Detecting synthetic user accounts using synthetic patterns learned via machine learning
The present disclosure relates to systems, methods, and non-transitory computer-readable media that detect synthetic user accounts of a digital system via machine learning. For instance, the disclosed systems can utilize a machine learning model to analyze account features that are related to a user account and generate an indication that the user account is synthetic based on the analysis. The disclosed systems can further disable (e.g., suspend or close) the user account based on determining that the user account is synthetic. In some cases, the machine learning model provides a precision score that indicates a likelihood that the user account is synthetic, and the disclosed systems disable the user account if the precision score satisfies a threshold. In some implementations, the disclosed systems generate the machine learning model using synthetic user accounts detected via one or more rules and other user accounts that are associated with those synthetic user accounts.
1. A computer-implemented method comprising:
determining a plurality of account features related to a user account of a digital system;
generating, utilizing a synthetic account detection machine learning model trained using known synthetic user accounts and additional user accounts that are suspected to be synthetic user accounts based on one or more associations with the known synthetic user accounts, an indication that the user account is synthetic based on the plurality of account features; and
disabling the user account to prevent one or more actions of the user account on the digital system based on the indication that the user account is synthetic.
2. The computer-implemented method of claim 1 , further comprising determining a precision threshold for disabling synthetic user accounts of the digital system, wherein:
generating the indication that the user account is synthetic comprises generating a precision score indicating a likelihood that the user account is synthetic; and
disabling the user account based on the indication that the user account is synthetic comprises disabling the user account based on determining that the precision score satisfies the precision threshold.
3. The computer-implemented method of claim 2 , further comprising:
determining a subsequent precision threshold that is lower than the precision threshold;
generating, for a batch of user accounts of the digital system, at least one precision score indicating that at least one user account from the batch of user accounts is synthetic utilizing the synthetic account detection machine learning model; and
disabling the at least one user account from the batch of user accounts based on determining that the at least one precision score satisfies the subsequent precision threshold.
4. The computer-implemented method of claim 3 , further comprising:
providing a notification to the at least one user account regarding disabling the at least one user account; and
determining to utilize the subsequent precision threshold to disable additional synthetic user accounts based on a response to the notification provided to the at least one user account.
5. The computer-implemented method of claim 4 , further comprising:
determining account features related to an additional user account of the digital system;
generating, utilizing the synthetic account detection machine learning model, an additional precision score indicating a likelihood that the additional user account is synthetic; and
disabling the additional user account based on determining that the additional precision score satisfies the subsequent precision threshold.
6. The computer-implemented method of claim 1 , wherein disabling the user account comprises closing the user account.
7. The computer-implemented method of claim 1 , wherein disabling the user account comprises suspending the user account and providing a notification to the user account regarding suspension of the user account.
8. The computer-implemented method of claim 1 , wherein determining the plurality of account features related to the user account of the digital system comprises determining one or more of a user profile feature, a member acquisition feature, a member service feature, a device feature, a third-party feature, a device ID feature, or a device IP feature.
9. The computer-implemented method of claim 1 , wherein the one or more associations between the known synthetic user accounts and the additional user accounts comprises at least one of a common device ID, a common physical address, a common email address, or a common phone number.
10. A non-transitory computer-readable medium storing instructions thereon that, when executed by at least one processor, cause a computing device to:
determine a plurality of account features related to a user account of a digital system;
generate, utilizing a synthetic account detection machine learning model trained using known synthetic user accounts and additional user accounts that are suspected to be synthetic user accounts based on one or more associations with the known synthetic user accounts, an indication that the user account is synthetic based on the plurality of account features; and
disable the user account to prevent one or more actions of the user account on the digital system based on the indication that the user account is synthetic.
11. The non-transitory computer-readable medium of claim 10 ,
further comprising instructions that, when executed by the at least one processor, cause the computing device to determine a precision threshold for disabling synthetic user accounts of the digital system,
wherein the instructions, when executed by the at least one processor, cause the computing device to:
generate the indication that the user account is synthetic by generating a precision score indicating a likelihood that the user account is synthetic; and
disable the user account based on the indication that the user account is synthetic by disabling the user account based on determining that the precision score satisfies the precision threshold.
12. The non-transitory computer-readable medium of claim 11 , further comprising instructions that, when executed by the at least one processor, cause the computing device to:
determine a subsequent precision threshold that is lower than the precision threshold;
generate, for a batch of user accounts of the digital system, at least one precision score indicating that at least one user account from the batch of user accounts is synthetic utilizing the synthetic account detection machine learning model; and
disable the at least one user account from the batch of user accounts based on determining that the at least one precision score satisfies the subsequent precision threshold.
13. The non-transitory computer-readable medium of claim 12 , further comprising instructions that, when executed by the at least one processor, cause the computing device to:
provide a notification to the at least one user account regarding disabling the at least one user account; and
determine to utilize the subsequent precision threshold to disable additional synthetic user accounts based on a response to the notification provided to the at least one user account.
14. The non-transitory computer-readable medium of claim 10 , wherein the instructions, when executed by the at least one processor, cause the computing device to disable the user account by closing the user account.
15. The non-transitory computer-readable medium of claim 10 , wherein the instructions, when executed by the at least one processor, cause the computing device to disable the user account by suspending the user account and providing a notification to the user account regarding suspension of the user account.
16. A system comprising:
at least one processor; and
a non-transitory computer-readable medium comprising instructions that, when executed by the at least one processor, cause the system to:
determine a plurality of account features related to a user account of a digital system;
generate, utilizing a synthetic account detection machine learning model trained known synthetic user accounts and additional user accounts that are suspected to be synthetic user accounts based on one or more associations with the known synthetic user accounts, an indication that the user account is synthetic based on the plurality of account features; and
disable the user account to prevent one or more actions of the user account on the digital system based on the indication that the user account is synthetic.
17. The system of claim 16 ,
further comprising instructions that, when executed by the at least one processor, cause the system to determine a precision threshold for disabling synthetic user accounts of the digital system,
wherein the instructions, when executed by the at least one processor, cause the system to:
generate the indication that the user account is synthetic by generating a precision score indicating a likelihood that the user account is synthetic; and
disable the user account based on the indication that the user account is synthetic by disabling the user account based on determining that the precision score satisfies the precision threshold.
18. The system of claim 17 , further comprising instructions that, when executed by the at least one processor, cause the system to:
determine a subsequent precision threshold that is lower than the precision threshold;
generate, for a batch of user accounts of the digital system, at least one precision score indicating that at least one user account from the batch of user accounts is synthetic utilizing the synthetic account detection machine learning model; and
disable the at least one user account from the batch of user accounts based on determining that the at least one precision score satisfies the subsequent precision threshold.
19. The system of claim 18 , further comprising instructions that, when executed by the at least one processor, cause the system to:
provide a notification to the at least one user account regarding disabling the at least one user account; and
determine to utilize the subsequent precision threshold to disable additional synthetic user accounts based on a response to the notification provided to the at least one user account.
20. The system of claim 16 , wherein the instructions, when executed by the at least one processor, cause the system to disable the user account by closing the user account.