponding to the entity of interest to one or more other social
media accounts on the social media platform corresponding to other
entities, wherein an individual link is based on one or more social
media interactions between the social media account corresponding
to the entity of interest and each of the one or more other social
media accounts corresponding to other entities; and a link analysis
server comprising one or more processors configured to assign an
individual link risk measure to one or more of the individual links
of the linked social network data structure, the individual link
risk measure based on a risk assessment of the one or more social
media interactions upon which the individual link is based on and
to then determine a risk profile of the entity of interest based on
an aggregated risk measure based on the linked social network data
structure comprising the individual link risk measures.
15. The computer-implemented system of claim 14, wherein
interrogating the social media account by the interrogation server
comprises: providing entity selection information characterising
the entity of interest; interrogating the social media platform to
identify one or more candidate social media accounts, each
candidate social media account comprising candidate information;
ranking the one or more candidate social media accounts based on a
degree of similarity between the entity selection information and
candidate information for each candidate social media account to
provide a set of ranked candidate social media accounts; and
selecting the social media account corresponding to the entity of
interest from the set of ranked candidate social media
accounts.
16. The computer-implemented system of claim 14, wherein generating
the linked social network data structure by the collection server
comprises: collecting data items from the social media account;
determining data items corresponding to social media activities;
and determining social media interactions for the social media
account based on the social media activities that relate to an
interaction between the entity of interest and another social media
account corresponding to another entity.
17. The computer-implemented system of claim 16, wherein
determining data items corresponding to social media activities
includes comparing a data item with a previous version of the data
item to identify a change in the data item.
18. The computer-implemented system of claim 14, wherein
determining social media interactions includes determining whether
the social media account of the entity of interest and another
social media account corresponding to another entity have
interacted with common content on the social media platform.
19. The computer-implemented system of claim 14, wherein the risk
assessment is based on a textual analysis of the one or more social
media interactions.
20. The computer-implemented system of claim 19, wherein the
textual analysis includes a measure of a relevance of the one or
more social media interactions in combination with a measure of a
sentiment of the one or more social media interactions.
21. The computer-implemented system of claim 14, wherein the risk
assessment is based on an image analysis of the one or more social
media interactions.
22. The computer-implemented system of claim 14, wherein an initial
entity risk measure is determined by the link analysis server for
each of the one or more other social media accounts linked to the
social media account of the entity of interest.
23. The computer-implemented system of claim 22, wherein the
individual link risk measure for a link between the entity of
interest and another entity is also based on the initial entity
risk measure for the other entity.
24. The computer-implemented system of claim 23, further including
interrogating by the collection server additional social media
platforms to determine one or more related social media accounts
corresponding to the entity of interest.
25. The computer-implemented system of claim 24, wherein generating
the linked social network data structure by the link analysis
server includes: for each of the related social media accounts
determining links based on social media interactions between each
of the related social media accounts of the entity of interest and
further social media accounts on the social media platform or the
additional social media platforms corresponding to other
entities.
26. The computer-implemented system of claim 14, wherein the linked
social network data structure and the risk profile of the entity of
interest is updated by the link analysis server over time.
27. A system comprising: one or more processors; memory in
electronic communication with the one or more processors; and
instructions stored in the memory and operable, when executed by
the one or more processors, to cause the system to: interrogate a
social media platform to determine a social media account
corresponding to an entity of interest; generate a linked social
network data structure linking the social media account
corresponding to the entity of interest to one or more other social
media accounts on the social media platform corresponding to other
entities, wherein an individual link is based on one or more social
media interactions between the social media account corresponding
to the entity of interest and each of the one or more other social
media accounts corresponding to other entities; assign an
individual link risk measure to one or more of the individual links
of the linked social network data structure, the individual link
risk measure based on a risk assessment of the one or more social
media interactions upon which the individual link is based on; and
determine a risk profile of the entity of interest based on an
aggregated risk measure based on the linked social network data
structure comprising the individual link risk measures.
Description
PRIORITY DOCUMENTS
[0001] The present application claims priority from Australian
Provisional Patent Application No 2018902753 titled "METHOD AND
SYSTEM FOR RISK DETERMINATION" and filed on 30 Jul. 2018, the
content of which is hereby incorporated by reference in its
entirety.
TECHNICAL FIELD
[0002] The present disclosure relates to determining the risk
profile of an entity having an associated online social media
presence. In a particular form, the present disclosure relates to
determining a risk profile of an entity based on their online
relationships.
BACKGROUND
[0003] Determining the risk profile of entities such as a person,
business, organisation or other groups is an important
consideration in many areas of commercial and law enforcement
activities. One example is characterising the risk profile of an
entity to determine whether a commercial transaction should be
entered into with the entity such as providing credit or an
insurance policy.
[0004] In the area of national security, where entities are subject
to a security vetting process that allows them to hold a security
clearance or engage in activities with the law enforcement body or
government, determining a risk profile is an important
consideration as it allows an assessment to be made of the
likelihood of future behaviour which may be problematical.
Similarly, law enforcement can also be involved in providing
"police" clearances where a cleared entity may be able to provide a
range of services such as children related activities. Typically,
this involves determining whether clearance should be provided
based on past behaviour but it would be advantageous if likely
future behaviour could be characterised in this assessment.
[0005] With the advent of the Internet, there is a wealth of
potential data that is available online from entities particularly
on social media platforms such as Reddit.TM., Google+.TM.,
Twitter.TM., LinkedIn.TM. and the like which could potentially form
the basis of determining a risk profile. However, the number of
entities of potential interest and the sheer volume of content that
is available online, in addition to its constantly changing nature,
makes this an extremely challenging task. In theory, the
dynamically varying and interrelated nature of the content which is
unique to social media platforms could be employed to monitor an
entity's behaviour to determine whether they may be engaging in
illegal activities or posing a threat to national security or if
there is likelihood they may do so.
[0006] Analysts in the law enforcement and national security
community are faced with the difficult problem of finding "the
needle in the haystack" and they employ a range of manual processes
to prioritise which potential threats should be further
investigated. Increasingly, they are looking to online footprints,
and the behaviours that might be manifested in the online
footprint, as an early indicator of risk, however, with the number
of persons of interest, and the sheer volume of online content, it
is impractical for users to monitor all persons of interest.
[0007] It is against this background that there is therefore a need
for tools to determine a risk profile that employs the special
characteristics of the data available online from social media
platforms.
[0008] SUMMARY
[0009] In a first aspect, the present disclosure provides a
computer-implemented method for determining a risk profile of an
entity of interest, comprising:
[0010] interrogating by one or more electronic processors of a
computer system a social media platform to determine a social media
account corresponding to the entity of interest;
[0011] generating by the one or more electronic processors a linked
social network data structure linking the social media account
corresponding to the entity of interest to one or more other social
media accounts on the social media platform corresponding to other
entities, wherein an individual link is based on one or more social
media interactions between the social media account corresponding
to the entity of interest and each of the one or more other social
media accounts corresponding to other entities;
[0012] assigning by the one or more electronic processors an
individual link risk measure to one or more of the individual links
of the linked network data structure, the individual link risk
measure based on a risk assessment of the one or more social media
interactions upon which the individual link is based on; and
[0013] determining by the one or more electronic processors the
risk profile of the entity of interest based on an aggregated risk
measure based on the linked social network data structure
comprising the individual link risk measures.
