TECHNIQUES FOR DETECTION OF FRAUDULENT ACTIVITY IN A DISTRIBUTED SERVICES SYSTEM

1 . A method for obtaining insights from detected fraudulent activity in a distributed services system, the method comprising:

determining, by a server computer system of the distributed services system, a set of data related to a set of jobs processed by a computing platform on behalf of subscribers to the computing platform, the set of data including, for each job, a set of attribute-value pairs corresponding to a set of attributes utilized to parameterize each job in the set of jobs;

transforming, by the server computer system, the data into input data for a machine learning (ML) model executed by the server computer system;

generating, with the machine learning (ML) model executed by the server computer system, a ranked list of the set of attribute-value pairs based on predictive utility of each attribute value for identifying jobs involving fraudulent activity;

identifying, by the server computer system, a request to access information associated with the set of jobs for a particular subscriber to the computing platform;

determining, by the server computer system and in response to the request, a set of statistics for a threshold number of top attribute-value pairs in the ranked list;

presenting, by the server computer system, the threshold number of top attribute-value pairs and the set of statistics for the threshold number of top attribute-value pairs via a graphical user interface; and

generating, by the server computer system, a job processing rule for the particular subscriber based on user input identifying a top attribute-value pair in the threshold number of top attribute-value pairs.

2 . The method of claim 1 , further comprising:

identifying, by the server computer system, an unprocessed job; and

blocking, by the server computer system, processing of the unprocessed job based on the job processing rule.

3 . The method of claim 2 , wherein blocking processing of the unprocessed job based on the job processing rule is in response to determining that the unprocessed job includes the top attribute-value pair identified based on user input.

4 . The method of claim 1 , further comprising:

identifying, by the server computer system, an unprocessed job; and

processing, by the server computer system, the unprocessed job based on the job processing rule.

5 . The method of claim 1 , wherein the ranked list of the set of attribute-value pairs is generated in an offline phase and the set of statistics are generated in an online phase.

6 . The method of claim 1 , wherein the ranked list of the set of attribute-value pairs is generated automatically on a periodic basis and the set of statistics are generated on a demand basis.

7 . The method of claim 1 , wherein the set of statistics include a count or percentage of fraudulent jobs and a count or percentage of legitimate jobs for each of the top attribute-value pairs in the ranked list.

8 . The method of claim 1 , wherein the job processing rule prevents processing of a current job on behalf of the particular subscriber based on a value for the top attribute corresponding to the current job.

9 . The method of claim 1 , wherein each job corresponds to an exchange between a subscriber to the computing platform and a client of the subscriber to the computing platform.

10 . The method of claim 1 , wherein the set of statistics include a monetary value of fraudulent jobs and a monetary value of legitimate jobs for each of the top attribute-value pairs in the ranked list.

11 . A server computer system, comprising:

a memory; and

a processor coupled to the memory configured to:

determine, by a server computer system of the distributed services system, a set of data related to a set of jobs processed by a computing platform on behalf of subscribers to the computing platform, the set of data including, for each job, a set of attribute-value pairs corresponding to a set of attributes utilized to parameterize each job in the set of jobs;

transform, by the server computer system, the data into input data for a model executed by the server computer system;

generate, with the model executed by the server computer system, a ranked list of the set of attribute-value pairs based on predictive utility of each attribute value for identifying jobs involving fraudulent activity;

identify, by the server computer system, a request to access information associated with the set of jobs for a particular subscriber to the computing platform;

determine, by the server computer system and in response to the request, a set of statistics for a threshold number of top attribute-value pairs in the ranked list;

present, by the server computer system, the threshold number of top attribute-value pairs and the set of statistics for the threshold number of top attribute-value pairs via a graphical user interface; and

generate, by the server computer system, a job processing rule for the particular subscriber based on user input identifying a top attribute-value pair in the threshold number of top attribute-value pairs.

12 . The server computer system of claim 11 , wherein the processor coupled to the memory is further configured to:

identify an unprocessed job; and

block processing of the unprocessed job based on the job processing rule.

13 . The server computer system of claim 12 , wherein blocking processing of the unprocessed job based on the job processing rule is in response to determining that the unprocessed job includes the top attribute-value pair identified based on user input.

14 . The server computer system of claim 11 , wherein the ranked list of the set of attribute-value pairs is generated in an offline phase and the set of statistics are generated in an online phase.

15 . The server computer system of claim 11 , wherein the ranked list of the set of attribute-value pairs is generated automatically on a periodic basis and the set of statistics are generated on a demand basis.

16 . The server computer system of claim 11 , wherein the set of statistics include a count or percentage of fraudulent jobs and a count or percentage of legitimate jobs for each of the top attribute-value pairs in the ranked list.

17 . A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform operations, the operations comprising:

determining, by a server computer system of the distributed services system, a set of data related to a set of jobs processed by a computing platform on behalf of subscribers to the computing platform, the set of data including, for each job, a set of attribute-value pairs corresponding to a set of attributes utilized to parameterize each job in the set of jobs;

transforming, by the server computer system, the data into input data for a model executed by the server computer system;

generating, with the model executed by the server computer system, a ranked list of the set of attribute-value pairs based on predictive utility of each attribute value for identifying jobs involving fraudulent activity;

identifying, by the server computer system, a request to access information associated with the set of jobs for a particular subscriber to the computing platform;

determining, by the server computer system and in response to the request, a set of statistics for a threshold number of top attribute-value pairs in the ranked list;

presenting, by the server computer system, the threshold number of top attribute-value pairs and the set of statistics for the threshold number of top attribute-value pairs via a graphical user interface; and

generating, by the server computer system, a job processing rule for the particular subscriber based on user input identifying a top attribute-value pair in the threshold number of top attribute-value pairs.

18 . The non-transitory computer readable storage medium of claim 17 , the operations further comprising:

identifying, by the server computer system, an unprocessed job; and

blocking, by the server computer system, processing of the unprocessed job based on the job processing rule.

19 . The non-transitory computer readable storage medium of claim 18 , wherein blocking processing of the unprocessed job based on the job processing rule is in response to determining that the unprocessed job includes the top attribute-value pair identified based on user input.

20 . The non-transitory computer readable storage medium of claim 17 , wherein the set of statistics include a count or percentage of fraudulent jobs and a count or percentage of legitimate jobs for each of the top attribute-value pairs in the ranked list.