Detecting fraud by calculating email address prefix mean keyboard distances using machine learning optimization
This disclosure relates to systems and methods for identifying fraudulent email addresses associated with an electronic payment service. In some implementations, a computing device receives an email with a prefix having a number of characters and characterized by a prefix length indicative of the number of characters in the prefix. The computing device identifies each of a number of bigrams is identified within the prefix, and determines a row and column distance for each bigram between two consecutive characters of the bigram as positioned on a keyboard. The computing device calculates a Euclidean distance between the two consecutive characters of the bigram based on the row and column distances, and determines a normalized distance based on the prefix length and an average of the Euclidean distances calculated for the number of bigrams in the prefix. The normalized distance is compared with a value to classify the email as suspicious or as not suspicious.
1. A method of identifying fraudulent emails, the method performed by one or more processors of a computing device and comprising:
receiving an email comprising a prefix including a number of characters and characterized by a prefix length indicative of the number of characters in the prefix;
identifying each of a number of bigrams within the prefix, each bigram of the number of bigrams consisting of two consecutive characters of the prefix;
determining, for the each bigram of the number of bigrams, a row distance and a column distance between the two consecutive characters of the each bigram as positioned on a keyboard;
calculating, for the each bigram of the number of bigrams, an Euclidean distance between the two consecutive characters of the each bigram based on the determined row and column distances;
determining a normalized distance based on the prefix length and an average of the Euclidean distances calculated for the number of bigrams in the prefix;
comparing the normalized distance with a value; and
classifying the email as suspicious or as not suspicious based at least in part on the comparing.
2. The method of claim 1 , wherein classifying the email comprises:
classifying the email as suspicious when the normalized distance is less than the value; and
classifying the email as not suspicious when the normalized distance is not less than the value.
3. The method of claim 1 , further comprising:
for the each bigram of the number of bigrams, assigning a x-coordinate and a y-coordinate to each of the two consecutive characters in the each bigram.
4. The method of claim 3 , further comprising:
calculating the row distance between the two consecutive characters of a respective bigram based on a difference between absolute values of the x-coordinates of the two consecutive characters of the respective bigram; and
calculating the column distance between the two consecutive characters of the respective bigram based on a difference between absolute values of the y-coordinates of the two consecutive characters of the respective bigram.
5. The method of claim 3 , further comprising:
creating a mapping between each of the characters in the prefix and a corresponding set of x-coordinates and y-coordinates.
6. The method of claim 1 , further comprising, for the each bigram:
determining a weighted row distance by multiplying the row distance of the each bigram by a first parameter; and
determining a weighted column distance by multiplying the column distance of the each bigram by a second parameter, wherein the Euclidean distance of the each bigram is based on the weighted row distance, the weighted column distance, and the prefix length.
7. The method of claim 6 , wherein the Euclidean distance is calculated by taking a square root of a distance value based on a sum of the weighted row distance squared and the weighted column distance squared.
8. The method of claim 6 , further comprising:
iteratively optimizing the first and second parameters using a machine learning classification model.
9. The method of claim 8 , further comprising:
inferring a fraud level of the email based at least in part on the first and second optimized parameters.
10. The method of claim 8 , wherein the machine learning classification model is based on at least one of a decision tree or a logistic regression.
11. A computing device for identifying fraudulent emails addresses, the computing device comprising:
one or more processors; and
a memory coupled to the one or more processors and storing instructions that, when executed by the one or more processors, cause the computing device to perform operations comprising:
receiving an email comprising a prefix including a number of characters and characterized by a prefix length indicative of the number of characters in the prefix;
identifying each of a number of bigrams within the prefix, each bigram of the number of bigrams consisting of two consecutive characters of the prefix;
determining, for the each bigram of the number of bigrams, a row distance and a column distance between the two consecutive characters of the each bigram as positioned on a keyboard;
calculating, for the each bigram of the number of bigrams, an Euclidean distance between the two consecutive characters of the each bigram based on the determined row and column distances;
determining a normalized distance based on the prefix length and an average of the Euclidean distances calculated for the number of bigrams in the prefix;
comparing the normalized distance with a value; and
classifying the email as suspicious or as not suspicious based at least in part on the comparing.
12. The computing device of claim 11 , wherein execution of the instructions for classifying the email causes the computing device to perform operations further comprising:
classifying the email as suspicious when the normalized distance is less than the value; and
classifying the email as not suspicious when the normalized distance is not less than the value.
13. The computing device of claim 11 , wherein execution of the instructions causes the computing device to perform operations further comprising:
for the each bigram of the number of bigrams, assigning a x-coordinate and a y-coordinate to each of the two consecutive characters in the each bigram.
14. The computing device of claim 13 , wherein execution of the instructions causes the computing device to perform operations further comprising:
calculating the row distance between the two consecutive characters of a respective bigram based on a difference between absolute values of the x-coordinates of the two consecutive characters of the respective bigram; and
calculating the column distance between the two consecutive characters of the respective bigram based on a difference between absolute values of the y-coordinates of the two consecutive characters of the respective bigram.
15. The computing device of claim 13 , wherein execution of the instructions causes the computing device to perform operations further comprising:
creating a mapping between each of the characters in the prefix and a corresponding set of x-coordinates and y-coordinates.
16. The computing device of claim 11 , wherein execution of the instructions causes the computing device to perform operations further comprising, for each bigram:
determining a weighted row distance by multiplying the row distance of the each bigram by a first parameter; and
determining a weighted column distance by multiplying the column distance of the each bigram by a second parameter, wherein the Euclidean distance of the each bigram is based on the weighted row distance, the weighted column distance, and the prefix length.
17. The computing device of claim 16 , wherein the Euclidean distance is calculated by taking a square root of a distance value based on a sum of the weighted row distance squared and the weighted column distance squared.
18. The computing device of claim 16 , wherein execution of the instructions causes the computing device to perform operations further comprising:
iteratively optimizing the first and second parameters using a machine learning classification model.
19. The computing device of claim 18 , wherein execution of the instructions causes the computing device to perform operations further comprising:
inferring a fraud level of the email based at least in part on the first and second optimized parameters.
20. The computing device of claim 18 , wherein the machine learning classification model is based on at least one of a decision tree or a logistic regression.