Coalition network identification

1. A method, comprising:

identifying a first plurality of sets of event information associated with a first plurality of events, wherein:

the first plurality of events is associated with a first plurality of entities corresponding to a client-side entity type and a second plurality of entities corresponding to an internet resource-side entity type;

a first set of event information of the first plurality of sets of event information is associated with a first event of the first plurality of events; and

the first set of event information is indicative of:

a first entity, of the first plurality of entities, associated with the first event; and

a second entity, of the second plurality of entities, associated with the first event;

generating, based upon the first plurality of sets of event information, a first network profile associated with the first plurality of entities and the second plurality of entities, wherein the first network profile is indicative of one or more first sets of event metrics associated with the first entity and one or more entities comprising the second entity, wherein:

the second plurality of entities comprises the one or more entities; and

a first set of event metrics of the one or more first sets of event metrics corresponds to a measure of events associated with the first entity and the second entity;

generating, based upon the first network profile, a first plurality of representations associated with the first plurality of entities;

generating, based upon the first network profile, a second plurality of representations associated with the second plurality of entities;

identifying a first plurality of clusters in the first plurality of representations, wherein a first cluster of the first plurality of clusters corresponds to a first set of representations of the first plurality of representations associated with the first plurality of entities corresponding to the client-side entity type;

identifying a second plurality of clusters in the second plurality of representations, wherein a second cluster of the second plurality of clusters corresponds to a second set of representations of the second plurality of representations associated with the second plurality of entities corresponding to the internet resource-side entity type;

analyzing the first network profile to determine a relationship between (i) a first set of entities associated with the first cluster associated with the client-side entity type and (ii) a second set of entities associated with the second cluster associated with the internet resource-side entity type; and

identifying a coalition network associated with fraudulent activity based upon the relationship determined between (i) the first set of entities associated with the client-side entity type and (ii) the second set of entities associated with the internet resource-side entity type.

2. The method of claim 1 , wherein a third entity of the first set of entities is associated with a first client device, the method comprising:

receiving a first request for content associated with the first client device; and

not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.

3. The method of claim 1 , wherein a third entity of the second set of entities is associated with a first internet resource, the method comprising:

receiving a first request associated with a first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and

not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.

4. The method of claim 1 , wherein a third entity of the first set of entities is associated with a first client device and a fourth entity of the second set of entities is associated with a first internet resource, the method comprising:

receiving a first request associated with the first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and

not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity and the fourth entity are associated with the coalition network.

5. The method of claim 1 , wherein:

the determination that the first set of entities and the second set of entities are related is based upon a determination that one or more first events of the first plurality of events are associated with one or more first entities of the first set of entities and one or more second entities of the second set of entities.

6. The method of claim 5 , wherein:

the determination that the first set of entities and the second set of entities are related is based upon a determination that the one or more first events exceeds a threshold quantity of events.

7. The method of claim 1 , wherein:

the generating the first plurality of representations associated with the first plurality of entities comprises generating a first representation associated with the first entity based upon the one or more first sets of event metrics associated with the first entity; and

the generating the second plurality of representations associated with the second plurality of entities comprises generating a second representation associated with the second entity based upon one or more second sets of event metrics, of the first network profile, associated with the second entity.

8. The method of claim 7 , wherein:

the first representation of the first plurality of representations is a first vector representation; and

the second representation of the second plurality of representations is a second vector representation.

9. The method of claim 8 , wherein:

the identifying the first plurality of clusters comprises identifying the first cluster based upon a determination that a first density of the first set of representations corresponding to the first cluster exceeds a first threshold density; and

the identifying the second plurality of clusters comprises identifying the second cluster based upon a determination that a second density of the second set of representations corresponding to the second cluster exceeds a second threshold density.

10. The method of claim 1 , wherein:

an event of the first plurality of events corresponds to at least one of:

a presentation of a first content item via a first client device; or

a selection of a second content item via a second client device.

11. The method of claim 1 , wherein:

an entity of the first plurality of entities is associated with a client device; and

an entity of the second plurality of entities is associated with an internet resource.

12. The method of claim 1 , wherein:

the first set of event metrics is indicative of at least one of:

a rate at which events associated with the first entity and the second entity occur; or

a quantity of events associated with the first entity and the second entity.

