Machine learning and security classification of user accounts
Machine learning techniques are used in combination with graph data structures to perform automated classification of accounts. Graphs may be constructed using a seed node and then expanded outward to second-degree nodes and third-degree nodes that are connected to a seed user account node via direct interaction between the accounts. Characterization information regarding the interaction between accounts can be stored in the graph (e.g., quantity of interactions, types of interactions) as well as other metrics and metadata. A classifier, using random forest or another technique, may be trained using a number of different graphs that can then be used to reach a determination as to whether a user account falls into one particular category or another. These techniques can identify accounts that may be violating terms of service, committing a security violation, and/or performing illegal actions in a way that is not ascertainable from human analysis.
1. A system, comprising:
a processor; and
a non-transitory computer readable medium having stored thereon instructions executable to cause the system to perform operations comprising:
creating a seed node based on a seed account that satisfies one or more selection criteria;
creating a graph data structure corresponding to the seed node that includes information on other nodes, corresponding to other user accounts, connected to the seed node, including:
determining a plurality of second-degree accounts with which the seed account has transacted;
adding a plurality of second-degree accounts as a plurality of second-degree nodes connected to the seed node in the graph data structure, wherein each second-degree node added has less than a threshold number of connections to other nodes;
creating a first group of edges in the graph data structure indicating one or more respective transactions between the seed node and each of the plurality of second degree nodes; and
for each of the plurality of second-degree nodes:
determining, for that second-degree node, whether one or more third-degree accounts exist that have transacted with a second-degree account for that second-degree node;
if the one or more third-degree accounts exist, adding the one or more third-degree accounts as one or more third-degree nodes to the graph data structure; and
if the one or more third-degree accounts exist, creating a second respective group of edges in the graph data structure indicating links between that second-degree node and the one or more third-degree nodes;
for each of the edges in the graph data structure, calculating and storing, in the graph data structure one, or more attribute values based on one or more transactions occurring between the nodes connected to that edge; and
providing the graph data structure as an input to a machine learning model.
2. The system of claim 1 , wherein providing the graph data structure as input to the machine learning model comprises providing a label value for the seed node to the machine learning model, wherein the label value indicates whether the seed node corresponds to a user account that has engaged in behavior prohibited by an authorized use policy applicable to the user account.
3. The system of claim 1 , wherein the operations further comprise:
providing a plurality of graph data structures to the machine learning model; and
the machine learning model producing a trained classifier, based on the plurality of graph data structures, that is configured to accept an unclassified graph data structure and predict a classification value for an unclassified seed node for the unclassified graph data structure.
4. The system of claim 3 , wherein the classification value is a categorization of whether an account is likely to engage in behavior prohibited by an authorized use policy applicable to the account.
5. The machine learning system of claim 3 , wherein the classification value has a corresponding confidence value.
6. The system of claim 1 , wherein the one or more attribute values for at least one of the edges in the graph include a dispute claim type for one or more transactions.
7. The system of claim 1 , wherein the operations further comprise calculating and storing graph-level attributes for the graph data structure based on attribute values for the nodes in the graph.
8. The system of claim 7 , wherein the graph-level attributes include a proportion of nodes in the graph corresponding to accounts believed to have violated an acceptable use policy.
9. A method for machine-learning based account classification, comprising:
accessing, by a computer system, a graph data structure having a seed node that corresponds to an unclassified seed account;
providing, by the computer system, the graph data structure to a trained machine learning (ML) classifier, wherein the ML classifier was trained using a plurality of graph data structures each built using operations comprising:
determining one or more second-degree accounts with which a seed account for the graph data structure has transacted;
adding the one or more second-degree accounts as one or more second-degree nodes connected to the seed node in the graph data structure, wherein each second-degree node added has less than a threshold number of connections to other nodes;
creating a first group of edges in the graph data structure indicating links between the seed node and each of the one or more second degree nodes; and
for each of the one or more second-degree nodes:
determining, for that second-degree node, whether one or more third-degree accounts exist that have transacted with a second-degree account for that second-degree node;
if the one or more third-degree accounts exist, adding the one or more third-degree accounts as one or more third-degree nodes to the graph data structure; and
if the one or more third-degree accounts exist, creating a second respective group of edges in the graph data structure indicating links between that second-degree node and the one or more third-degree nodes; and
receiving, by the computer system from the trained ML classifier, a classification of the seed account.
10. The method of claim 9 , wherein the computer system comprises a plurality of computing devices linked via one or more networks, and wherein the computer system comprises the trained ML classifier.
11. The method of claim 9 , further comprising:
determining, by the computer system, whether to take a corrective action against the seed account based on the classification.
12. The method of claim 11 , wherein the classification indicates the seed account is believed to have engaged in collusion, further comprising taking corrective action including causing a suspension of transaction privileges for the seed account.
13. The method of claim 9 , wherein the operations to build each of the plurality of graph data structures further comprise:
for each of the edges in the graph data structure, calculating and storing, in the graph data structure, one or more attribute values based on one or more transactions occurring between the nodes connected to that edge.
14. The method of claim 9 , wherein the ML classifier comprises an artificial neural network (ANN) based classifier.
15. The method of claim 9 , wherein the classification of the seed account indicates that the seed account is likely to violate or has violated an authorized use policy (AUP) applicable to the seed account.
16. The method of claim 9 , further comprising:
based on the classification of the seed account, denying one or more electronic transactions requested by the seed account.
17. The method of claim 16 , wherein the denied one or more electronic transactions include one or more electronic monetary transactions to purchase an item.
18. A non-transitory computer-readable medium having stored thereon instructions that are executable by a computer system to cause the computer system to perform operations comprising:
accessing a graph data structure having a seed node that corresponds to an unclassified seed account;
providing the graph data structure to a trained machine learning (ML) classifier, wherein the ML classifier was trained using a plurality of graph data structures each built using operations comprising:
determining one or more second-degree accounts with which a seed account for the graph data structure has transacted;
adding the one or more second-degree accounts as one or more second-degree nodes connected to the seed node in the graph data structure, wherein each second-degree node added has less than a threshold number of connections to other nodes;
creating a first group of edges in the graph data structure indicating links between the seed node and each of the one or more second degree nodes; and
for each of the one or more second-degree nodes:
determining, for that second-degree node, whether one or more third-degree accounts exist that have transacted with a second-degree account for that second-degree node;
if the one or more third-degree accounts exist, adding the one or more third-degree accounts as one or more third-degree nodes to the graph data structure; and
if the one or more third-degree accounts exist, creating a second respective group of edges in the graph data structure indicating links between that second-degree node and the one or more third-degree nodes; and
receiving, from the trained ML classifier, a classification of the seed account.
19. The non-transitory computer-readable medium of claim 18 , wherein one or more attribute values for each of a plurality of the edges in the graph include a total purchase volume (TPV) for electronic payment transactions engaged in between nodes connected to that edge.
20. The non-transitory computer-readable medium of claim 18 , wherein the operations further comprise causing a remedial action to be taken against the seed account based on the classification of the seed account.