[0014] In another form, interrogating the social media account
comprises:
[0015] providing entity selection information characterising the
entity of interest;
[0016] interrogating the social media platform to identify one or
more candidate social media accounts, each candidate social media
account comprising candidate information;
[0017] ranking the one or more candidate social media accounts
based on a degree of similarity between the entity selection
information and candidate information for each candidate social
media account to provide a set of ranked candidate social media
accounts; and
[0018] selecting the social media account corresponding to the
entity of interest from the set of ranked candidate social media
accounts.
[0019] In another form, generating the linked social network data
structure comprises:
[0020] collecting data items from the social media account;
[0021] determining data items corresponding to social media
activities;
[0022] determining social media interactions for the social media
account based on the social media activities that relate to an
interaction between the entity of interest and another social media
account corresponding to another entity;
[0023] In another form, determining data items corresponding to
social media activities includes comparing a data item with a
previous version of a data item to identify a change in the data
item.
[0024] In another form, determining social media interactions
includes determining whether the social media account of the entity
of interest and another social media account corresponding to
another entity have interacted with common content on the social
media platform.
[0025] In another form, the risk assessment is based on a textual
analysis of the one or more social media interactions.
[0026] In another form, the textual analysis includes a measure of
a relevance of the social media interaction in combination with a
measure of a sentiment of the one or more social media
interactions.
[0027] In another form, the risk assessment is based on an image
analysis of the one or more social media interactions.
[0028] In another form, an initial entity risk measure is
determined for each of the one or more other social media accounts
linked to the social media account of the entity of interest.
[0029] In another form, the individual link risk measure for a link
between the entity of interest and an other entity is also based on
the initial entity risk measure for the other entity.
[0030] In another form, the method further includes interrogating
by the one or more electronic processors additional social media
platforms to determine one or more related social media accounts
corresponding to the entity of interest.
[0031] In another form, generating the linked social network data
structure includes:
[0032] for each of the related social media accounts determining
links based on social media interactions between each of the
related social media accounts of the entity of interest and further
social media accounts on the social media platform or the
additional social media platforms corresponding to other
entities.
[0033] In another form, the linked network data structure and the
risk profile of the entity of interest is updated over time.
[0034] In a second aspect, the present disclosure provides a
computer-implemented risk profiling system for determining a risk
profile of an entity of interest, comprising:
[0035] an interrogation server comprising one or more processors
configured to interrogate a social media platform to determine a
social media account corresponding to the entity of interest;
[0036] a collection server comprising one or more processors
configured to generate a linked social network data structure
linking the social media account corresponding to the entity of
interest to one or more other social media accounts on the social
media platform corresponding to other entities, wherein an
individual link is based on one or more social media interactions
between the social media account corresponding to the entity of
interest and each of the one or more other social media accounts
corresponding to other entities;
[0037] a link analysis server comprising one or more processors
configured to assign an individual link risk measure to one or more
of the individual links of the linked network data structure, the
individual link risk measure based on a risk assessment of the one
or more social media interactions upon which the individual link is
based on and to then determine the risk profile of the entity of
interest based on an aggregated risk measure based on the linked
social network data structure comprising the individual link risk
measures.
[0038] In another form, interrogating the social media account by
the interrogation server comprises:
[0039] providing entity selection information characterising the
entity of interest;
[0040] interrogating the social media platform to identify one or
more candidate social media accounts, each candidate social media
account comprising candidate information;
[0041] ranking the one or more candidate social media accounts
based on a degree of similarity between the entity selection
information and candidate information for each candidate social
media account to provide a set of ranked candidate social media
accounts; and
[0042] selecting the social media account corresponding to the
entity of interest from the set of ranked candidate social media
accounts.
[0043] In another form, generating the linked social network data
structure by the collection server comprises:
[0044] collecting data items from the social media account;
[0045] determining data items corresponding to social media
activities;
[0046] determining social media interactions for the social media
account based on the social media activities that relate to an
interaction between the entity of interest and another social media
account corresponding to another entity;
[0047] In another form, determining data items corresponding to
social media activities includes comparing a data item with a
previous version of a data item to identify a change in the data
item.
[0048] In another form, determining social media interactions
includes determining whether the social media account of the entity
of interest and another social media account corresponding to
another entity have interacted with common content on the social
media platform.
[0049] In another form, the risk assessment is based on a textual
analysis of the one or more social media interactions.
[0050] In another form, the textual analysis includes a measure of
a relevance of the social media interaction in combination with a
measure of a sentiment of the one or more social media
interactions.
[0051] In another form, the risk assessment is based on an image
analysis of the one or more social media interactions.
[0052] In another form, an initial entity risk measure is
determined by the link analysis server for each of the one or more
other social media accounts linked to the social media account of
the entity of interest.
[0053] In another form, the individual link risk measure for a link
between the entity of interest and another entity is also based on
the initial entity risk measure for the other entity.
[0054] In another form, the system includes interrogating by the
collection server additional social media platforms to determine
one or more related social media accounts corresponding to the
entity of interest.
[0055] In another form, generating the linked social network data
structure by the link analysis server includes:
[0056] for each of the related social media accounts determining
links based on social media interactions between each of the
related social media accounts of the entity of interest and further
social media accounts on the social media platform or the
additional social media platforms corresponding to other
entities.
[0057] In another form, the linked network data structure and the
associated risk profile of the entity of interest is updated by the
link analysis server over time.
[0058] In a third aspect, the present disclosure provides a risk
profiling system for determining a risk profile of an entity of
interest, comprising:
[0059] one or more processors;
[0060] memory in electronic communication with the one or more
processors; and
[0061] instructions stored in the memory and operable, when
executed by the processor, to cause the system to:
[0062] interrogate a social media platform to determine a social
media account corresponding to the entity of interest;
[0063] generate a linked social network data structure linking the
social media account corresponding to the entity of interest to one
or more other social media accounts on the social media platform
corresponding to other entities, wherein an individual link is
based on one or more social media interactions between the social
media account corresponding to the entity of interest and each of
the one or more other social media accounts corresponding to other
entities;
[0064] assign an individual link risk measure to one or more of the
individual links of the linked network data structure, the
individual link risk measure based on a risk assessment of the one
or more social media interactions upon which the individual link is
based on; and
[0065] determine the risk profile of the entity of interest based
on an aggregated risk measure based on the linked social network
data structure comprising the individual link risk measures.
