US20180247054A1

US20180247054A1 - Method and system for piracy detection

Info

Publication number: US20180247054A1
Application number: US15/444,351
Authority: US
Inventors: Uri Porat; Yoav GLAZNER; Amitay Stern
Original assignee: Cisco Technology Inc
Current assignee: Cisco Technology Inc
Priority date: 2017-02-28
Filing date: 2017-02-28
Publication date: 2018-08-30
Also published as: US11176452B2

Abstract

In one embodiment, a system, apparatus and a method is described, the system, apparatus and a method including, a storage device and a memory operative to store target content items, a comparator operative to compare one content item of the target content items with the other target content items, and, at least on the basis of comparing the one content item of the target content items with the other content items of the target content items, to develop a correlation graph between each one content item of the target content items and the other content items of the target content items, and a machine learning system operative to receive the correlation graph and to output a decision, on the basis of in the correlation graph, indicating if the content items represented in the correlation graph are pirated content items or not. Related system, apparatuses and methods are also described.

Description

TECHNICAL FIELD

The present disclosure generally relates to methods and systems for comparing versions of content files.

BACKGROUND

Copyright holders seek to identify copyright violations which occur when copyrighted content, such as a copyrighted video, is pirated. Such content, to which access has been made available in violation of copyright, may be referred to as hacked video, hacked content, rogue content, pirated content, or other similar terms.
It is often the case that pirated content will be manipulated by pirates in an attempt to frustrate automatic detection systems, so that automatic detection via simple comparison becomes difficult. Such manipulations may include, for example, but not be limited to: change of color, cropping, rotation/translation, audio mute/swap, video format transcoding, etc. Sometimes these manipulations occur as incidental byproducts of conversion from a source to a digital replication of the source.

BRIEF DESCRIPTION OF THE DRAWINGS

The present disclosure will be understood and appreciated more fully from the following detailed description, taken in conjunction with the drawings in which:

FIG. 1 is a simplified block diagram of a comparison of an original content item with similar content items, as performed by a comparison system which is constructed and operative in accordance with an embodiment of the present invention;

FIG. 2 is a depiction of an exemplary comparison of content items using the comparison of FIG. 1;

FIGS. 3-5 are a series of block diagrams detailing a method of determining a correlation graph, similar to a correlation graph depicted in FIG. 2;

FIG. 6 is a correlation graph resulting from the example of FIGS. 3-5;

FIG. 7 is a depiction of a plurality of correlation graphs, such as the correlation graph of FIG. 6, for inputting into a machine learning system;

FIG. 8 is a block diagram of an exemplary device comprising one or both of the machine learning system and a comparator which performs the comparison of the content items as described above with reference to FIGS. 2-6; and

FIG. 9 is a simplified flow chart diagram of a method for an embodiment of the system FIG. 1.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

In one embodiment, a system, apparatus and a method is described, the system, apparatus and a method including, a storage device and a memory operative to store a plurality of target content items, a comparator operative to compare each one content item of the plurality of target content items with the other content items of the plurality of target content items, and, at least on the basis of comparing each one content item of the plurality of target content items with the other content items of the plurality of target content items, to develop a correlation graph indicating a level of correlation between each one content item of the plurality of target content items and the other content items of the plurality of target content items, and a machine learning system operative to receive, as an input, the correlation graph and to output a decision, on the basis of the level of correlation shown in the correlation graph, which indicates if the content items represented in the correlation graph are pirated content items or are not pirated content items. Related system, apparatuses and methods are also described.

