Anomalous Account Detection via Dynamic Feature Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in distinguishing anomalous user accounts, such as spam accounts, from valid accounts, as they share common features, leading to difficulties in developing effective detection models that balance precision and coverage.
Innovation Solution
A computer-implemented method that evaluates unknown user accounts by comparing features with known anomalous accounts, calculating correlation and dependence values, and using a Naïve Bayesian algorithm to determine a risk score, thereby identifying potentially spam accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection methods are used to identify anomalous accounts, then the detection process is simple, but the precision and coverage are insufficient due to shared features between anomalous and valid accounts
Solution Approach 1:
The detection model is segmented into multiple independent components: feature extraction module, correlation calculation module, dependence analysis module, and risk scoring module. Each module handles a specific aspect of the detection process, allowing complex analysis to be broken down into manageable segments that can be executed efficiently
Solution Approach 2:
The patent transitions from traditional single-dimension feature matching to multi-dimensional analysis by calculating correlation values and dependence values across multiple features simultaneously. This dimensional expansion allows the system to capture complex relationships between features that single-dimension methods miss
2Reliability
If more features are analyzed to improve detection coverage, then the coverage increases, but the computational time and resources increase
Solution Approach 1:
Correlation values and dependence values are pre-calculated and stored for all features before actual account detection. This preliminary computation allows the detection phase to quickly retrieve and combine pre-computed values without performing heavy calculations in real-time, significantly reducing computational time during detection
Solution Approach 2:
The system automatically selects and weights features based on their pre-calculated correlation and dependence values, eliminating the need for manual feature selection and optimization. The model self-adjusts to use only the most informative features, reducing computational overhead while maintaining coverage
3Measurement precision
If manual review is used to verify accounts, then the precision can be high, but the productivity is low and the burden on reviewers is high
Solution Approach 1:
The automated detection system acts as an intermediary between raw account data and human reviewers. It pre-processes accounts by calculating risk scores based on multiple features, and only flags accounts exceeding the threshold for manual review. This intermediary layer filters out most accounts automatically, reducing reviewer burden while maintaining precision
Solution Approach 2:
The patent replaces manual mechanical review processes with an automated computational system that performs feature analysis, correlation calculation, and risk scoring. This substitution handles the bulk of verification work algorithmically, reserving human review only for borderline cases, thereby dramatically increasing productivity
4Ease of operation
If simple detection rules are applied, then the ease of operation is high, but the ability to distinguish anomalous accounts is insufficient
Solution Approach 1:
The system dynamically changes parameters (correlation thresholds, dependence weights) based on pre-analyzed data patterns. Instead of using fixed simple rules, the model adapts parameter values to reflect actual relationships between features in the data, improving distinction accuracy while maintaining automated operation that preserves ease of use
Data Source
AI summary
This specification describes technologies relating to detecting anomalous user accounts. A computer implemented method is disclosed which evaluates an unknown status user account. The method described compares features associated with a plurality of known anomalous user accounts stored in a database to features present in the unknown account. A correlation value corresponding to the probability of a specific feature occurring in a particular anomalous user account is calculated and a dependence value corresponding to the degree of dependence between the given feature and at least one other feature is also calculated. A subset of features in the unknown account is generated comprising those features that possess a correlation value less than a threshold value and a dependence value below a maximum correlation value. A risk score for the unknown account is calculated by selecting those features from the subset that maximizes the correlation value. The unknown account is then reviewed by an account reviewer if the risk score exceeds a threshold value.