Systems and methods for mapping a networked environment with cross account clustering to monitoring and/or detect fraudulent entity networks
Systems, methods, and non-transitory computer-readable media are provided for detecting and monitoring fraudulent entity networks in a networked environment. The networked environment can be mapped with cross account clustering to identify nodes associated with one or more entity networks in the networked environment and can identify whether the one or more entity networks are fraudulent entity networks based on a determination that one or more nodes in the one or more entity networks is a source of malignant content. Upon detecting the fraudulent entity networks, embodiments of the present disclosure can alert parties that may be affected by the one or more fraudulent entity networks and/or can initiate one or more actions against the fraudulent entity network.
1 . A system for detecting and monitoring fraudulent entity networks in a networked environment, the system comprising:
a computing system communicatively coupled to data sources in a networked environment, the data sources including one or more remote servers that are configured to host digital content;
one or more processors being disposed in the computing system, the one or more processors being programmed to:
establish separate and distinct client accounts;
search, for each client account, the digital content hosted by the one or more remote servers in the networked environment to generate separate harvested data sets for each client account;
tag each search result in the harvested data sets as legitimate or malignant based on an analysis of each search result;
generate a network graph by combining data from each search result in the harvested data sets for the client accounts, wherein the client accounts include confidential or private data that is utilized to generate the network graph;
generate clusters in the network graph, the clusters including cross-account clusters that include data from two or more client accounts;
prevent disclosure of the confidential or private data for each of the client accounts to other ones of the client accounts by modifying the cross-account clusters in the network graph to obfuscate the confidential or private data;
in response to receiving a selection or request, alter the scope of the network graph so that only nodes that have been tagged as being associated with malignant content are included in the network graph;
identify one or more fraudulent entity networks based on the clusters in the network graph; and
initiate a removal action against the identified one or more fraudulent entity networks, wherein the removal action includes a removal engine initiating an automated takedown against the identified one or more fraudulent entity networks.
2 . The system of claim 1 , wherein the one or more processors are programmed to:
analyze, for each search result in the harvested data sets for each client account, whether the search result corresponds to legitimate or malignant content; and
tag each search result in the harvested data sets for each client as legitimate or malignant based on the analysis.
3 . The system of claim 1 , wherein the one or more processors are programmed to:
create a plurality of records in a relational database for each for each unique search result in the harvested data sets for each client account; and
store data extracted from each result in harvested data set for each client account in data fields of a corresponding one of the plurality of records.
4 . The system of claim 3 , wherein the one or more processors are further programmed to:
create a graph database;
define a graph data model for the graph database;
copy the plurality of records from the relational database to documents of the graph database;
copy the data fields from the plurality of records in the relational database to keys of documents in the graph database; and
generate at least one of node collections or edge collections in the graph database based on the documents and the keys of the documents.
5 . The system of claim 4 , wherein the data forming the keys are at least one of transformed into their canonical form or converted by a hash algorithm.
6 . The system of claim 1 , wherein the one or more remote servers in the networked environment are webservers and the digital content hosted by the one or more remote servers is websites including webpages.
7 . The system of claim 1 , wherein the one or more processors are further programmed to generate at least one of the network graph or the clusters in response to execution of an entity resolution algorithm, wherein the entity resolution algorithm is a connected components algorithm.
8 . The system of claim 1 , wherein the one or more processors are programmed to:
detect formation of one of the cross-account clusters; and
alert a user of one of the client accounts associated with the one of the cross-account clusters.
