Abstract: Systems and methods for impersonation detection and abuse prevention are disclosed. In example embodiments, a batch server of a social networking service receives a new registration or an update for an account, the account comprising a name and identity-related information. The batch server determines that the name and the identity-related information of the account matches one or more other accounts of the social networking service. The batch server detects a suspicious behavior of the account. The batch server limits, in response to the suspicious behavior, access to the account unless or until an identity of a user of the account is verified.

Abstract: The disclosed embodiments provide a system for processing actions with a service. During operation, the system obtains a first attribute associated with a first cluster of entities identified as malicious to a service. Next, the system matches the first attribute to a second attribute of an entity in the first cluster. The system then uses the second attribute to identify a second cluster of entities as malicious to the service. Finally, the system uses cluster scores for identifying the first and second clusters of entities as malicious to the service to output responses to actions associated with entities in the first and second clusters of entities.

Abstract: Techniques are provided for determining a reputation of a source address based on analytics of interaction history. In an embodiment, computers store interaction data that indicates a plurality of interactions between users and an online entity. For each interaction of the plurality of interactions, the interaction data indicates a source address of a user. For each source address of a plurality of source addresses indicated in the interaction data, the computers determine an aggregate measurement indicating aggregate behavior of users associated with an aggregate subset of interactions of the plurality of interactions. Each interaction of the aggregate subset is associated with said source address. The computers determine a negative measurement indicating negative behavior of users that are associated with a negative subset of interactions of the aggregate subset. The computers generate, based on the negative and aggregate measurements, a score that indicates a reputation of said each source address.

Abstract: Techniques for processing address book upload requests are provided. A user of a social network service uploads a list of email addresses. The social network service is configured to provide information about members of the social network service whose email addresses match one of the email addresses in the list of email addresses. Before providing that information, the social network service identifies attributes of the list of email addresses, the user, and/or the upload. The social network service analyzes the attributes to determine whether to provide the requested information. In one technique, the social network service creates and trains a model to learn the attributes or features (and their corresponding weights) that are associated with “bad” uploads. Example features include the number of email addresses in an upload and the number of uploads submitted by the user within the last hour.