Adaptive scoring of service requests and determining whether to fulfill service requests
Services often utilize scoring techniques to distinguish between user requests that comply with a usage policy of the service from those that represent a misuse of the service. Users who endeavor to misuse the service engages in probing by submitting a variety of requests to the service until one such request exhibiting a score that is within a score threshold, and then patterning further requests that misuse the service upon the successful request. Instead, when a first request from a user is identified that violates the score threshold, a score offset is selected. The scores of second and future requests by the user are adjusted by the score offset, indicating increased suspicion of the user's requests, while allowing legitimate requests that fulfill the score threshold by a larger margin. Additionally, absent further misuse, the score offset decays over time to restore trust incrementally in the legitimacy of the user's requests.
1. A method of providing a service by a device comprising a processor, the method comprising:
executing, by the processor, instructions that cause the device to:
for a first request from a first requester:
determine a first score indicating whether the first request complies with a usage policy of the service;
determine whether to fulfill the first request by comparing the first score with a score threshold; and
responsive to the first score failing the score threshold, initiate a score offset;
decay the score offset over time;
for a second request from the first requester:
determine a second score for the second request; and
determine whether to fulfill the second request by comparing the second score adjusted by the score offset to the score threshold;
for a first request from a second requester:
determine a third score for the first request from the second requester; and
determine whether to fulfill the first request from the second requester by comparing the third score to the score threshold; and
for a second request from the second requester:
determine a fourth score for the second request from the second requester; and
determine whether to fulfill the second request from the second requester by comparing the fourth score to the score threshold.
2. The method of claim 1 , wherein executing the instructions further causes the device to, responsive to the second request from the first requester failing the score threshold, increase the score offset.
3. The method of claim 2 , wherein:
initiating the score offset further comprises: setting the score offset to an initial score offset value; and
increasing the score threshold further comprises: resetting the score offset to the initial score offset value.
4. The method of claim 2 , wherein:
initiating the score offset further comprises: setting the score offset to an initial score offset value; and
increasing the score threshold further comprises: increasing the score offset above the initial score offset value.
5. The method of claim 1 , comprising:
determining to fulfill the first request from the second requester based upon the comparison of the third score to the score threshold.
6. The method of claim 1 , wherein:
the first request from the first requester and the second request from the first requester are of a request type;
the score offset is specific to the request type; and
determining whether to fulfill the second request from the first requester further comprises: comparing, to the score threshold, the second score adjusted by the score offset specific to the request type.
7. The method of claim 1 , wherein:
evaluating the first request from the first requester further comprises: evaluating the first request from the first requester using a heuristic; and
evaluating the second request from the first requester further comprises:
providing the score offset as an input to the heuristic.
8. The method of claim 1 , wherein:
decaying the score offset over time further comprises: decaying the score offset according to a decay rate; and
executing the instructions further causes the device to, responsive to the second request from the first requester failing the score threshold, decrease the decay rate of the score offset.
9. The method of claim 1 , wherein executing the instructions further causes the device to, responsive to determining that the second request from the first requester adjusted by the score offset satisfies the score threshold, reducing the score offset.
10. The method of claim 1 , wherein:
executing the instructions further causes the device to obscure the score offset from the first requester.
11. A nontransitory computer-readable medium storing instructions that, when executed by a processor of a device, cause the device to provide a service by:
for a first request from a first requester:
determining a first score indicating whether the first request complies with a usage policy of the service;
determining whether to fulfill the first request by comparing the first score with a score threshold; and
responsive to the first score failing the score threshold, initiating a score offset;
decaying the score offset over time;
for a second request from the first requester:
determining a second score for the second request; and
determining whether to fulfill the second request by comparing the second score adjusted by the score offset to the score threshold;
for a first request from a second requester:
determining a third score for the first request from the second requester; and
determining whether to fulfill the first request from the second requester by comparing the third score to the score threshold; and
for a second request from the second requester:
determining a fourth score for the second request from the second requester; and
determining whether to fulfill the second request from the second requester by comparing the fourth score to the score threshold.
12. The nontransitory computer-readable medium of claim 11 , wherein:
the device further comprises an adaptive heuristic that generates scores for requests according to the usage policy of the service; and
the instructions, when executed by the processor, further cause the device to, responsive to the first score failing the score threshold, train the adaptive heuristic using the first request from the first requester.
13. The nontransitory computer-readable medium of claim 12 , wherein training the adaptive heuristic further comprises: training the adaptive heuristic to recognize that one or more requests similar to the first request from the first requester fail to comply with the usage policy.
14. The nontransitory computer-readable medium of claim 12 , wherein training the adaptive heuristic further comprises: training the adaptive heuristic to choose score offsets for one or more requests that are similar to the first request from the first requester.
15. A server that provides a service, the server comprising:
a processor; and
a memory storing instructions that, when executed by the processor, cause the server to:
for a first request from a first requester:
determine a first score indicating whether the first request complies with a usage policy of the service;
determine whether to fulfill the first request by comparing the first score with a score threshold; and
responsive to the first score failing the score threshold, initiate a score offset;
decay the score offset over time;
for a second request from the first requester:
determine a second score for the second request; and
determine whether to fulfill the second request by comparing the second score adjusted by the score offset to the score threshold;
for a first request from a second requester:
determine a third score for the first request from the second requester; and
determine whether to fulfill the first request from the second requester by comparing the third score to the score threshold; and
for a second request from the second requester:
determine a fourth score for the second request from the second requester; and
determine whether to fulfill the second request from the second requester by comparing the fourth score to the score threshold.
16. The server of claim 15 , comprising:
choosing a failure response for at least one request according to a score difference between at least one score of the at least one request and the score threshold.
17. The server of claim 15 , wherein initiating the score offset further comprises: initiating at least one score offset that is proportional to a difference between the first score and the score threshold.
18. The server of claim 15 , wherein initiating the score offset further comprises: at least partially randomizing the score offset.
19. The server of claim 15 , wherein decaying the score offset further comprises: at a selected frequency, incrementally reducing the score offset.
20. The server of claim 15 , wherein:
initiating the score offset further comprises: storing a first request time of the first request from the first requester; and
decaying the score offset further comprises:
identifying a second request time of the second request from the first requester; and
decaying the score offset by which the second score is adjusted according to a time difference between the first request time and the second request time.