9 . A method for detecting and monitoring fraudulent entity networks in a networked environment, the method implemented via a computing system communicatively coupled to data sources in the networked environment, the data sources including one or more remote servers that are configured to host digital content, and one or more processors being disposed in the computing system, the method comprising:
establishing separate and distinct client accounts;
searching, for each client account, the digital content hosted by the one or more remote servers in the networked environment to generate separate harvested data sets for each client account;
tagging each search result in the harvested data sets as legitimate or malignant based on an analysis of each search result;
generating a network graph by combining data from each search result in the harvested data sets for the client accounts, wherein the client accounts include confidential or private data that is utilized to generate the network graph;
generating clusters in the network graph, the clusters including cross-account clusters that include data from two or more client accounts;
preventing disclosure of the confidential or private data for each of the client accounts to other ones of the client accounts by modifying the cross-account clusters in the network graph to obfuscate the confidential or private data;
in response to receiving a selection or request, altering the scope of the network graph so that only nodes that have been tagged as being associated with malignant content are included in the network graph;
identifying one or more fraudulent entity networks based on the clusters in the network graph; and
initiating a removal action against the identified one or more fraudulent entity networks, including initiating, by a removal engine, an automated takedown against the identified one or more fraudulent entity networks.
10 . A non-transitory computer-readable medium storing instructions for detecting and monitoring fraudulent entity networks in a networked environment that when executed by one or more processors causes the one or more processors to:
establish separate and distinct client accounts;
search, for each client account, digital content hosted by one or more remote servers in the networked environment to generate separate harvested data sets for each client account;
tag each search result in the harvested data sets as legitimate or malignant based on an analysis of each search result;
generate a network graph by combining data from each search result in the harvested data sets for the client accounts, wherein the client accounts include confidential or private data that is utilized to generate the network graph;
generate clusters in the network graph, the clusters including cross-account clusters that include data from two or more client accounts;
prevent disclosure of the confidential or private data for each of the client accounts to other ones of the client accounts by modifying the cross-account clusters in the network graph to obfuscate the confidential or private data;
in response to receiving a selection or request, alter the scope of the network graph so that only nodes that have been tagged as being associated with malignant content are included in the network graph;
identify one or more fraudulent entity networks based on the clusters in the network graph; and
initiate a removal action against the identified one or more fraudulent entity networks, wherein the removal action includes a removal engine initiating an automated takedown against the identified one or more fraudulent entity networks.
11 . The medium of claim 10 , wherein the client accounts include confidential or private data is utilized to generate the network graph and execution of the instructions causes the one or more processors to:
prevent disclosure of the confidential or private data for each of the client accounts to other ones of the client accounts by modifying the cross-account clusters in the graph to at least one of obfuscate the confidential or private data or remove the confidential or private data.
12 . The medium of claim 10 , wherein execution of the instructions causes the one or more processors to:
analyze, for each search result in the harvested data sets for each client account, whether the search result corresponds to legitimate or malignant content; and
tag each search result in the harvested data sets for each client as legitimate or malignant based on the analysis.
13 . The medium of claim 10 , wherein execution of the instructions causes the one or more processors to:
create a plurality of records in a relational database for each for each unique search result in the harvested data sets for each client account; and
store data extracted from each result in harvested data set for each client account in data fields of a corresponding one of the plurality of records.
14 . The medium of claim 13 , wherein execution of the instructions causes the one or more processors to:
create a graph database;
define a graph data model for the graph database;
copy the plurality of records from the relational database to documents of the graph database copy the data fields from the plurality of records in the relational database to keys of documents in the graph database; and
generate at least one of node collections or edge collections in the graph database based on the documents and the keys of the documents.
15 . The medium of claim 14 , wherein the data forming the keys are at least one of transformed into their canonical form or converted by a hash algorithm.
16 . The medium of claim 10 , wherein the one or more remote servers in the networked environment are webservers and the digital content hosted by the one or more remote servers is websites including webpages.
17 . The medium of claim 10 , wherein execution of the instructions causes the one or more processors to generate at least one of the network graph or the clusters in response to execution of an entity resolution algorithm, wherein the entity resolution algorithm is a connected components algorithm.
18 . The medium of claim 10 , wherein execution of the instructions causes the one or more processors to:
detect formation of one of the cross-account clusters; and
alert a user of one of the client accounts associated with the one of the cross-account clusters.