BRIEF DESCRIPTION OF DRAWINGS
[0066] Embodiments of the present disclosure will be discussed with
reference to the accompanying drawings wherein:
[0067] FIG. 1 is a system overview diagram of a risk profiling
system for determining the risk profile of an entity of interest in
accordance with an illustrative embodiment;
[0068] FIG. 2 is a flowchart of a method for determining a risk
profile of an entity of interest in accordance with an illustrative
embodiment that may be implemented on the risk profiling system
illustrated in FIG. 1;
[0069] FIG. 3 is a flowchart of a method for determining the social
media account of the entity of interest in accordance with an
illustrative embodiment;
[0070] FIG. 4 is a flowchart of a method for determining a linked
social network data structure in accordance with an illustrative
embodiment;
[0071] FIG. 5 is a depiction of the entity data structure that
characterises an entity having a social media account in accordance
with an illustrative embodiment;
[0072] FIG. 6 is domain model of a linked network data structure in
accordance with an illustrative embodiment;
[0073] FIG. 7 is a depiction of a social media interaction
comprising a post and follow up comment showing the use of textual
matching to determine a risk measure in accordance with an
illustrative embodiment;
[0074] FIG. 8 is a depiction of a social media activity comprising
a post showing the use of textual matching to determine a risk
measure in accordance with another illustrative embodiment;
[0075] FIG. 9 is a depiction of a social media activity comprising
a post of an image showing the use of an image classifier and text
extractor to determine a risk measure in accordance with an
illustrative embodiment;
[0076] FIG. 10 is a visual depiction of a linked network data
structure showing the links between the entity of interest and
other entities in accordance with an illustrative embodiment;
[0077] FIG. 11 is a visual depiction of an enhanced linked network
data structure comprising the linked network structure illustrated
in FIG. 10 expanded to the next level of links in accordance with
an illustrative embodiment;
[0078] FIG. 12 is a depiction of a social media activity comprising
a post showing the use of textual matching to determine a risk
measure in accordance with another illustrative embodiment;
[0079] FIG. 13 is a depiction of a social media activity comprising
a post of an image showing the use of an image classifier and text
extractor to determine a risk measure in accordance with an
illustrative embodiment;
[0080] FIG. 14 is a depiction of a social media interaction
comprising a post of an image and follow up comment and reaction
showing the use of text extraction from an image to determine a
risk measure in accordance with an illustrative embodiment;
[0081] FIG. 15 is a depiction of a social media interaction
comprising a post and follow up comment showing the use of textual
matching to determine a risk measure in accordance with an
illustrative embodiment;
[0082] FIG. 16 is a visual depiction of a linked network data
structure showing the links between the entity of interest and
other entities based on the social media activities and
interactions illustrated in FIGS. 12 to 15 in accordance with
another illustrative embodiment;
[0083] FIG. 17 is a graph of the variation of the risk profile of
an entity of interest over time in accordance with an illustrative
embodiment; and
[0084] FIG. 18 is a system overview diagram of a risk profiling
system 1000 for determining the risk profile of an entity of
interest based on their social media presence according to another
illustrative embodiment.
[0085] In the following description, like reference characters
designate like or corresponding parts throughout the figures.
DESCRIPTION OF EMBODIMENTS
[0086] Referring now to FIG. 1, there is shown a system overview
diagram of a risk profiling system 100 for determining the risk
profile of an entity of interest based on their social media
presence according to an illustrative embodiment. In this
specification, the term "entity" is defined to include, but not be
limited to, individuals, groups of individuals, organisations,
businesses or any other commercial or legal structure.
[0087] In this specification, the term "social media platform" is
defined to be an online software system comprising an online
community where an entity can create a social media account and
which includes online communication channels directed to community
interaction, content sharing and collaboration allowing entities to
interact with each other online.
[0088] Risk profiling system 100 includes a user interface 140
which is connected to a computer system 110 comprising an
electronic processor and a database 150 for the storage of
electronic information. Computer system 110 which may comprise one
or more processors is connected to the Internet 120 by a network
connection and is configured to interrogate social media platform
130 which operates in the Internet 120. In one illustrative
embodiment, user interface 140 comprises a web browser 141 that
connects to a complementary web portal interface served by computer
system 110 over a secure HTTPS connection.
[0089] It will be appreciated that the network connections shown
are exemplary and other ways of establishing a communications link
between the computers can be used. The existence of any of various
well-known protocols, such as TCP/IP, Frame Relay, Ethernet, FTP,
HTTP and the like, is presumed, and the computer can be operated in
a client-server configuration to permit a user to retrieve web
pages from a web-based server. Furthermore, any of various
conventional web browsers can be used to display and manipulate
data on web pages.
[0090] Referring now to FIG. 2, there is shown a flowchart of a
method 200 for determining a risk profile of an entity of interest
based on their social media presence according to an illustrative
embodiment. In one example, method 200 may be implemented on the
risk profiling system 100 illustrated in FIG. 1 or the risk
profiling system 1000 illustrated in FIG. 18.
[0091] At step 210, for a given entity of interest such as a
person, the online social media platform is interrogated to
determine a social media account that corresponds to the entity of
interest. In one example, an interrogation server 111 (eg, see FIG.
1) is configured to operate on computer system 110 and the entity
of interest is entered by way of user interface 140 consisting of a
web browser 141 that connects to the interrogation server by way of
a HTTPS connection 110A.
[0092] In one example, the entity of interest is defined by a known
entity identifier such as an associated URL, username or handle for
the social media platform and the social media account of the
entity of interest may be determined on this basis.
[0093] More typically, the social media account for the entity of
interest must be determined. Referring now to FIG. 3, there is
shown a flowchart of a method 210 of determining the social media
account of the entity of interest according to an illustrative
embodiment At step 211, entity selection information characterising
the entity of interest is provided to risk profiling system 100,
the entity selection information including, but not limited to:
email address, mobile phone number, age, date of birth, entity
image, real world name (eg, first name, surname), alias, location
(eg, city, state, country), company, industry, social media
association (eg, liked groups, employers), real world associations
(eg, wife, friend), or any combination of the above.
[0094] At step 212, the social media platform is then interrogated
by carrying out a search to identify candidate social media
accounts based on the entity selection information. Depending on
the social media platform, the following candidate information may
be retrieved from a candidate social media account including, but
not limited to: [0095] account holder identity and profile
information including, but not limited to: account identifiers,
usernames, person names and aliases, date of birth, gender,
education and employment details, languages spoken, or length of
membership/age of account; [0096] account holder contact
information including, but not limited to: telephone numbers or
email addresses; [0097] account holder associate information
including, but not limited to: family, friends, followers &
people followed, forum memberships, relationship status; [0098]
account holder location information including, but not limited to:
full or partial address, place of birth, school location or other
location details; or [0099] account holder visual information
including, but not limited to, profile photos, photo & video
albums.
[0100] At step 213, the candidate social media accounts are then
ranked by interrogation server 111. In one example, a similarity
measure is determined for each candidate account depending on the
degree of similarity between the entity selection information and
the candidate information which may also be expressed as a
confidence level that the candidate social media account is a match
to the social media account of the entity of interest.
