Web Service Fraud Detection via Request Partitioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for securing web services are inadequate in detecting fake account creations, which are often the initial step in large-scale fraudulent activities, as they rely on historical application fingerprinting and fail to effectively identify anomalies in user request patterns.
Innovation Solution
The method involves partitioning user requests into subsets based on attributes like domain, country, and platform, and determining a risk score based on the evolution of user requests within these subsets, using techniques like Seasonal and Trend decomposition using Loess (STL) and Extreme Studentized Deviate (ESD) to detect anomalies in time series data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If historical application fingerprinting is used to detect fraud, then existing fraud patterns can be identified, but new and evolving fraudulent activities cannot be detected early enough
Solution Approach 1:
The system performs preliminary analysis by partitioning user requests into subsets and establishing baseline request patterns before fraudulent activities fully manifest. By continuously monitoring the evolution of user requests in each subset and comparing against historical data, the system detects anomalies proactively, enabling early intervention before fake accounts are fully utilized for fraud.
Solution Approach 2:
The patent segments the space of user requests into multiple subsets based on various attributes (domain, country, platform, etc.). This segmentation allows the system to analyze request patterns within specific contexts independently, making it more sensitive to localized fraudulent activities while reducing false positives from legitimate traffic variations in different regions or domains.
2Measurement precision
If comprehensive monitoring of all user requests is performed, then fraud detection capability is improved, but system complexity and computational load increase
Solution Approach 1:
By dividing the monitoring task into multiple independent subset analyses, the system reduces the complexity of analyzing all requests simultaneously. Each subset can be processed with simpler algorithms, and the results are aggregated to form the overall fraud risk assessment, making the system more manageable and scalable.
Solution Approach 2:
The system applies different monitoring strategies and risk thresholds to different subsets based on their specific characteristics (e.g., high-risk countries vs. low-risk countries, specific domains vs. general domains). This localized approach optimizes detection precision for each context while avoiding unnecessary computational overhead in low-risk areas.
3Speed
If risk scoring is performed for every user request, then real-time fraud detection is achieved, but processing time and computational resources increase
Solution Approach 1:
The system performs full risk scoring analysis only for requests that exhibit anomalous patterns or fall into high-risk subsets. For normal requests that conform to established patterns, the system uses simplified validation, reducing computational overhead while maintaining detection effectiveness for suspicious activities.
Solution Approach 2:
By pre-establishing baseline patterns and partitioning rules, the system avoids performing complex analysis for every request. The preliminary partitioning and pattern matching enable quick filtering, with intensive risk scoring reserved only for edge cases that require detailed evaluation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method comprising partitioning a space of user requests into subsets, and determining a risk score for a user request based on the evolution of the number of user requests in the subset of user requests to which this user request belongs.