Auto adaptive anomaly detection system for streams

1. A computer-implemented method for detecting fraud in electronic commerce traffic, the method comprising:

determining, by one or more processors, a global conversion rate for electronic commerce traffic to a commercial website, the global conversion rate defining activity related to a purchase made or proxy activity executed that is indicative of non-fraud activity, the global conversion rate representing a fraction of the electronic commerce traffic that leads to the purchase or the proxy activity;

monitoring, by the one or more processors, subsets of the electronic commerce traffic to the commercial website for clusters of activity having a conversion rate that is lower than the global conversion rate by a threshold margin, the conversion rate representing a fraction of a subset out of the subsets of the electronic commerce traffic that leads to the purchase or the proxy activity, the monitoring subsets of the electronic commerce traffic to the commercial website further including:

registering, by the one or more processors, a number of user-initiated input signals associated with an IP address to navigate from each of one or more affiliate websites to the commercial website, the IP address associated with geo-location data; and

registering, by the one or more processors, a number of conversions generated from each of the one or more affiliate websites;

detecting, by the one or more processors, of a change in the electronic commerce traffic in an amount of the electronic commerce traffic above or below a predetermined threshold in which the change extends for a predefined threshold term;

scaling, by the one or more processors, the global conversion rate to be a scaled global conversion rate in accordance with the detected change, the scaling comprising adjusting, by the one or more processors, of a tunable parameter that modifies the global conversion rate, the adjusting based on the change;

comparing, by the one or more processors, the scaled global conversion rate to each of the conversion rates in order to detect anomalous conversion rates;

generating, by the one or more processors, a score for each user-initiated input signal, wherein the score ranks the pathology of the traffic related to the user-initiated input signal;

comparing, by the one or more processors, the score to a threshold;

detecting, by the one or more processors, anomalous conversion rates based on the comparing of the scaled global conversion rate to each of the conversion rates, based on the geo-location data, and based on scores exceeding the threshold; and

providing, by the one or more processors, data encapsulating the detection of the anomalous conversion rates to a user interface.

2. A method in accordance with claim 1 , further comprising applying, by the one or more processors, a smoothing algorithm to the registered number of conversions generated from each of the one or more affiliate websites to generate a statistically smoothed sample to detect a sharp peak of the clusters of activity having the conversion rate that is lower than the global conversion rate.

3. A method in accordance with claim 2 , wherein the smoothing algorithm is based upon χ 2 statistics.

4. A method in accordance with claim 2 , wherein the smoothing algorithm is based upon calculating the conversion rate by mixing in a specified and tunable number of user-initiated input signals with the global conversion rate.

5. A method in accordance with claim 1 , wherein monitoring subsets of the electronic commerce traffic to the commercial website further includes tracking an IP address from which the user-initiated input signals from the input device are received.

6. A method in accordance with claim 5 , further comprising computing, by the one or more processors, a smoothed conversion rate using a smoothing algorithm.

7. A method in accordance with claim 1 , wherein the adjusting of the tunable parameter is further based on a selected advertising campaign related to the commercial website and also based on normal variations in a volume of the electronic commerce traffic to the commercial website.

8. A method in accordance with claim 7 , further comprising applying, by the one or more processors, a periodicity factor to the monitoring.

9. A method in accordance with claim 1 , wherein the scores exceeding the threshold are identified after a threshold quantity of user-initiated input signals is satisfied for a given cluster of activity.

10. A method in accordance with claim 1 , wherein the score is generated according to the model:

S

=

1000

⁢

⁢

1

1

+

e

a

0

+

∑

⁢

a

i

⁢

z

i

where a 0 is a score that an average user-initiated input signal associated with the global conversion rate will receive, and z i are the smoothed ratio of conversion rates.

11. A method in accordance with claim 1 , wherein monitoring subsets of the electronic commerce traffic to the commercial website further includes monitoring for user-initiated input signals that are above a baseline volume of paid-search electronic commerce traffic.