[0101] In one example, the degree of similarity is determined based
on the type of candidate information such as set out below: [0102]
For account holder contact type information the degree of
similarity between the entity selection information and the
candidate information may be determined by exact string matching or
"edit" distance. [0103] For account holder identity and profile
type information the degree of similarity between the entity
selection information and the candidate information may be
determined by "edit" distance on person names and aliases, "edit"
distance on date of birth and binary match on gender. [0104] For
account holder associate type information the degree of similarity
between the entity selection information and the candidate
information may be determined by edit distance comparing family,
friends and followers. [0105] For account holder location type
information the degree of similarity between the entity selection
information and the candidate information may be determined by
geographical distance. [0106] For account holder visual type
information the degree of similarity between the entity selection
information and the candidate information may be determined by
facial recognition distance match.
[0107] In this example, the degree of similarity or confidence
level is determined based on a normalised, weighted sum of the
individual degrees of similarity for each of the information types
referred to above.
[0108] In another example, the degree of similarity may be
determined by a learnt classification model operating over the
above information types. A variety of classification models may be
used. In one example, a classification model is trained on features
derived from the above information types, where the features are
represented as vectors in a multi-dimensional feature vector space.
The classification model is then trained to place similar social
media accounts closer to each other in the feature vector space and
dissimilar social media accounts further apart in the feature
vector space. The trained classification model is then applied to
the candidate social media accounts to obtain a ranked list of
candidate social media accounts based on the proximity to the input
entity selection information.
[0109] At step 214, the social media account corresponding to the
entity of interest is selected from the set or list of ranked
candidate social media accounts. In one example, the top ranked
candidate social media account is automatically determined to be
the social media account of the entity of interest. In another
example, the highest ranked candidate social media accounts are
presented to an operator for selection of the social media account
corresponding to the entity of interest. In yet another example, a
selection of social media accounts that are ranked above a
predetermined threshold would be nominated as individual entities
of interest to which the following risk assessment process would be
applied for each case.
[0110] In this example, the user interface 140 via web browser 141
also provides the capability to: [0111] configure and manage
collection of data; [0112] configure risk analytics; [0113] search,
review and visualise the collected data and analytic output; and
[0114] export data to external tools for further analysis.
[0115] In one example, interrogation server 111 includes a
firewall. As would be appreciated, this configuration allows for
remote access to the risk profiling system 100. In this
illustrative embodiment, interrogation server 111 communicates with
social media platform by network connection 110B which may include
an optional firewall 160B and/or virtual private network (VPN)
server in order to obfuscate the IP address of the interrogation
server 111.
[0116] In one example embodiment, risk profiling system 100
includes a HTTPS proxy server 112 (eg, see FIG. 1) configured to
operate on data processor 110 which allows an operator to browse
the Internet via a browser plugin in web browser 141 using the same
VPN connection as the interrogation server 111. This facility
provides IP obfuscation for any web browsing by the operator
configuring risk profiling system 100.
[0117] Referring back to FIG. 2, at step 220, a linked social
network data structure is determined that links the social media
account of the entity of interest to one or more other social media
accounts on the social media platform where the link is based on a
social media interaction between the entity of interest's social
media account and the other social media accounts.
[0118] Referring now to FIG. 4, there is shown a flowchart of one
example method 220 for determining a linked social network data
structure. At step 221, in this illustrative embodiment, once the
social media account corresponding to an entity of interest has
been determined, a collection server 113 (eg, see FIG. 1)
configured to operate on computer system 110 functions to collect
data items from the social media account of the entity of interest
to populate an entity data structure 300 corresponding to the
entity of interest for storage in database 150.
[0119] Referring now to FIG. 5, there is shown an entity data
structure 300 according to an illustrative embodiment which
characterises an entity 310 having a social media account 320. The
social media account 320 includes one or more data items 330 which
may include entity details that describe the entity 310 and further
include configuration details pertaining to the social media
platform. Data items 330 may also include multimedia data such as
text, images, videos and audio and derived data items that are
unique to the social media platform such as social media account
metadata comprising profile information including, but not limited
to: gender, age, nationality, place of residence, place of birth,
education, marital status and religion.
[0120] At step 222, collection server 113 classifies data items 330
as social media activities 340 that are performed by the entity 310
on the social media platform including, but not limited to, social
media activities such as posts, reposts, shares, comments, replies,
joining groups, adding and removing friends/followers or reactions
(eg, likes).
[0121] In one example, the classification of a data item 330 as a
social media activity 340 may occur as a result of comparing a data
item with a previous version of a data item in order to identify
changes. In one illustrative example, a comparison of a data item
330 listing the friends or connections of an entity on a social
media account may be compared to an earlier version to generate one
or more "Added a Friend/Connection/Follower" social media
activities for that data item 330 depending on the number of
friends or connections added since the previous collection.
[0122] In another example, a visual change in an entity's profile
picture may be classed as a social media activity. In a further
example, a change in membership in respect of an online community
such as a group, organisation or like may be classed as a social
media activity. In yet another example, a change in the volume of
content or interactions over a predetermined time such as a
significant increase/decrease or halt in activity may be classed as
a social media activity. In another example, an actual activity
such as an entity changing location (eg, going on holiday) will be
classed as a social media activity.
[0123] At step 223, collection server 113 identifies and classifies
social media activities determined in the previous step as social
media interactions. In this illustrative embodiment, a social media
interaction is a social media activity 340 associated with an
entity 310 which concerns an interaction between the entity of
interest and another social media account that corresponds to
another entity.
[0124] Examples of social media interactions include, but are not
limited to: [0125] the entity of interest connecting to another
social media account corresponding to another entity (eg, becoming
a follower or friend or joining a group, forum or online
community); [0126] the entity of interest disconnecting from
another social media account corresponding to another entity (eg,
ceasing to be a follower or friend or leaving a group, forum or
online community); [0127] the entity of interest reacting to
another social media account corresponding to another entity (eg,
liking, disliking or otherwise reacting); [0128] the entity of
interest interacting with content from another social media account
such as by commenting on, replying to, reacting to, quoting,
reposting or sharing the initial content from their social media
account; or [0129] the entity of interest mentioning, tagging or
referring to another entity or the social media account
corresponding to another entity.
[0130] In one example, the entity of interest may be commenting or
otherwise interacting with social media content such as a post from
a group or forum page or an otherwise unrelated entity on the
social media platform and another entity also interacts with the
same social media content by, for example, also commenting on the
same post. This social media activity is then also classified as a
social media interaction between the entity of interest and the
other entity on the basis that they have both interacted with
common content on the social media platform.
[0131] At step 224, the collection server 113 generates the linked
social network data structure centred about the entity of interest
and comprising links to each of the other social media accounts
corresponding to other entities where a link requires there to be
at least one social media interaction between the social media
account of the entity of interest and the linked social media
account of the other entity.
