Fraud Detection via Usage Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud storage service providers face challenges in detecting fraudulent usage of prohibited content, such as child pornography or hate speech, without compromising user privacy or violating legal requirements, as existing methods like 'notice-and-takedown' can be circumvented by moving illicit content between accounts.
Innovation Solution
A technique that involves receiving notifications of prohibited content, 'corrupting' the data in reported accounts to make it inaccessible without closing them, collecting and analyzing usage data to build a model of fraudulent behavior, and using this model to block or limit further fraudulent usage, while maintaining user privacy through anonymization and consent-based data collection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the service provider takes down or closes the account hosting prohibited content, then the prohibited content becomes inaccessible to other users, but the fraudulent account can be moved to another account and reactivated
Solution Approach 1:
The system implements a feedback mechanism by collecting usage data from accounts that have been reported for prohibited content, analyzing this data to identify patterns of fraudulent behavior, and using these insights to improve future detection. The account is not immediately closed but kept under monitoring, allowing the system to observe whether the account exhibits typical fraudulent patterns (such as rapid creation, immediate content upload, and quick abandonment) before taking final action. This feedback loop enables continuous improvement of detection algorithms without prematurely eliminating potentially valuable detection opportunities.
Solution Approach 2:
The system performs preliminary actions by collecting and analyzing usage data from reported accounts before making final determinations about fraudulent behavior. Instead of immediately closing accounts upon receiving reports, the system first gathers comprehensive usage patterns, compares them against known fraudulent profiles, and only then decides whether to close the account or allow it to remain under monitoring. This preliminary analysis phase prevents premature account closures and enables more accurate identification of truly fraudulent accounts.
2Measurement precision
If the service provider scans stored content to detect prohibited content, then detection accuracy improves, but user privacy is compromised
Solution Approach 1:
The system extracts only the necessary usage metadata from user accounts for analysis purposes, leaving the actual user content untouched. Specifically, it collects information such as account creation date, IP addresses, device identifiers, upload patterns, and access frequencies - but does not scan or access the actual files or content stored by users. This extraction approach enables fraud detection through behavioral analysis while maintaining user privacy by never exposing or processing the user's actual content.
Solution Approach 2:
The system introduces an intermediary layer of usage data analysis that mediates between content moderation goals and user privacy protection. Instead of directly scanning user content, the system uses usage patterns and metadata as an intermediary indicator of potential fraudulent behavior. This intermediary approach allows the system to infer the presence of prohibited content through behavioral signatures (such as rapid account creation followed by immediate bulk uploads) without ever needing to actually view or process the user's private content.
3Reliability
If the service provider collects detailed usage data to build fraud detection models, then detection capability improves, but data storage and processing complexity increases
Solution Approach 1:
The system segments the fraud detection process into distinct functional modules: data collection, data processing, pattern recognition, and decision-making. Each module handles specific aspects of the detection workflow independently. The usage data is segmented into different categories (account metadata, upload patterns, access patterns, device information) and processed through specialized algorithms designed for each type. This segmentation reduces overall system complexity by breaking down the complex task of fraud detection into manageable, independent components that can be developed and maintained separately.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Techniques for detecting fraudulent account usage without accessing user content associated with user accounts are disclosed herein. In one embodiment, a method includes receiving a report indicating fraudulent account usage related to an account of the computing service and in response to the received report, disallowing access to any content items associated with the account without disabling access to the account. While access to the content items is disallowed, collecting usage data related to the account or the content items and developing a model representing an activity profile of accessing the account or the content items. The method further includes detecting additional fraudulent account usage based on the developed model without scanning content items in the additional accounts.