Detection of adversarial networks

1. A computer-implemented method of detecting adversarial networks, the method comprising:

determining, over a first time period, a first group of internet protocol (IP) addresses, wherein each IP address of the first group of IP addresses, when expressed in decimal notation, comprises four or fewer different values from each other IP address of the first group of IP addresses;

determining a number of unique user identifiers associated with the first group of IP addresses;

determining a ratio of the number of unique user identifiers to a number of IP addresses in the first group of IP addresses;

determining that the ratio is less than a threshold ratio; and

preventing the first group of IP addresses from accessing a call-back service in response to the ratio being less than the threshold ratio.

2. The computer-implemented method of claim 1 , further comprising:

determining a set of ordered numbers common to each of the IP addresses of the first group of IP addresses;

receiving a first request from a first IP address to access the call-back service;

determining that the first IP address includes the set of ordered numbers; and

determining that a return telephone call not be made in response to the first request based at least in part on the determination that the first IP address includes the set of ordered numbers.

3. The computer-implemented method of claim 2 , further comprising:

receiving a second request from the first IP address to access a second service, different from the call-back service; and

allowing the second request from the first IP address to access the second service.

4. The computer-implemented method of claim 2 , further comprising:

determining a first user identifier associated with the first request from the first IP address;

receiving, after receiving the first request, a second request from the first IP address to access a second service different from the call-back service; and

allowing the second request to access the second service.

5. A method comprising:

receiving a first plurality of requests over a first time period, the first plurality of requests being requests to access a first service;

determining a hierarchical data representation of each request of the first plurality of requests, each of the hierarchical data representations comprising an ordered set of values;

determining a first subset of the first plurality of requests, wherein the hierarchical data representation associated with each request of the first subset includes fewer than a threshold number of value substitutions relative to each other hierarchical data representation of the first subset of the first plurality of requests;

determining a number of unique account identifiers associated with the first subset of the first plurality of requests;

determining a number of hierarchical data representations associated with the first subset of the first plurality of requests;

determining a ratio of the number of unique account identifiers to the number of hierarchical data representations associated with the first subset of the first plurality of requests; and

preventing access to the first service by subsequent requests associated with the first subset of the first plurality of requests.

6. The method of claim 5 , further comprising:

determining a threshold ratio; and

determining that the ratio of the number of unique account identifiers to the number of hierarchical data representations associated with the first subset of the first plurality of requests is less than the threshold ratio, wherein the preventing access to the first service by subsequent requests associated with the first subset of the first plurality of requests is based at least in part on the ratio of the number of unique account identifiers to the number of hierarchical data representations associated with the first subset of the first plurality of requests being less than the threshold ratio.

7. The method of claim 5 , further comprising:

determining a set of common values among the hierarchical data representations of the first subset of the first plurality of requests;

receiving a second request at a second time period following the first time period;

determining that a hierarchical data representation associated with the second request comprises the set of common values; and

preventing access to the first service by the second request.

8. The method of claim 7 , further comprising:

determining that the second request is related to a second service, different from the first service; and

allowing the second request to access the second service.

9. The method of claim 7 , further comprising:

determining a first user identifier associated with the second request;

receiving, after receiving the second request, a third request to access a third service different from the first service; and

allowing subsequent access to the first service by requests associated with the hierarchical data representation associated with the second request.

10. The method of claim 5 , further comprising:

determining a first number of requests among the first subset of the first plurality of requests that are not associated with an account identifier;

determining a second number of hierarchical data representations associated with the first subset of the first plurality of requests; and

determining a ratio of the first number of requests to the second number of hierarchical data representations; and

determining that the ratio is less than a threshold ratio.

11. The method of claim 5 , wherein the hierarchical data representations include at least one of a phone number or an internet protocol (IP) address.

12. A system, comprising:

at least one processor; and

at least one non-transitory computer-readable memory configured in communication with the at least one processor, the at least one non-transitory computer-readable memory storing instructions that, when executed by the at least one processor, are effective to program the at least one processor to:

receive a first plurality of requests over a first time period, the first plurality of requests being requests to access a first service;

determine a hierarchical data representation of each request of the first plurality of requests, each of the hierarchical data representations comprising an ordered set of values;

determine a first subset of the first plurality of requests, wherein the hierarchical data representation associated with each request of the first subset include fewer than a threshold number of value substitutions relative to each other hierarchical data representation of the first subset of the first plurality of requests;

determine a number of unique account identifiers associated with the first subset of the first plurality of requests;

determine a number of hierarchical data representations associated with the first subset of the first plurality of requests;

determine a ratio of the number of unique account identifiers to the number of hierarchical data representations associated with the first subset of the first plurality of requests; and

prevent access to the first service by subsequent requests associated with the first subset of the first plurality of requests.

13. The system of claim 12 , the at least one non-transitory computer-readable memory storing further instructions that, when executed by the at least one processor, are further effective to program the at least one processor to:

determine a threshold ratio; and

determine that the ratio of the number of unique account identifiers to the number of hierarchical data representations associated with the first subset of the first plurality of requests is less than the threshold ratio, wherein the preventing access to the first service by subsequent requests associated with the first subset of requests is based at least in part on the ratio of the number of unique account identifiers to the number of hierarchical data representations associated with the first subset of the first plurality of requests being less than the threshold ratio.

14. The system of claim 12 , the at least one non-transitory computer-readable memory storing further instructions that, when executed by the at least one processor, are further effective to program the at least one processor to:

determine a set of common values among the hierarchical data representations of the first subset of the first plurality of requests;

receive a second request at a second time period following the first time period;

determine that a hierarchical data representation associated with the second request comprises the set of common values; and

prevent access to the first service by the second request.

15. The system of claim 14 , the at least one non-transitory computer-readable memory storing further instructions that, when executed by the at least one processor, are further effective to program the at least one processor to:

determine that the second request is related to a second service, different from the first service; and

allow the second request to access the second service.

16. The system of claim 14 , the at least one non-transitory computer-readable memory storing further instructions that, when executed by the at least one processor, are further effective to program the at least one processor to:

determine a first user identifier associated with the second request;

receive, after receiving the second request, a third request to access a third service different from the first service; and

allow subsequent access to the first service by requests associated with the hierarchical data representation associated with the second request.

17. The system of claim 12 , the at least one non-transitory computer-readable memory storing further instructions that, when executed by the at least one processor, are further effective to program the at least one processor to:

determine a first number of requests among the first subset of the first plurality of requests that are not associated with an account identifier;

determine a second number of hierarchical data representations associated with the first subset of the first plurality of requests; and

determine a ratio of the first number of requests to the second number of hierarchical data representations; and

determine that the ratio is less than a threshold ratio.

18. The system of claim 12 , wherein the hierarchical data representations include at least one of a phone number or an internet protocol (IP) address.