Classification scheme for detecting illegitimate account creation
A system and method that detects malicious account creation in a web-based platform. A method includes detecting suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an IP address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account; analyzing each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collections of account creation processes; and determining an alert condition based on at least one malicious event detection.
1. A system, comprising:
a memory; and
a processor coupled to the memory and configured to execute instructions that detect a malicious account in a web-based platform, wherein the instructions cause the processor to:
detect suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an internet protocol (IP) address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account;
analyze each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collection of account creation processes; and
determine an alert condition based on at least one malicious event detection,
wherein the domain classifier is trained by evaluating domains used to create prior accounts in order to determine a threshold, and wherein domain classifier:
obtains the domain used for the new account;
determines a number of accounts created with the domain during a predefined time period; and
generates a suspicious event if the number of accounts exceeds the threshold.
2. The system of claim 1 , wherein the username classifier is trained with a first dataset of legitimate usernames and a second dataset of illegitimate usernames, and wherein the username classifier:
analyzes the username structure of a new username to predict whether the new username is legitimate or illegitimate; and
flags an illegitimate username as a suspicious event.
3. The system of claim 2 , wherein the username classifier is trained using N-grams in combination with a Naïve Bayes classifier.
4. The system of claim 1 , wherein the username classifier is trained to predict whether the username comprises a suspicious event based on a number of characters in the username.
5. The system of claim 1 , wherein the IP address classifier is trained by evaluating IP addresses used to create prior accounts in order to determine a threshold, and wherein IP address classifier:
obtains the IP address used for the new account;
determines a number of accounts created with the IP address during a predefined time period; and
generates a suspicious event if the number of accounts exceeds the threshold.
6. The system of claim 1 , wherein the density analysis classifier:
evaluates a detected suspicious event relative to an associated time series of events within an associated time window in which the events are generated by at least one of the username classifier, IP address classifier and domain classifier; and
classifies the detected suspicious event as a malicious event if a threshold number of events were flagged as suspicious events within the associated time window.
7. The system of claim 1 , wherein each of the username classifier, IP address classifier, domain classifier and density analysis classifier are tuned to produce an overall target specificity that dictates a precision as a function of recall, wherein the precision is a ratio of correctly detected malicious events relative to a total number of detected events and recall is a probability that a malicious event will be detected.
8. The system of claim 7 , wherein the overall target specificity is determined based on a historical prevalence of correctly detected malicious events.
9. The system of claim 7 , wherein the overall target specificity is determined based on an assumption about a prevalence of malicious events in the web-based platform.
10. A computerized method, comprising:
detecting suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an internet protocol (IP) address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account;
analyzing each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collection of account creation processes; and
determining an alert condition based on at least one malicious event detection,
wherein the domain classifier is trained by evaluating domains used to create prior accounts in order to determine a threshold, and wherein domain classifier:
obtains the domain used for the new account;
determines a number of accounts created with the domain during a predefined time period; and
generates a suspicious event if the number of accounts exceeds the threshold.
11. The method of claim 10 , wherein the username classifier is trained with a first dataset of legitimate usernames and a second dataset of illegitimate usernames, and wherein the username classifier:
analyzes the username structure of a new username to predict whether the new username is legitimate or illegitimate; and
flags an illegitimate username as a suspicious event.
12. The method of claim 11 , wherein the username classifier is trained using N-grams in combination with a Naïve Bayes classifier.
13. The method of claim 10 , wherein the username classifier is trained to predict whether the username comprises a suspicious event based on a number of characters in the username.
14. The method of claim 10 , wherein the IP address classifier is trained by evaluating IP addresses used to create prior accounts in order to determine a threshold, and wherein IP address classifier:
obtains the IP address used for the new account;
determines a number of accounts created with the IP address during a predefined time period; and
generates a suspicious event if the number of accounts exceeds the threshold.
15. The method of claim 10 , wherein the density analysis classifier:
evaluates a detected suspicious event relative to an associated time series of events within an associated time window in which the events are generated by at least one of the username classifier, IP address classifier and domain classifier; and
classifies the detected suspicious event as a malicious event if a threshold number of events were flagged as suspicious events within the associated time window.
16. The method of claim 10 , wherein each of the username classifier, IP address classifier, domain classifier and density analysis classifier are tuned to produce an overall target specificity that dictates a precision as a function of recall, wherein the precision is a ratio of correctly detected malicious events relative to a total number of detected events and recall is a probability that a malicious event will be detected.
17. The method of claim 16 , wherein the overall target specificity is determined based on a historical prevalence of correctly detected malicious events.
18. The method of claim 16 , wherein the overall target specificity is determined based on an assumption about a prevalence of malicious events in the web-based platform.