13. A computing device comprising:

a processor; and

memory comprising processor-executable instructions that when executed by the processor cause performance of operations, the operations comprising:

identifying a first plurality of sets of event information associated with a first plurality of events, wherein:

the first plurality of events is associated with a first plurality of entities corresponding to a client-side entity type and a second plurality of entities corresponding to an internet resource-side entity type;

a first set of event information of the first plurality of sets of event information is associated with a first event of the first plurality of events; and

the first set of event information is indicative of:

a first entity, of the first plurality of entities, associated with the first event; and

a second entity, of the second plurality of entities, associated with the first event;

generating, based upon the first plurality of sets of event information, a first network profile associated with the first plurality of entities and the second plurality of entities, wherein the first network profile is indicative of one or more first sets of event metrics associated with the first entity and one or more entities comprising the second entity, wherein:

the second plurality of entities comprises the one or more entities; and

a first set of event metrics of the one or more first sets of event metrics corresponds to a measure of events associated with the first entity and the second entity;

generating, based upon the first network profile, a first plurality of representations associated with a third plurality of entities comprising the first plurality of entities and the second plurality of entities;

identifying a first plurality of clusters in the first plurality of representations, wherein:

a first cluster of the first plurality of clusters corresponds to a first set of representations of the first plurality of representations associated with the third plurality of entities comprising the first plurality of entities corresponding to the client-side entity type and the second plurality of entities corresponding to the internet resource-side entity type; and

the first set of representations is associated with a first set of entities of the first plurality of entities and a second set of entities of the second plurality of entities; and

identifying a coalition network associated with fraudulent activity based upon a relationship between (i) the first set of entities associated with the client-side entity type and (ii) the second set of entities associated with the internet resource-side entity type.

14. The computing device of claim 13 , wherein a third entity of the first set of entities is associated with a first client device, the operations comprising:

receiving a first request for content associated with the first client device; and

not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.

15. The computing device of claim 13 , wherein a third entity of the second set of entities is associated with a first internet resource, the operations comprising:

receiving a first request associated with a first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and

not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.

16. The computing device of claim 13 , wherein a third entity of the first set of entities is associated with a first client device and a fourth entity of the second set of entities is associated with a first internet resource, the operations comprising:

receiving a first request associated with the first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and

not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity and the fourth entity are associated with the coalition network.

17. A non-transitory machine readable medium having stored thereon processor-executable instructions that when executed cause performance of operations, the operations comprising:

identifying a first plurality of sets of event information associated with a first plurality of events, wherein:

the first plurality of events is associated with a first plurality of entities corresponding to a first device or resource entity type and a second plurality of entities corresponding to a second device or resource entity type, wherein the first device or resource entity type is different than the second device or resource entity type;

a first set of event information of the first plurality of sets of event information is associated with a first event of the first plurality of events; and

the first set of event information is indicative of:

a first entity, of the first plurality of entities, associated with the first event; and

a second entity, of the second plurality of entities, associated with the first event;

generating, based upon the first plurality of sets of event information, a first network profile associated with the first plurality of entities and the second plurality of entities, wherein the first network profile is indicative of one or more first sets of event metrics associated with the first entity and one or more entities comprising the second entity, wherein:

the second plurality of entities comprises the one or more entities; and

a first set of event metrics of the one or more first sets of event metrics corresponds to a measure of events associated with the first entity and the second entity;

generating, based upon the first network profile, a first plurality of representations associated with the first plurality of entities;

generating, based upon the first network profile, a second plurality of representations associated with the second plurality of entities;

identifying a first plurality of clusters in the first plurality of representations, wherein a first cluster of the first plurality of clusters corresponds to a first set of representations of the first plurality of representations associated with the first plurality of entities corresponding to the first device or resource entity type;

identifying a second plurality of clusters in the second plurality of representations, wherein a second cluster of the second plurality of clusters corresponds to a second set of representations of the second plurality of representations associated with the second plurality of entities corresponding to the second device or resource entity type;

analyzing the first network profile to determine a relationship between (i) a first set of entities associated with the first cluster associated with the first device or resource entity type and (ii) a second set of entities associated with the second cluster associated with the second device or resource entity type; and

identifying a coalition network associated with fraudulent activity based upon the relationship determined between (i) the first set of entities associated with the first device or resource entity type and (ii) the second set of entities associated with the second device or resource entity type.

18. The non-transitory machine readable medium of claim 17 , wherein a third entity of the first set of entities is associated with a first client device, the operations comprising:

receiving a first request for content associated with the first client device; and

not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.

19. The non-transitory machine readable medium of claim 17 , wherein a third entity of the second set of entities is associated with a first internet resource, the operations comprising:

receiving a first request associated with a first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and

not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity is associated with the coalition network.

20. The non-transitory machine readable medium of claim 17 , wherein a third entity of the first set of entities is associated with a first client device and a fourth entity of the second set of entities is associated with a first internet resource, the operations comprising:

receiving a first request associated with the first client device, wherein the first request corresponds to a request for content to be presented via the first internet resource; and

not transmitting a content item, associated with the first request for content, to the first client device based upon a determination that the third entity and the fourth entity are associated with the coalition network.