Account Creation Classification Scheme for Malicious Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web-based platforms face challenges in identifying and policing malicious account creations, which are often created in bulk and automatically by malicious actors for non-legitimate purposes such as phishing, spreading fake news, and scalping.
Innovation Solution
A system and method that detects malicious account creation using a classification scheme involving a username classifier, an IP address classifier, a domain classifier, and a density analysis classifier to evaluate account creation details and identify suspicious events, determining alert conditions based on malicious event detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple classifiers are used to evaluate account creation details, then detection precision is improved, but device complexity increases
Solution Approach 1:
The detection system is divided into multiple specialized classifiers (username classifier, IP address classifier, domain classifier, density analysis classifier), each responsible for evaluating specific aspects of account creation data. This segmentation allows each classifier to focus on particular features, improving overall detection precision while maintaining manageable complexity through modular design
Solution Approach 2:
The classification system serves multiple functions: evaluating usernames, IP addresses, email domains, and analyzing event density patterns. This multi-functionality approach consolidates various detection tasks into a unified system that improves precision across different attack vectors without requiring separate independent systems
2Productivity
If automated detection systems are implemented, then productivity is improved, but false positive rate increases
Solution Approach 1:
The density analysis classifier evaluates suspicious events by analyzing the density of detected events across multiple account creation processes. This feedback mechanism allows the system to distinguish between automated bulk creations (malicious) and legitimate rapid registrations, reducing false positives while maintaining high productivity in detecting actual threats
Solution Approach 2:
The system applies partial action by not flagging every suspicious event individually, but rather evaluating the collective density and pattern of events. This approach reduces false positives by requiring multiple indicators to align before triggering alerts, while still maintaining high productivity in identifying coordinated malicious campaigns
Data Source
AI summary
A system and method that detects malicious account creation in a web-based platform. A method includes detecting suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an IP address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account; analyzing each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collections of account creation processes; and determining an alert condition based on at least one malicious event detection.