The monitoring of user account activity must, therefore, take into account both newly created and existing accounts to prevent malicious activities carried out by existing accounts that are being compromised by the attacker. It is advisable to associate a measure of reputation (reputation scoring) estimated on the basis of the behavior held by the associated user. This reputation scoring also allows us to identify attacks conducted in stealth mode, thus preventing the risk of attacks going undetected. It does this by leveraging alarm systems calibrated to monitor anomalous and noisy peaks of activity.
In the estimate of the reputation score associated with each user account, we can take into consideration various features:
- The number and frequency of user posts published for a period of time
- Access to the user account via proxy, VPN, or other IP anonymization...