Example Embodiment

Reference is now made to FIG. 1, which is a simplified block diagram of a comparison of an original content item with similar content items, as performed by a comparison system which is constructed and operative in accordance with an embodiment of the present invention. A first content item 110, designated in FIG. 1 as an “Original Content” item, is depicted. A number of additional versions 120, 130, 140 of the content item are also depicted, designated in FIG. 1, respectively, as V₁, V₂, V_n. The additional versions V₁ 120, V ₂ 130, and V _n 140 of the Original Content item 110 are pirated copies of the Original Content item 110. Dotted arrows 160 indicate that the additional versions V₁ 120, V ₂ 130, and V _n 140 are somehow related to the Original Content item 110. The path of the relationship may be direct, as indicated by the solid arrow 170 between additional version V ₂ 130 and the Original Content item 110. Alternatively, the relationship between the Original Content item 110 and one of the additional versions V₁ 120, and V _n 140 may be indirect, as indicated by solid arrows, indicating a direct relationship between V ₂ 130 and V_n 140 (arrow 180), and a second direct relationship between V _n 140 and V₁ 120 (arrow 190). Accordingly, as depicted in FIG. 1, the relationship between various content items 110, 120, 130, and 140 is: Original Content item 110-V₂ 130-V_n 140-V₁ 120, where the dashes (i.e., “-”) may be understood as showing a “chain” of direct relationships.
In cases where a direct relationship is detected (i.e., Original Content item 110-V ₂ 130; V₂ 130-V _n 140; and V_n 140-V₁ 120), a threshold has been exceeded when the two versions are compared by the comparison system, as will be explained.
Persons who attempt to gain unauthorized access to copyrighted video (e.g., Original Content item 110) are sometimes referred to as “Hackers,” “Rogues,” or “Pirates”. Such content, to which a hacker, rogue, or pirate has gained unauthorized or illegal access may be referred to as hacked content, rogue content, pirated content, or other similar terms. Pirates may attempt to distribute the content over rogue content distribution networks, peer-to-peer file sharing methods, and so forth. It is often the case that pirated copies of the copyrighted content have been somehow manipulated using various methods, which are typically known methods, in order to make automated detection of pirated copies difficult. Such manipulations include, for example: change of color, cropping, rotation/translation, audio mute/swap. Methods for comparison of versions of files of content are discussed below, particularly with reference to FIGS. 2-5. Content may include video content, audio content, or other formats of content which are suitable for consumption.
It is the opinion of the inventors that there is little value in pirating content that is freely available at one location on the Internet. For example, if a copy of content item is freely available for distribution, for example, if the content item has been legitimately uploaded to a video sharing service such as YouTube™, then copies which may exist elsewhere on the Internet are also legitimate (i.e., not pirated) copies of the content item. Hence, there is little reason for someone who is making a legitimate copy of the freely available content item, to manipulate the file in an attempt to disguise the file's source. By contrast, a content item which is uploaded in violation of intellectual property rights of a content owner may be subject to manipulations of the sort mentioned above. A level of correspondence between two files which have been differently manipulated, may be used to determine a level of confidence that the various versions of the content item (such as V₁ 120, V ₂ 130, and V_n 140) are copies with variations of the same Original Content source file (such as Original Content item 110).
