Deep Neural Network Fraud Detection via Hierarchical Content Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional online services face challenges in detecting coordinated malicious accounts, as attackers use automated scripts to generate content that mimics legitimate users, making it difficult to distinguish between malicious and legitimate patterns, especially when the distribution of normal user content is unknown.
Innovation Solution
A system utilizing a combination of Single-User, Multi-Users, and Group Models, powered by deep neural networks, analyzes content generated by groups of accounts to identify suspicious patterns, leveraging attention mechanisms and convolutional neural networks to extract and compare features across users, effectively detecting coordinated malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated scripts are used to generate content for multiple accounts, then productivity of the attack increases, but detection difficulty increases due to pattern uniformity
Solution Approach 1:
The system segments the analysis into multiple hierarchical levels: individual user content analysis, cluster-level pattern analysis, and distribution-level statistical analysis. This segmentation allows detection of coordinated attacks by examining patterns across different granularities simultaneously.
Solution Approach 2:
The system transitions from analyzing individual content items to analyzing the distribution space of content features. By projecting content into a multi-dimensional feature space and examining distribution patterns, the system detects coordinated attacks that are invisible at the individual content level.
2Measurement precision
If content distribution characteristics are analyzed, then detection accuracy improves, but computational complexity increases
Solution Approach 1:
The system pre-computes and stores distribution characteristics of legitimate user content across multiple dimensions during normal operation. When detecting potential attacks, it compares against these pre-established baselines, avoiding the need for complex real-time computations while maintaining high detection accuracy.
Solution Approach 2:
The system introduces distribution statistics as an intermediary layer between raw content and detection decisions. Instead of directly analyzing complex content patterns, it uses distribution characteristics (means, variances, skewness) as intermediate representations that simplify the detection process while preserving detection accuracy.
3Measurement precision
If deep learning models are trained on large datasets, then pattern recognition capability improves, but training data requirements increase
Solution Approach 1:
The system changes the parameters being learned by the model from raw content features to distributional statistics (means, variances, higher-order moments). This parameter transformation allows the model to learn with smaller datasets because distributional characteristics capture essential patterns more efficiently than raw features.
Solution Approach 2:
The system discards the need for large volumes of labeled training data by using unsupervised distribution analysis. It recovers detection capability by leveraging the inherent statistical structure of legitimate user content, which can be characterized without labeled examples of malicious behavior.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting suspicious accounts. One of the methods includes identifying one or more potential clusters of malicious accounts; for each cluster, processing a collection of content associated with each account of the cluster, the processing comprising applying a plurality of models in series to determine whether the collection of content indicates a common pattern; and based on the respective determinations, classifying the accounts of each cluster as ordinary or suspicious.