[0132] Referring now to FIG. 6, there is shown a domain model 400
of a linked social network data structure 410 according to an
illustrative embodiment. Linked social network data structure 410
consists of one or more entities 420 including the entity of
interest and other entities that are connected to the entity of
interest by links 450 which comprise the linked social network
structure 410. The links 450 that connect the entities are based on
the social media interactions 440 which are a subset of the social
media activities 430 performed by the entity of interest that
involve at least one other entity. In this manner, the link
connecting entities is comprised of, or characterises, all the
social media interactions 440 between those two entities.
[0133] In one example, the process of generating the linked social
network structure 410 will also involve automatically populating
respective entity data structures 300 for the other entities that
are linked to the entity of interest. In this manner, selection of
an entity of interest will then automatically generate a linked
social network data structure comprising other entities as well as
their associated populated entity data structures which in turn may
characterise links between these other entities.
[0134] Referring back to FIG. 2, at step 230 an individual link
risk measure is assigned to links of the linked network data
structure where the individual link risk measure is based on a risk
assessment of the one or more social media interactions upon which
the link is based on. In one embodiment, a link analysis server 114
configured to operate on computer system 110 carries out this
process (eg, see FIG. 1).
[0135] In one example, the risk assessment comprises a textual
analysis of any text forming part of the data item that forms the
basis for the social media interaction. This can also include text
extracted from images by optical character recognition techniques.
In one embodiment, the textual analysis includes matching words or
phrases to a predetermined list of words/phrases that are of
interest. In one example, the predetermined lists of words/phrases
may be divided into different categories of interest for the risk
profiling activity.
[0136] Referring now to FIG. 7, there is shown a social media
interaction 500 comprising a comment 521 made by a related entity
520 to a post 511 on a social media post made by the entity of
interest 510. In this example, the term "ISLAMIC STATE" has been
identified by textual matching 530 and further the term "KUFFAR"
was identified in the comment made by the related entity. Textual
matching may be divided into a number of categories and in this
example, the term "ISLAMIC STATE" has been categorised in the
"islamic state" category and the term "kuffar" has been categorised
in the "Derogation" category.
[0137] Referring now to FIG. 8, there is shown a social media
activity 600 comprising a post 611 made by an entity 610 on a
social media platform. In this example, the indicated quote 612 was
identified by textual matching 630 to a list of texts categorised
into different libraries. In this example, the indicated quote 612
was categorised as belonging to a publication or text in the
library "Library-Ideology" 631.
[0138] In one embodiment, the textual analysis includes determining
a risk measure for a given social media interaction in the form of
a binary score associated with the presence or absence of words
from a predetermined list of words or phrases such as quotes from
relevant texts.
[0139] In another embodiment, the textual analysis includes
determining a risk measure for a given social media interaction in
the form of a continuous score between zero and one that measures
the relevance of this interaction to a category of interaction
subject topics (eg, "drugs", "alcohol" or "ideology"). In this
example, a given category is first characterised by a set of
predetermined words/phrases relevant to that category. Each of
these words/phrases is then represented in a high dimensional
vector space constructed so that contextually and semantically
similar words are located near to each other. The textual content
of the social media interaction is then projected into this high
dimensional vector space and the risk measure is then determined by
calculating a distance measure in this high dimensional vector
space normalised between zero and one.
[0140] In another embodiment, the textual analysis includes
determining a combination risk measure for a given social media
interaction in the form of a continuous score between zero and one
that measures the relevance of the social media interaction to a
category of interaction subject topics (eg, "drugs", "alcohol" or
"ideology") combined with a continuous score between zero and one
that measures a specific sentiment for the social media interaction
(eg, "happy", "fearful", "angry"). In one example, a sentiment
classifier is trained using a training corpus comprising a set of
social media posts with their associated reactions (eg, like, love,
hate etc.). These reactions are then used as a substitute for human
labels defining positive, negative or neutral sentiment for a given
social media posts. The words and phrases in those posts and the
associated reactions are then used to train the sentiment
classifier to recognise the sentiment of input text arising from
the social media interaction.
[0141] In another embodiment, the risk assessment comprises an
image analysis of any images forming part of the data item that
forms the basis for the social media interaction to determine
whether the images contain objects from a predetermined list of
objects of interest. In another example, the image analysis
determines whether the images contain logos from a predetermined
list of logos of interest. In another example, the image analysis
determines whether the images contain faces from a predetermined
list of faces of interest.
[0142] Referring now to FIG. 9, there is shown a social media
activity 700 comprising a post 710 made by an entity on a social
media platform comprising an image 711 which has been classified by
an image classifier 730 to determine whether it contains any
objects of interest. As can be seen, the image classifier 730 has
determined that the image contains a number of objects of interest
731 in this case in the category "mujahideen" 732. In this example,
image classifier 730 has also extracted text 740 present in the
image.
[0143] 100931 In this manner, each social media interaction may be
assigned a risk measure following risk assessment of the social
media interaction and then any link between two entities based on
one or more social media interactions may be assigned an individual
link risk measure based on the determined risk measures for the one
or more social media interactions that form the basis for the link
between the entity of interest and the other entity.
[0144] In one example, the individual link risk measure may
comprise a number of sub-measures pertaining to different risk
assessment categories such as a sub-measure directed in one example
to "ideology" and a sub-measure direct to "weapons" which may be
reviewed separately. In another example, the sub-measure is
determined for each social media interaction across all risk
assessment categories to allow identification of high risk social
media interactions that could occur.
[0145] In another example, the individual link risk measure may
include a risk measure based on the number of social media
interactions between entities that occur for a predetermined time
period or any changes in this number over successive time
periods.
[0146] In another example, the individual link risk measure may
include a weighted sum where the weight is attributed to the type
of social media interaction from the perspective of the entity of
interest based on a degree of interaction measure of the social
media interaction. In one example, for given content that has a
high risk measure as determined by risk assessment, the degree of
interaction measure would be higher if the entity of interest
posted the content as opposed to commenting on the content.
Correspondingly, the degree of interaction measure would be higher
for commenting on the content compared to the case of the entity of
interest reposting the content without comment which in turn would
have a higher degree of interaction measure as compared to the
situation of where the entity of interest just "liked" the
content.
[0147] In another illustrative embodiment, each social media
activity for each entity in the linked social network data
structure is assigned an activity risk measure based on the data
item forming the basis for the social media activity. In this
example, each entity may be assigned an initial entity risk measure
based on the social media activities they enter into on the social
media platform without regard to whether those social media
activities are related to an interrelationship between two or more
entities.
[0148] This initial entity risk measure may then be used to weight
the individual link risk measure. As an example, the individual
link risk measure for a link between the entity of interest and
another entity based on their social media interactions where the
other entity has initial entity risk measure that is high based on
an assessment of their general social media activities on the
social media platform would be weighted higher than the same
individual link risk measure where the other party has a low
initial entity risk measure.
[0149] In another example, an initial entity risk measure may be
assigned to or prescribed for an entity, as a result enhancing the
individual link risk measure for any entity of interest that has a
social media interaction with this entity.