The difference between two different pirated copies may be smaller than the difference between the original and a pirated copy. By way of example, a comparison method applied to Original Content item 110 and content item V _n 140, or between Original Content item 110 and content item V₁ 120 may find that there is little or no correlation between the three versions. However, a high level of correlation may be detected between content item V _n 140, and content item V₁ 120. For two versions of a content item to be considered similar the comparison rate between them should be greater than a predefined threshold. Thus, content item versions V₁ 120 and V_n 140 may not be directly connected to the Original Content item 110 (note that the solid arrows 170, 180, and 190 do not indicate any direct connection between: content item V₁ 120 and content item V ₂ 130; nor between Original Content item 110 and content item V₁ 120), but, since there is a path between them, they may still be identified as the same content item.
FIG. 1 may be viewed as an undirected graph, i.e., a set of nodes, in this case, content items, connected together by bi-directional edges. Specifically, since the content item V₁ 120 is connected to the content item V _n 140 indicated by an edge, solid arrow 190, it is also true that the content item V _n 140 is related to the content item V₁ 120. For the purposes of the discussion below, the graph of FIG. 1 will be referred to as a “correlation graph”.
Prior to discussing the method utilized to construct the graph of FIG. 1, reference is made to FIG. 2, which is a depiction of an exemplary comparison of video content items using the comparison system of FIG. 1. A timeline 210 indicates that exemplary illustrations of frames of video content which appear on the left side of the figure occur in a video (i.e. the content item) prior to those events which are shown progressing to the right, which appear progressively later in the video, later than those events to their left. It is appreciated that the example provided in FIG. 2 and the following discussion is a discussion of a simplified example, provided in order to highlight operation of an embodiment, which a person of skill in the art would be able to generalize for application in a more complex situation.
A grid 220 shows video frames, respectively from the earliest to the latest in the video file. Columns in the grid 220 indicate: a first frame; a second frame; and a third frame. Rows in the grid 220 indicate versions of the content as depicted in FIG. 1. In order to simplify the upcoming figures, the Original Content item 110 is denoted, for convenience sake, as {circle around (1)}; Version V₁ 120 is denoted, for convenience sake, as {circle around (2)}; Version V₂ 130 is denoted, for convenience sake, as {circle around (3)}; and Version V_n 140 is denoted, for convenience sake, as {circle around (4)}.
Each frame depicted in the grid 220 is shown with a number beneath it. The number is an indication of the number of occurrences of faces appearing in the frame. Face detection is a technique known in the art, and is a subcategory of feature detection, where a number of occurrences of a particular feature which appears in a given video frame is counted. Because, as discussed above, pirated videos are manipulated, different types of manipulations (as will be detailed below) are depicted, as well as the effect of the manipulation on the number occurrences of features. An arrow emphasizes the area of the manipulation in the First Frame column of the grid 220. So, for example, the second frame of Version V₂ 130 has a 1 beneath it, because only one face appears in the frame.
Content version V₁ 120 {circle around (2)} is shown as having been cropped on the left side of the frame. Content version V₂ 130 {circle around (3)} is shown as having been cropped on the right side of the frame. Content version V_n 140 {circle around (4)} is shown as having been cropped on the bottom of the frame. Turning now to the number of faces in the Original Content item 110 {circle around (1)}, the first frame shows two faces as appearing in the frame; the second frame shows one face as appearing in the frame; and the third frame shows three faces as appearing in the frame. The effects of the cropping on the frames in the different versions of the content. V₁ 120; V ₂ 130; and V_n 140 (all from FIG. 1) is as follows:

- Version V₁ 120 {circle around (2)} has been cropped on the left side of the frame. Thus, in the first frame, the face on the left side of the frame 222 does not appear. Only one face is counted, instead of the two faces which appear in the original frame. However, the left side cropping of the frames in version V₁ 120 has not affected the faces in the remaining second and third frames.
- Version V₂ 130 {circle around (3)} has been cropped on the right side of the frame. Thus, in the third frame, the two faces which appear on the right side of the original frame 224A, 224B do not appear version V ₂ 130. However, the right side cropping of the frames in version V ₂ 130 has not affected the faces in the remaining first and second frames.
- Version V_n 140 {circle around (4)} has been cropped on the bottom of the frame. Thus, in the first frame, the face in the lower left corner of the frame 222 is mostly obscured by the cropping. Likewise, in the third frame, the face in the lower right of the frame 224B is mostly obscured by the cropping. The second face in the upper right of the frame 224A however, is not affected by the cropping.

Table 1 below summarizes the number of faces in each frame of each version of the content item (the information of which also appears in FIG. 2).

TABLE 1

First Frame	Second Frame	Third Frame

Original Content item	2	1	3
V ₁	1	1	3
V ₂	2	1	1
V _n	1	1	2

Each of the different versions of the content is first compared to the original version of the content. Table 2 shows two of the rows in Table 1 for version V₁ 120 and the Original Content item 110.
TABLE 2

First Frame Second Frame Third Frame

Original Content item 2 1 3

V ₁ 1 1 3

Does not match Match Match

Thus, version V₁ 120 is considered to be a copy of the Original Content item 110. A correlation (undirected) graph 230 is thereby created, where an arrow indicates that {circle around (2)} is derived from {circle around (1)} (i.e., {circle around (1)}→{circle around (2)}).
Likewise, Table 3 shows two of the rows in Table 1 for Version V ₂ 130 and the Original Content item 110:
TABLE 3

First Frame Second Frame Third Frame

Original Content item 2 1 3

V ₂ 2 1 1

Match Match Does not match

Thus, version V ₂ 130 is considered to have been made as a copy of the Original Content item 110. As such, in the correlation graph 230, where version V ₂ 130 is denoted, for convenience sake, as {circle around (3)}, an arrow in the correlation graph 230 ({circle around (1)}→{circle around (3)}) indicates that {circle around (3)} is derived from {circle around (1)}.
However, as indicated in Table 4, below, comparing the row of Table 1 for version V _n 140 to the row of Table 1 for Original Content item 110 shows the following result:
TABLE 4

First Frame Second Frame Third Frame

Original Content item 2 1 3

V _n 1 1 2

Does not match Match Does not match

Accordingly, since there is only one matching cell between version V _n 140 and Original Content item 110, {circle around (4)} is not shown in the correlation graph 230 as (directly) derived from {circle around (1)}.
Comparing version V₁ 120 to version V _n 140, gives the following (Table 5):
TABLE 5