12. A computer-implemented method for detecting fraud in electronic commerce traffic, the method comprising:

defining, by the one or more processors, a global conversion rate that represents activity related to a purchase made or proxy activity executed during electronic commerce traffic to a commercial website that is indicative of non-fraud activity, the global conversion rate representing a fraction of the electronic commerce traffic that leads to the purchase or the proxy activity;

monitoring, by the one or more processors, subsets of the electronic commerce traffic to a commercial website for clusters of activity having a conversion rate that is lower than the global conversion rate by a threshold margin, the conversion rate representing a fraction of a subset out of the subsets of the electronic commerce traffic that leads to the purchase or the proxy activity, the monitoring subsets of the electronic commerce traffic to the commercial website further including:

registering, by the one or more processors, a number of user-initiated input signals associated with an IP address to navigate from each of one or more affiliate websites to the commercial website, the IP address associated with geo-location data; and

registering, by the one or more processors, a number of conversions generated from each of the one or more affiliate websites;

detecting, by the one or more processors, of a change in the electronic commerce traffic in an amount of the electronic commerce traffic above or below a predetermined threshold in which the change extends for a predefined threshold term;

scaling, by the one or more processors, the global conversion rate to be a scaled global conversion rate in accordance with the detected change, the scaling comprising adjusting, by the one or more processors, of a tunable parameter that modifies the global conversion rate, the adjusting based on the change;

comparing, by the one or more processors, the scaled global conversion rate to each of the conversion rates in order to detect anomalous conversion rates;

generating, by the one or more processors, a score for each user-initiated input signal, wherein the score ranks the pathology of the traffic related to the user-initiated input signal;

comparing, by the one or more processors, the score to a threshold;

detecting, by the one or more processors, anomalous conversion rates based on the comparing of the scaled global conversion rate to each of the conversion rates, based on the geo-location data, and based on scores exceeding the threshold; and

providing, by the one or more processors, data encapsulating the detection of the anomalous conversion rates to a user interface.

13. A method in accordance with claim 12 , further comprising applying, by the one or more processors, a smoothing algorithm to the registered number of conversions generated from each of the one or more affiliate websites to generate a statistically smoothed sample to detect a sharp peak of the clusters of activity having the conversion rate that is lower than the global conversion rate.

14. A method in accordance with claim 12 , wherein monitoring subsets of the electronic commerce traffic to the commercial website further includes tracking an IP address from which the user-initiated input signals from the input device are received.

15. A method in accordance with claim 12 , wherein monitoring subsets of the electronic commerce traffic to the commercial website further includes tracking traffic for a selected advertising campaign related to the commercial website.

16. A system for detecting fraud in electronic commerce traffic, the system comprising:

a global conversion rate definition tool, implemented by one or more processors, defining a global conversion rate that represents activity related to a purchase made or proxy activity executed during electronic commerce traffic to a commercial website that is indicative of non-fraud activity, the global conversion rate representing a fraction of the electronic commerce traffic that leads to the purchase or the proxy activity;

a web traffic monitor, implemented by the one or more processors, configured to monitor subsets of the electronic commerce traffic to a commercial website for clusters of activity having a conversion rate that is lower than the global conversion rate by a threshold margin, the conversion rate representing a fraction of a subset out of the subsets of the electronic commerce traffic that leads to the purchase or the proxy activity, the monitoring subsets of the electronic commerce traffic to the commercial website further including:

registering, by the one or more processors, a number of user-initiated input signals associated with an IP address to navigate from each of one or more affiliate websites to the commercial website, the IP address associated with geo-location data; and

registering, by the one or more processors, a number of conversions generated from each of the one or more affiliate web sites;

detecting, by the one or more processors, of a change in the electronic commerce traffic in an amount of the electronic commerce traffic above or below a predetermined threshold in which the change extends for a predefined threshold term;

scaling, by the one or more processors, the global conversion rate to be a scaled global conversion rate in accordance with the detected change, the scaling comprising adjusting, by the one or more processors, of a tunable parameter that modifies the global conversion rate, the adjusting based on the change;

comparing, by the one or more processors, the scaled global conversion rate to each of the conversion rates in order to detect anomalous conversion rates;

generating, by the one or more processors, a score for each user-initiated input signal, wherein the score ranks the pathology of the traffic related to the user-initiated input signal;

comparing, by the one or more processors, the score to a threshold;

detecting, by the one or more processors, anomalous conversion rates based on the comparing of the scaled global conversion rate to each of the conversion rates, based on the geo-location data, and based on scores exceeding the threshold; and

providing, by the one or more processors, data encapsulating the detection of the anomalous conversion rates to a user interface.

17. A system in accordance with claim 16 , wherein the scores exceeding the threshold are identified after a threshold quantity of user-initiated input signals is satisfied for a given cluster of activity.