[0150] Referring now to FIG. 10, there is shown a visual depiction
of a linked network data structure 800 according to an illustrative
embodiment. In this example, the entity of interest (EOI) 810 is
linked to the other entities (E1, E2 and E3) where an individual
link is based on one or more social media interactions as has been
previously described. By way of example, EOI 810 is linked to other
entities E1, E2, and E3, by respective links 841, 842 and 843.
[0151] In this example, the number of social media interactions
between an entity and another entity is shown by the weight or
thickness of the line with a thicker line representing more social
media interactions between the linked entities. Where the
individual link risk measure for a link connecting entities exceeds
a risk threshold then the line in this example is dashed.
[0152] Where an initial entity risk measure is determined, in the
example visual depiction of FIG. 10, the size of the box indicating
an entity in the linked network data structure 800 will reflect
this initial entity risk measure which may be used to weight the
individual link risk measure as described above. In the example
visual depiction of FIG. 10, were the initial entity risk measure
exceeds a threshold then the box outline is dashed.
[0153] As would be appreciated, the visual depiction illustrated in
FIG. 10 is but one example. In another example, colour coding may
also be used to indicate where various risk measure thresholds have
been exceeded. As would also be appreciated, the linked network
data structure 800 of FIG. 10 is highly simplified to illustrate
the principles of the present disclosure and in a real use case
there may be large number of links to other social media accounts
corresponding to other entities.
[0154] As would be appreciated, visual depictions of the linked
network data structure in accordance with the example illustrated
in FIG. 8 allow an operator to extremely rapidly determine the
level of risky engagement between an entity of interest and other
entities in the social media network of the entity of interest.
[0155] Referring now to FIG. 11, there is shown a visual depiction
of an enhanced linked network data structure 900 comprising the
linked network structure (Level 1), ie E1, E2 and E3, illustrated
in FIG. 10 expanded to the next level of links (Level 2), ie E4,
E5, E6, E7, E8, E9, E10, E11, E12, E13 and E14, according to an
illustrative embodiment. In this example, for each of the entities
that are linked to the entity of interest a further level of links
is determined to generate enhanced linked network data structure
900 by determining social media interactions between the entity at
the first level and entities at the second level and then assigning
individual link risk measures to each of these links based on risk
assessment of the respective social media interactions.
[0156] In one example, the links between Level 1 and Level 2 may be
used to determine the initial entity risk measure for those
entities on Level 1 which will further feed in to determining the
individual link measures between the Level 1 entities and the
entity of interest. In this way, entities that are more than one
level removed from the entity of interest may be utilised in
determining the risk profile of the entity of interest. As would be
appreciated, the process may be repeated again to generate the next
level of linked entities (ie, Level 3) and so on.
[0157] In the example shown in FIG. 11, once the Level 2 entities
have been identified then links between these Level 2 entities and
other Level 2 or Level 1 entities are determined. The resulting
topology of the linked network data structure 900 as a result
provides insight into how disparate entities may be indirectly
linked together.
[0158] In another embodiment, it is possible to filter the linked
network data structure based on the type of social media
interaction. In one example, the filtered linked network data
structure is based on a social media interaction where one entity
has followed another entity. In another example, the filtered
linked network data structure is based on a social media
interaction where one entity has reacted to a social media post or
activity by another entity. In yet another example, the filtered
linked network data structure is based on a social media
interaction where one entity has commented on a social media post
or activity of another entity. As would be appreciated, this
ability to filter the linked network data structure in accordance
with the type of social media interaction provides additional
insight into the type of linkages between the entities in the
structure.
[0159] Referring again to FIG. 2, at step 240 the risk profile for
the entity of interest is determined based on an aggregated risk
measure combining the individual link risk measures determined
between the entity of interest and the linked entities based on the
linked social network data structure now comprising the individual
link risk measures. In one example, the risk profile may be based
on risk measures aggregated over different risk assessment
categories or topics such as "ideology" and "weapons" as has been
previously described so that these may be separately examined. In
one example embodiment, the link analysis server 114, configured to
operate on computer system 110, functions to determine the risk
profile.
[0160] Referring now to FIGS. 12 to 15, there are shown depictions
of a number of social media activities and interactions and an
associated linked network data structure 1600 illustrated in FIG.
16 relating to determining a risk profile based on antisocial
behaviour such as alcohol consumption and gambling.
[0161] Referring now to FIG. 12, there is shown a social media
activity 1200 comprising a post 1211 by an entity of interest 1210.
In this example, the terms "poker" and "drinks" have been
identified in the "Alcohol" 1221 and "Gambling" 1222 categories
which are of interest in this risk assessment exercise. Referring
now to FIG. 13, there is shown a social media activity 1300 by the
entity of interest 1210 comprising a post 1315 including text 1313
and an image 1314. In the text, the term "drink" has been
identified in the "Alcohol" category 1221. As can be seen by
inspection, image 1314 is a picture of fridge full of alcohol.
Image classifier 1330 has determined a number of relevant objects
1331 in the category "distilled beverage" 1332. In this example,
image classifier has also extracted text 1340 from the image which
is an alcohol brand which has been identified in the "Alcohol"
category 1221.
[0162] Referring now to FIG. 14, there is shown a social media
interaction 1400 comprising a reaction 1451 in the form of "like"
and a comment 1452 (not shown) in relation to a social media
activity comprising a post 1415 by an entity of interest 1210
including text 1413 and an image 1414. As can be seen in this
example, textual matching did not identify relevant material in the
text 1413 of the post 1415 and the image classifier did not
identify any objects in the image 1414 which is a betting
transaction record, however, the image classifier extracted the
text 1440 from image 1414 and the term "bet" has been identified in
the "Gambling" category 1222.
[0163] Referring now to FIG. 15, there is shown a social media
interaction 1500 comprising a comment 1573 made by a related entity
1570 to a post 1513 on a social media post made by the entity of
interest 1210. In this example, the term "booze" has been
identified by textual matching 1530 and has been further identified
or classified in the "Alcohol" category 1221.
[0164] Referring now to FIG. 16, there is shown a visual depiction
of a linked network data structure 1600 based on social media
activities and interactions of the type illustrated in FIGS. 12 to
15 comprising in this example two levels similar to FIG. 11. In
this example, each of the entities including the entity of interest
1610 is represented by a profile picture or image related to the
entity. Similar to the linked network data structure illustrated in
FIGS. 10 and 11, each of the individual links is based on one more
social medial interactions.
[0165] In this example, the thickness of the link indicates that
number of social media interactions between the linked entities and
the darkness of the link corresponds to the individual link risk
measure for the link connecting the entities. In those examples,
where the assessed risk of an entity exceeds a threshold based on
their social media activities the entities name is highlighted
explicitly as shown for entities 1681, 1682, 1683. In this
illustrative example, entity 1682 relates to a venue that provides
alcohol and gambling services.
[0166] In another embodiment, the linked network data structure is
updated on a periodic basis resulting in the associated risk
profile of the entity of interest being updated over time.