First Frame Second Frame Third Frame

V

₁ 1 1 3

V _n 1 1 2

Match Match Does not match

Accordingly, correlation graph 230 shows that {circle around (4)} is derived from {circle around (2)}. Although no table is provided here, by referring to the Table 1, it can be seen that version V ₂ 130 has only one cell which matches version V _n 140. Thus, correlation graph 230 does not show any direct correlation between {circle around (3)} and {circle around (4)}.
Reference is now made to FIGS. 3-5, which are a series of block diagrams detailing a method of determining a correlation graph, similar to the correlation graph 230 of FIG. 2. It is appreciated that the example given in FIGS. 3-5 uses an original content item {circle around (0)} 310, and four additional content items, content {circle around (1)} 320; content {circle around (2)} 330; content {circle around (3)} 340; and content {circle around (4)} 350.
Using an appropriate feature matching technique, such as the face matching technique used in the example of FIG. 2, a match is determined between the original content item {circle around (0)} 310 and content {circle around (1)} 320 and content {circle around (2)} 330. No match, however, is found, between content item {circle around (0)} 310 and content {circle around (3)} 340 and content {circle around (4)} 350. In a second iteration of comparison, performed after the comparisons described above, depicted in FIG. 4, similar to the comparison of version V₁ 120 to version V _n 140 in FIG. 2, content {circle around (3)} 340 is found to match content {circle around (2)} 330. In a third iteration of comparison, depicted in FIG. 5, content {circle around (4)} 340 is found to match content {circle around (4)} 350.
A correlation graph 380 resulting from the example of FIGS. 3-5 is depicted in FIG. 6, graphically summarizing the results of the iterations of comparison depicted in FIGS. 3-5.
Reference is now made to FIG. 7, which is a depiction of a plurality of correlation graphs, such as the correlation graph 380 of FIG. 6, for inputting into a machine learning system. The machine learning system may comprise a neural network, a system implementing a clustering algorithm, a system implementing a naïve Bayes classification algorithm, or another appropriate machine learning method as is known in the art. A set of correlation graphs used as training data 710 is depicted on the left side of FIG. 7. The training data 710 data-set is input into the machine learning system to train the machine learning system to distinguish between types of correlation graphs which are indicative of non-pirated content and types of correlation graphs which are indicative of pirated content. The training data 710 data-set, which comprises correlation graphs of known non-pirated related content items, such as correlation graph 720 and correlation graph 725, as well as correlation graphs of known pirated related content items, such as correlation graph 730, is input into the machine learning system. The machine learning system, via machine learning processes known in the art learns to distinguish between the correlation graphs of non-pirated related content items, such as correlation graph 720 and correlation graph 725, which are typically non-sparse, and the correlation graphs of pirated content, such as correlation graph 730, which are typically sparse.
Correlation graphs of pirated content are assumed to be sparse because pirates typically manipulate the video so that automatic detection via simple comparison becomes difficult. Because of the variety of manipulations, including change of color, cropping, rotation/translation, audio mute/swap, there is a lower correlation between the different files compared. By contrast, however, correlation graphs of non-pirated content are assumed to be non-sparse because little manipulation is anticipated in the files. Some level of variety might be introduced in non-pirated content due to variations introduced in legitimate operations, such as trans-coding. Where two content items are compared and have a higher level of similarity, as is assumed to be the case for groups of non-pirated content items, the nodes are graphed closer to one another. On the other hand, two content items which are compared and have a lower level of similarity, as is assumed to be the case for groups of pirated content items, will result in nodes graphed further from one another. It is also understood in related fields of mathematics (such as, but not limited to directed graphs), the distinction between sparse and non-sparse correlation graphs may appear vague, and may depend on the context. However, as is known in the art, machine learning systems have been found to be successful in dealing with these vague distinctions.
Once the machine learning system has been trained using the machine learning techniques described above, groups of suspected videos may then be obtained and correlation graphs of unknown clusters 740 may be obtained using the methods described above. Unknown clusters such as correlation graphs 750, 760, 770, 780, and 790 may be typical of such unknown clusters. Each correlation graph input into the machine learning system, whether from the training data 710 data-set or from the unknown clusters 740 is a graph where each node represents the content and each edge represents a similarity factor.
The correlation graphs 750, 760, 770, 780, and 790 for the unknown clusters will then be individually fed into the machine learning system and will produce a result indicating if the content items in the group of compared content items yielding the correlation graphs 750, 760, 770, 780, and 790 are suspected of being groups of pirated content items, such as correlation graphs 780 and 790, or groups of non-pirated content items, such as correlation graphs 750, 760, and 770.
Reference is now made to FIG. 8, which is a block diagram of an exemplary device 800 comprising one or both of the machine learning system and a comparator which performs the comparison of the content items as described above with reference to FIGS. 2-6. The exemplary device 800 is suitable for implementing any of the systems, methods or processes described above. The exemplary device 800 comprises one or more processors, such as processor 801, providing an execution platform for executing machine readable instructions such as software. One of the processors 801 may be a special purpose processor operative to perform the method for piracy detection described herein above.
