Detection of malicious user accounts of an online service using feature analysis
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for fraud detection. One of the methods includes partitioning a feature space into a plurality of sub feature spaces, wherein the feature space comprises features associated with user account events for an online service; generating one or more clusters of users for each of one or more sub feature spaces; comparing a feature profile of one or more of the clusters with a global feature profile to determine features of one or more the clusters that have concentrated key values that exceed a respective threshold value; for each of the one or more clusters, scoring the cluster including aggregating the degree to which the key values for features exceed the corresponding threshold values; and based on the scores of the one or more clusters, determining one or more fraud detection actions.
1. A method for fraud detection comprising:
partitioning a feature space into a plurality of sub feature spaces, wherein the feature space comprises features associated with user account events for an online service;
generating one or more clusters of users for each of one or more sub feature spaces;
comparing a feature profile of one or more of the clusters with a global feature profile to determine features of one or more the clusters that have concentrated key values that exceed a respective threshold value;
for each of the one or more clusters, scoring the cluster including aggregating the degree to which the key values for features exceed the corresponding threshold values; and
based on the scores of the one or more clusters, determining one or more fraud detection actions.
2. The method of claim 1 , wherein the one or more sub feature spaces are selected based on an examination of each feature sub space and selecting the one or more sub feature spaces based on the examination.
3. The method of claim 2 , wherein the selecting one or more sub feature spaces comprises calculating a Partitioning Power Index (PPI) of individual features and combined features in each sub feature space.
4. The method of claim 3 , wherein the PPI is configured such that more fine-grained features tend to have a higher PPI value and that features with a highly concentrated distribution tends to have a lower PPI value.
5. The method of claim 3 , wherein calculating PPI comprises one or more of determining a number of distinctive feature values, or “cardinality” or determining a total proportion of a top three key values, or “top3 sum,” wherein cardinality captures whether a feature distribution is fine-grained or coarse-grained, while top3 sum captures a skewness of a distribution.
6. The method of claim 1 , wherein a profile for a particular cluster comprises a distribution of feature key values for all features in the cluster, and wherein the global profile comprises feature distributions among all, or a set of known, good users.
7. The method of claim 6 , wherein comparing feature distributions comprises using a negative binomial distribution to model the global feature distribution.
8. The method of claim 6 , wherein comparing the feature distributions comprises setting up a dynamic cutoff value for a given cluster and a given feature.
9. The method of claim 8 , wherein the dynamic cutoff is specified based on a size of the cluster and the PPI of the feature.
10. The method of claim 1 , wherein in response to determining that a cluster has one or more features such that these features all have highly concentrated key values that exceed their corresponding threshold values determining that the cluster is a suspicious cluster.
11. The method of claim 1 , wherein scoring a particular cluster comprises summing up the amounts by which features' top key values exceed the corresponding thresholds.
12. The method of claim 11 , wherein the score calculation for a cluster factors both a number of features being triggered and the amount by which a key value concentration exceeds the threshold.
13. The method of claim 12 , wherein the final score of a cluster is the sum of all positive overhead amounts after filtering out correlated features and adjusting for a detective power of each feature.
14. The method of claim 1 , further comprising calculating a user suspiciousness score for a particular account of the online service based on a highest score calculated for a cluster among the clusters that the user account is associated with.
15. A system comprising:
one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
partitioning a feature space into a plurality of sub feature spaces, wherein the feature space comprises features associated with user account events for an online service;
generating one or more clusters of users for each of one or more sub feature spaces;
comparing a feature profile of one or more of the clusters with a global feature profile to determine features of one or more the clusters that have concentrated key values that exceed a respective threshold value;
for each of the one or more clusters, scoring the cluster including aggregating the degree to which the key values for features exceed the corresponding threshold values; and
based on the scores of the one or more clusters, determining one or more fraud detection actions.
16. The system of claim 15 , wherein the one or more sub feature spaces are selected based on an examination of each feature sub space and selecting the one or more sub feature spaces based on the examination.
17. The system of claim 16 , wherein the selecting one or more sub feature spaces comprises calculating a Partitioning Power Index (PPI) of individual features and combined features in each sub feature space.
18. The system of claim 17 , wherein the PPI is configured such that more fine-grained features tend to have a higher PPI value and that features with a highly concentrated distribution tends to have a lower PPI value.
19. The system of claim 17 , wherein calculating PPI comprises one or more of determining a number of distinctive feature values, or “cardinality” or determining a total proportion of a top three key values, or “top3 sum,” wherein cardinality captures whether a feature distribution is fine-grained or coarse-grained, while top3sum captures a skewness of a distribution.
20. The system of claim 15 , wherein a profile for a particular cluster comprises a distribution of feature key values for all features in the cluster, and wherein the global profile comprises feature distributions among all, or a set of known, good users.
21. The system of claim 20 , wherein comparing the feature distributions comprises setting up a dynamic cutoff value for a given cluster and a given feature.
22. The system of claim 15 , wherein in response to determining that a cluster has one or more features such that these features all have highly concentrated key values that exceed their corresponding threshold values determining that the cluster is a suspicious cluster.
23. The system of claim 15 , wherein scoring a particular cluster comprises summing up the amounts by which features' top key values exceed the corresponding thresholds.
24. The system of claim 23 , wherein the score calculation for a cluster factors both a number of features being triggered and the amount by which a key value concentration exceeds the threshold.
25. The system of claim 15 , further comprising calculating a user suspiciousness score for a particular account of the online service based on a highest score calculated for a cluster among the clusters that the user account is associated with.
26. One or more non-transitory computer-readable storage media encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:
partitioning a feature space into a plurality of sub feature spaces, wherein the feature space comprises features associated with user account events for an online service;
generating one or more clusters of users for each of one or more sub feature spaces;
comparing a feature profile of one or more of the clusters with a global feature profile to determine features of one or more the clusters that have concentrated key values that exceed a respective threshold value;
for each of the one or more clusters, scoring the cluster including aggregating the degree to which the key values for features exceed the corresponding threshold values; and
based on the scores of the one or more clusters, determining one or more fraud detection actions.