Referring now to FIG. 17, there is shown a graph 1700 of the
variation of the risk profile or score 1710 of an entity of
interest over time according to an illustrative embodiment. As
would be appreciated, this allows the risk trajectory 1720 of an
entity of interest to be tracked and inspected to determine whether
there has been a change in behaviour that could trigger follow up
or reclassification of the entity of interest.
[0167] In one example, where the risk profile includes separate
risk assessment categories the updated risk profile may be used to
determine changes in behaviour at a category or topic level and
further define combined measures which detect changes in more than
one selected categories.
[0168] Taking the example above with categories "ideology" and
"weapons" the following may be determined: [0169] the risk score
per category at any given time (eg, in September the score for
"ideology" was 0.9 (high) or 0.1 (low)); [0170] changes and rates
of change in risk score for a given risk category (eg, from July to
September the "ideology" score moved from 0.1 (low) to 0.9 (high));
and [0171] sequences of elevated risks (eg. the entity of interest
had a high score for the "ideology" category in September, followed
by an increasing and elevated risk score in the "weapons" category
from October to December which may indicate a pattern of concerning
behaviour.
[0172] In another embodiment, a risk profiling system in accordance
with the present disclosure may be expanded to operate over
additional social media platforms. As with determining the social
media account on the primary social media platform, entity
selection information may be used to identify and match to
candidate social media accounts on the additional social media
platforms. Where a social media account has been identified for the
entity of interest on the primary social media platform, then
information from the already identified social media account may be
used preferentially as entity selection information to identify and
match to candidate social media accounts on the additional social
media platforms.
[0173] In one example, a matching candidate social media account on
a further social media platform may be assessed by measuring the
similarity between the account metadata of the entity of interest
on the first social media platform with that of the candidate
social media account on the further social media platform. In
another example, the assessment may be based on the degree of
similarity of the account content between the two social media
accounts on the different social media platforms. In another
example, the assessment may be based on a degree of similarity of
the social networks between the two social media accounts on the
different social media accounts. In another example, the assessment
may be based on a similarity measure comprising multiple weighted
sub-measures of similarity.
[0174] Once the additional social media accounts corresponding to
the entity of interest have been identified then social media
activities may be determined and the social media interactions
between the entity of interest and other entities on the additional
social media platforms may be classified and form the basis of
links between the entity of interest and the other entities. In
some instances, the social media interaction will involve two
different social media platforms, eg, an article posted on a first
social media platform by the entity of interest could be shared by
another entity on a second social media platform where they have a
social media account.
[0175] Some other types of interactions between different social
media platforms include, but are not limited to the following:
[0176] including a link to social media content such as a post,
photo or video from the second social media platform into a post on
the first social media platform. [0177] including an entity mention
(eg, user handle) from the second social media platform into a post
on the first social media platform. [0178] including an entity
mention (eg, user handle) from the second social media platform in
the metadata (eg, "about" information) for an entity on the first
social media platform.
[0179] Referring now to FIG. 18, there is shown a system overview
diagram of a risk profiling system 1000 for determining the risk
profile of an entity of interest based on their social media
presence according to another illustrative embodiment.
[0180] As would be appreciated the various computer modules,
servers and databases and data stores described both above and
below may be implemented on a computer system 1010 which may
comprise any combination of multiple different individual hardware
or software processors configured to run the various computing
tasks that are described in functional terms below. In this
illustrative embodiment, the computing system is based on a web
architecture where the webserver 1018 functions to provide the
middle tier between the Internet 1020 and the operator 1090 of the
risk profiling system 1000. In this manner, the user interface 1040
of the risk profiling system 1000 consists of webpages or content
served by the webserver and is accessed by a standard web browser
as a "web" application 1041 by the operator 1090.
[0181] The web based architecture allows an operator 1090 to access
the application from any device with a modern web browser, eg, a
desktop PC or tablet. As such, this architecture does not require
an operator 1090 to install specific software to use the
application. It also provides flexibility when deploying the
application as the server-side component may be deployed either on
hardware managed by the operator's 1090 organisation, or in a cloud
environment and managed on their behalf
[0182] An alternative architecture that may be adopted for a web
profiling system in accordance with the present disclosure is
termed a "thick-client" architecture where the user interface is
provided by a desktop application or app installed on the
operator's device. This would still require a server component to
support the functionality but can provide an enhanced user
experience that is more integrated with the device capabilities or
operating system that the application is installed on.
[0183] In this example, risk profile system 1090 includes a reverse
proxy 1087 which functions as an intermediary between the operator
1090 who may be accessing the risk profiling system 1000 remotely
by the Internet and the webserver application 1018 of the risk
profiling system 1000. In this example, network traffic is secured
between the user interface 1040 and reverse proxy 1087 by adopting
the secure HTTPS (HTTPS) protocol while network traffic between
webserver 1018 and the reverse proxy 1087 need not be encrypted as
it is internal to the risk profiling system 1000 and uses the
standard HTTP protocol. As would be appreciated, where the various
components or server applications of the risk profiling system may
be remotely distributed then network traffic between these
components may be encrypted as required.
[0184] In this illustrative embodiment, the network traffic between
the web application 1041 and the server 1018 employs a
Representational State Transfer (REST) API that defines a set of
messages and operations that can be exchanged over HTTP. This API
is used to configure the risk profiling system 1000 and retrieve
the results of the risk profile determinations. The REST API
provides an interface to the risk profiling system 1000 and may be
accessed by different user facing applications, eg, an iOS app
could be developed that uses the same API calls as the web
application 1041.
[0185] In this example, risk profiling system 1000 accesses the
internet 1020 by a third party VPN provider that provides access to
the Internet 1020 by a VPN server 1080 to which risk profiling
system 1000 connects to by a VPN client 1085 forming in this
example a component or module of the risk profiling system 1000. As
a result, all of the network traffic between the internet 1020 and
the risk profiling system 1000 may be encrypted by virtue of the
secure socket layer (SSL) connection between the VPN client 1085
and the VPN server 1080 and the HTTPS links between the VPN server
1080 and the Internet 1020. In this example, an operator 1090 may
also access the Internet generally through their access to the risk
profiling system 1000 by the web browser based user interface 1040
as will be described below.
[0186] Risk profiling system 1000 communicates via the VPN
Server/Client arrangement 1080, 1085 to interrogate social media
platforms 1022 (eg SMP 1, SMP 2, . . . , SMP N) as described above.
In this illustrative embodiment, risk profiling system 1000 can
also connect to various cloud based application programing
interfaces 1023 (eg, API 1, API 2, . . . , AMP N) to provide
specialised based machine learning and artificial intelligence type
processing available on the Internet to risk profiling system 1000.
In one example, a cloud based API may provide a translation
capability. In another example, a cloud based API may provide an
image object classification capability. As well as ensuring all
data communications to and from the Internet are encrypted, use of
the VPN Server/Client arrangement 1080, 1085 also functions to
obfuscate the source IP address of the risk profiling system 1000
to provide anonymity for risk profiling system 1000 and operator
1090.