Commands and data from the processor 801 are communicated over a communication bus 802. The system 800 also includes a main memory 803, such as a Random Access Memory (RAM) 804, where machine readable instructions may reside during runtime, and a secondary memory 805. The secondary memory 805 includes, for example, a hard disk drive 807 and/or a removable storage drive 808, representing a floppy diskette drive, a magnetic tape drive, a compact disk drive, a flash drive, etc., or a nonvolatile memory where a copy of the machine readable instructions or software may be stored. The secondary memory 805 may also include ROM (read only memory), EPROM (erasable, programmable ROM), EEPROM (electrically erasable, programmable ROM). In addition to software, data representing any one or more of the various content items discussed herein throughout, for example, and without limiting the generality of the foregoing, original content item 110, additional versions V₁ 120, V ₂ 130, and V _n 140 of FIG. 1, and correspondingly, FIG. 2, as well as original content item {circle around (0)} 310, content {circle around (1)} 320, content {circle around (2)} 330, content {circle around (3)} 340, and content {circle around (4)} 350 of FIGS. 3-6; the correlation graphs such as correlation graph 380 of FIG. 6, the training data 710, and unknown clusters 740 of FIG. 7; or other similar data, may be stored in the main memory 803 and/or the secondary memory 805. The removable storage drive 808 reads from and/or writes to a removable storage unit 809 in a well-known manner.
A user can interface with the exemplary device 800 via a user interface which includes input devices 811, such as a touch screen, a keyboard, a mouse, a stylus, and the like in order to provide user input data. A display adaptor 815 interfaces with the communication bus 802 and a display 817 and receives display data from the processor 801 and converts the display data into display commands for the display 817.
A network interface 319 is provided for communicating with other systems and devices via a network (such as network 155 of FIG. 1). The network interface 319 typically includes a wireless interface for communicating with wireless devices in the wireless community. A wired network interface (e.g. an Ethernet interface) may be present as well. The exemplary device 800 may also comprise other interfaces, including, but not limited to Bluetooth, and HDMI.
The machine learning system 850, the use of which is described above with reference to FIG. 7, may be among the software and/or specialized hardware executed or controlled by the processor 801. As noted above, the machine learning system 850 may comprise any appropriate machine learning methods as are known in the art, including, but not limited to a neural network, a clustering algorithm, or a naïve Bayes classification algorithm. A comparator 860, which may itself comprise either hardware, software, or a combination of both hardware and software, which performs the comparing method described above with reference to FIGS. 2-5, and which outputs the correlation graphs such as correlation graph 380 of FIG. 6, is also typically executed or controlled by the processor 801.
It will be apparent to one of ordinary skill in the art that one or more of the components of the exemplary device 800 may not be included and/or other components may be added as is known in the art. The exemplary device 800 shown in FIG. 8 is provided as an example of a possible platform that may be used, and other types of platforms may be used as is known in the art. One or more of the steps described above may be implemented as instructions embedded on a computer readable medium and executed on the exemplary device 800. The steps may be embodied by a computer program, which may exist in a variety of forms both active and inactive. For example, they may exist as software program(s) comprised of program instructions in source code, object code, executable code or other formats for performing some of the steps. Any of the above may be embodied on a computer readable medium, which include storage devices and signals, in compressed or uncompressed form. Examples of suitable computer readable storage devices include conventional computer system RAM (random access memory), ROM (read only memory), EPROM (erasable, programmable ROM), EEPROM (electrically erasable, programmable ROM), and magnetic or optical disks or tapes. Examples of computer readable signals, whether modulated using a carrier or not, are signals that a computer system hosting or running a computer program may be configured to access, including signals downloaded through the Internet or other networks. Concrete examples of the foregoing include distribution of the programs on a CD ROM or via Internet download. In a sense, the Internet itself, as an abstract entity, is a computer readable medium. The same is true of computer networks in general. It is therefore to be understood that those functions enumerated above may be performed by any electronic device capable of executing the above-described functions.
Reference is now made to FIG. 9, which is a simplified flow chart diagrams of a method for an embodiment of the system FIG. 1. At step 910, a plurality of target content items are stored in a storage device associated with a memory.
At least one content items of the plurality of target content items are compared with the other content items of the plurality of target content items (step 920). At least on the basis of comparing the at least one content item of the plurality of target content items with the other content items of the plurality of target content items, a correlation graph indicating a level of correlation between each one content item of the plurality of target content items and the other content items of the plurality of target content items is developed (step 930).
At step 940 the correlation graph is input into a machine learning system. At step 950 a decision is output from the machine learning system, the decision indicating, on the basis of the level of correlation shown in the correlation graph, if the content items represented in the correlation graph are pirated content items or are not pirated content items.
It is appreciated that software components of the present invention may, if desired, be implemented in ROM (read only memory) or non-volatile memory form. The software components may, generally, be implemented in hardware, if desired, using conventional techniques. It is further appreciated that the software components may be instantiated, for example: as a computer program product or on a tangible medium. In some cases, it may be possible to instantiate the software components as a signal interpretable by an appropriate computer, although such an instantiation may be excluded in certain embodiments of the present invention.
It is appreciated that various features of the invention which are, for clarity, described in the contexts of separate embodiments may also be provided in combination in a single embodiment. Conversely, various features of the invention which are, for brevity, described in the context of a single embodiment may also be provided separately or in any suitable subcombination.
It will be appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the invention is defined by the appended claims and equivalents thereof:

Claims

What is claimed is:

1. A system comprising:

a storage device and a memory operative to store a plurality of target content items;

a comparator operative to compare one content item of the plurality of target content items with the other content items of the plurality of target content items, and, at least on the basis of comparing the one content item of the plurality of target content items with the other content items of the plurality of target content items, to develop a correlation graph indicating a level of correlation between the one content item of the plurality of target content items and the other content items of the plurality of target content items; and

a machine learning system operative to receive, as an input, the correlation graph and to output a decision which indicates, on the basis of the level of correlation shown in the correlation graph, if the content items correlated in the correlation graph are pirated content items or are not pirated content items.

2. The system according to claim 1 wherein the plurality of target content items comprises at least one original content item.

3. The system according to claim 1 wherein the comparator is controlled by a processor.

4. The system according to claim 1 wherein the machine learning system comprises a neural network.

5. The system according to claim 1 wherein the machine learning system is trained with a training group of correlation graphs prior to the machine learning system being operative to output the decision, and, at least some of the training group of correlation graphs are correlation graphs of known pirated content items, and others of the training group of correlation graphs being correlation graphs of known non-pirated content items.

6. The system according to claim 5 wherein the machine learning system comprises a neural network which is built as a result of being trained.

7. The system according to claim 1 wherein the machine learning system comprises a naïve Bayesian classification system.

8. The system according to claim 1 wherein the machine learning system comprises a system implementing a clustering algorithm.

9. The system according to claim 1 wherein a node of the correlation graph represents one of the content items, and a length of an edge between two nodes of the correlation graph represents a similarity factor between two content items represented by the two nodes.

10. The system according to claim 9 wherein two content items of the plurality of content items having a high similarity factor are graphed as two nodes with a smaller distance between them than two nodes representing two content items of the plurality of content items having a low similarity factor.

11. A method comprising:

storing a plurality of target content items in a storage device associated with a memory;

comparing, by a comparator, one content item of the plurality of target content items with the other content items of the plurality of target content items;

developing, at least on the basis of comparing the one content item of the plurality of target content items with the other content items of the plurality of target content items, a correlation graph indicating a level of correlation between the one content item of the plurality of target content items and the other content items of the plurality of target content items;

inputting the correlation graph into a machine learning system; and

outputting a decision from the machine learning system, the decision indicating, on the basis of the level of correlation shown in the correlation graph, if the content items represented in the correlation graph are pirated content items or are not pirated content items.

12. The method according to claim 11 wherein the plurality of target content items comprises at least one original content item.

13. The method according to claim 11 wherein the comparator is controlled by a processor.

14. The method according to claim 11 wherein the machine learning system comprises a neural network.

15. The method according to claim 11 and further comprising training the machine learning system with a training group of correlation graphs prior to the machine learning system being operative to output the decision, wherein at least some of the training group of correlation graphs being correlation graphs of known pirated content items, and others of the training group of correlation graphs being correlation graphs of known non-pirated content items.

16. The method according to claim 15 wherein the machine learning system comprises a neural network which is built as a result of being trained.

17. The method according to claim 11 wherein the machine learning system comprises a naïve Bayesian classification machine learning system.

18. The method according to claim 11 wherein the machine learning system comprises a clustering algorithm machine learning system.

19. The method according to claim 11 wherein a node of the correlation graph represents one of the content items, and a length of an edge between two nodes of the correlation graph represents a similarity factor between two content items represented by the two nodes.

20. The method according to claim 19 wherein two content items of the plurality of content items having a high similarity factor are graphed as two nodes with a smaller distance between them than two nodes representing two content items of the plurality of content items having a low similarity factor.