[0187] Risk profiling system 1000 further includes an interrogation
server 1011 operable to interrogate social media platforms 1022 as
has been described above. In this embodiment, interrogation server
1011 comprises a webscraping module 1070 that can instantiate
multiple instances of a web browser 1071. Webscraping module 1070
interfaces to the risk profiling system 1000 by a driver interface
1072 that processes interrogation requests from the risk profiling
system 1000 into equivalent HTTP requests operable on each of the
social media platforms 1022. In this manner, content is "scraped"
from the social media platforms 122 for further processing.
[0188] In one example, the interrogation server 1011 employs
user-provided credentials to access the social media platforms.
These credentials can be an API key or a username and password for
authenticating to the social media platform's web interface. For
API keys, the application makes API requests to collect data from
the social media platform. For credentials where there is a
username and password, the webscraping module 1070 starts a web
browser 1071 and programmatically controls it to login using the
provided credentials, browse to the appropriate page and read
content from the page. From the social media platform's
perspective, the application appears to be a user browsing their
service. This web-scraping collection method provides access to all
content visible to a logged in user which may be more than would be
available via API-based collection methods to the particular social
media platform.
[0189] In one example, the content from the webscraping module
1070, and in particular the video and image data content, is stored
on a distributed fault tolerant no-SQL database 151 that provides
data distribution across a cluster of nodes for data replication
purposes. In one example, database 151 is a RIAK based database. In
other embodiments, the database could be a Redis key-value store or
any S3-compatible object store.
[0190] In this example, risk profiling system 1000 further includes
a HTTPS proxy server 1012 that allows the operator 1090 to connect
to the Internet 1021 by VPN Server and Client 1080, 1085
arrangement using the same IP address as the risk profiling system
1000. In this example, the web browser employed by operator 1090
includes an SSL proxy extension or plugin 1042 which connects by
HTTPS to the HTTPS proxy server 1012. As would be appreciated, this
allows the operator 1090 to both securely and anonymously browse
the general Internet 1020 while operating risk profiling system
1000, while presenting the same IP address as the risk profiling
system 1000 to the social media platforms.
[0191] Risk profiling system 1000 includes a collection server 1013
that functions to process the content returned by webscraping
module 1070 and stored in database 1051 as collected data items and
then populate an entity data structure that corresponds to the
entity of interest as has been described above. Collection server
1013, in this example, also functions to classify or identify
collected data items as a social media activity and then further as
a social media interaction where the social media activity concerns
an interaction between the entity of interest and another social
media account corresponding to another entity. In this example, the
other social media account may be on a different social media
platform (eg, SMP 2) as compared to the social media platform that
is being examined for the entity of interest (eg, SMP 1).
[0192] Risk profiling system 1000 further includes a link analysis
server 1014 that functions to generate the linked social network
data structure assign the individual link risk measures and then
determine the risk profile of the entity of interest as has been
described above. In this example, the data associated with the
entity data structure and the linked social network data structure
determined by risk profiling system 1000 is stored in a no-SQL
database 152 which in this example is a 3-node Elasticsearch.TM.
cluster. Elasticsearch is a database or datastore optimised for
searching large collections of semi-structured documents.
Elasticsearch constructs an inverted index that allows the
application to efficiently lookup content in text fields, eg,
searching for a word in the text of posts on social media. The
datastore supports "fuzzy" searches, eg, by synonyms or
misspellings. In another example, the datastore is Solr.TM.. In
this example, link analysis server 1014 may connect to cloud based
APIs 1023 to assist in the analysis task by VPN Server/Client
arrangement 1080, 1085.
[0193] In this example, risk profiling system 1000, being based on
a webserver architecture, also includes command and control module
1019, that functions to implement the risk profiling method in
accordance with the present disclosure. Data associated with the
application state of the risk profiling system 1000 such as
processor status, pending task details and log and error data are
stored in a standard relational database 1053. Risk profiling
system 1000 in this embodiment further includes a support module
1048 that allows an operator to access the system through a SSH
link to monitor and maintain the risk profile system 1000. The SSH
connection allows an operator 1090 to login to the webserver 1018
from a remote location to facilitate maintenance. SSH access
provides a terminal where the operator 1090 can execute commands
to, eg, patch or reboot the webserver 1018. In one example, the web
application 1041 provides an operator 1090 with an administrator
role access to additional features that can support operational
maintenance, eg, monitoring running tasks.
[0194] Those of skill in the art would further appreciate that the
various illustrative logical blocks, modules, circuits, and
algorithm steps described in connection with the embodiments
disclosed herein may be implemented as electronic hardware,
computer software or instructions, or combinations of both. To
clearly illustrate this interchangeability of hardware and
software, various illustrative components, blocks, modules,
circuits, and steps have been described above generally in terms of
their functionality. Whether such functionality is implemented as
hardware or software depends upon the particular application and
design constraints imposed on the overall system. Skilled artisans
may implement the described functionality in varying ways for each
particular application, but such implementation decisions should
not be interpreted as causing a departure from the scope of the
present invention.
[0195] In various embodiments of the present disclosure, a single
component may be replaced by multiple components, and multiple
components may be replaced by a single component, to perform a
given function or functions. Except where such substitution would
not be operative to practice embodiments of the present disclosure,
such substitution is within the scope of the present disclosure. In
accordance with this, any of the servers described in the present
disclosure may be implemented as logical processes on a single
computer processor or alternatively distributed amongst a group of
networked servers that are located and configured for cooperative
functions.
[0196] Various embodiments of the systems and methods of the
present disclosure may employ one or more electronic computer
networks to promote communication among different components,
transfer data, or to share resources and information. Such computer
networks can be classified according to the hardware and software
technology that is used to interconnect the devices in the network,
such as optical fibre, Ethernet, wireless LAN, HomePNA, power line
communication or G.hn. The computer networks may also be embodied
as one or more of the following types of networks: local area
network (LAN); metropolitan area network (MAN); wide area network
(WAN); virtual private network (VPN); storage area network (SAN);
or global area network (GAN), among other network varieties.
[0197] Throughout the specification and the claims that follow,
unless the context requires otherwise, the words "comprise" and
"include" and variations such as "comprising" and "including" will
be understood to imply the inclusion of a stated integer or group
of integers, but not the exclusion of any other integer or group of
integers.
[0198] The reference to any prior art in this specification is not,
and should not be taken as, an acknowledgement of any form of
suggestion that such prior art forms part of the common general
knowledge.
[0199] It will be appreciated by those skilled in the art that the
invention is not restricted in its use to the particular
application described. Neither is the present invention restricted
in its preferred embodiment with regard to the particular elements
and/or features described or depicted herein. It will be
appreciated that the invention is not limited to the embodiment or
embodiments disclosed, but is capable of numerous rearrangements,
modifications and substitutions without departing from the scope of
the invention as set forth and defined by the following claims.
* * * * *