Apparatus, method and article to facilitate automatic detection and removal of fraudulent user information in a network environment
First Claim
1. A method of operation in at least a portion of a system to detect at least one of accounts or related profiles suspected of being fraudulent, the system which includes at least one processor and at least one nontransitory processor-readable medium that stores at least one of processor-executable instructions or processor-executable data, the at least one nontransitory processor-readable medium communicatively coupled to the at least one processor, the method of operation comprising:
- for each of a plurality of profiles, computing by the at least one processor a representation of dissimilarity based at least in part on a respective attribute value of each of a plurality of attributes logically associated with the respective profile;
performing a clustering of the profiles by the at least one processor, based on the representation of dissimilarity, the performance of the clustering resulting in a number of clusters, each cluster comprising one or more of the profiles;
selecting clusters of the profiles from the resulting clusters of the profiles, where the selecting is based on whether the respective cluster includes a total number of profiles in the respective cluster that exceeds a threshold number of profiles;
in a first pass, following the selecting clusters of the profiles which include a total number of profiles in the respective cluster that is above the threshold number of profiles,for each of at least some of the selected clusters, identifying by the at least one processor each of a number of attributes and attribute value combinations that occur frequently in the profiles of the respective selected cluster;
in a second pass, following the first pass,for each of at least some of the selected clusters and for each attribute identified as occurring frequently in the first pass, identifying by the at least one processor one or more additional attribute values for the respective attribute that occur frequently in the profiles of the respective selected cluster; and
for each of at least some of the selected clusters, preparing a respective query to identify the accounts or the related profiles suspected of being fraudulent based at least in part on the processor identified attribute and attribute value combinations and the processor identified one or more additional attribute values.
0 Assignments
0 Petitions
Accused Products
Abstract
A fraud detection system may obtain a number of known fraudulent end-user profiles and/or otherwise undesirable end-user profiles. Using statistical analysis techniques that include clustering the end-user profiles by attributes and attribute values and/or combinations of attributes and attribute values, the fraud detection system identifies on a continuous, periodic, or aperiodic basis those attribute values and/or attribute value combinations that appear in fraudulent or otherwise undesirable end-user profiles. Using this data, the fraud detection system generates one or more queries to identify those end-user profiles having attribute values or combinations of attribute values that likely indicate a fraudulent or otherwise undesirable end-user profile. The fraud detection system can run these queries against incoming registrations to identify and screen fraudulent end-user profiles from entering the system and can also run these queries against stored end-user profile databases to identify and remove fraudulent or otherwise undesirable end-user profiles from the end-user database.
-
Citations
45 Claims
-
1. A method of operation in at least a portion of a system to detect at least one of accounts or related profiles suspected of being fraudulent, the system which includes at least one processor and at least one nontransitory processor-readable medium that stores at least one of processor-executable instructions or processor-executable data, the at least one nontransitory processor-readable medium communicatively coupled to the at least one processor, the method of operation comprising:
-
for each of a plurality of profiles, computing by the at least one processor a representation of dissimilarity based at least in part on a respective attribute value of each of a plurality of attributes logically associated with the respective profile; performing a clustering of the profiles by the at least one processor, based on the representation of dissimilarity, the performance of the clustering resulting in a number of clusters, each cluster comprising one or more of the profiles; selecting clusters of the profiles from the resulting clusters of the profiles, where the selecting is based on whether the respective cluster includes a total number of profiles in the respective cluster that exceeds a threshold number of profiles; in a first pass, following the selecting clusters of the profiles which include a total number of profiles in the respective cluster that is above the threshold number of profiles, for each of at least some of the selected clusters, identifying by the at least one processor each of a number of attributes and attribute value combinations that occur frequently in the profiles of the respective selected cluster; in a second pass, following the first pass, for each of at least some of the selected clusters and for each attribute identified as occurring frequently in the first pass, identifying by the at least one processor one or more additional attribute values for the respective attribute that occur frequently in the profiles of the respective selected cluster; and for each of at least some of the selected clusters, preparing a respective query to identify the accounts or the related profiles suspected of being fraudulent based at least in part on the processor identified attribute and attribute value combinations and the processor identified one or more additional attribute values. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23)
-
-
24. A system to detect at least one of accounts or related profiles suspected of being fraudulent, the system comprising:
-
at least one processor; and at least one nontransitory processor-readable medium that stores at least one of processor-executable instructions or processor-executable data, the at least one nontransitory processor-readable medium communicatively coupled to the at least one processor, wherein the at least one processor; for each of a plurality of profiles, computes a representation of dissimilarity based at least in part on a respective attribute value of each of a plurality of attributes logically associated with the respective profile; performs a clustering of the profiles based on the representation of dissimilarity, which results in a number of clusters, each cluster comprising one or more of the profiles; selects clusters of the profiles from the resulting clusters of the profiles, which selected clusters include a total number of profiles in the respective cluster, where that total number of profiles in the respective cluster is above a threshold number of profiles; in a first pass, that follows the selection of clusters of the profiles above the threshold, for each of at least some of the selected clusters, identifies each of a number of attributes and attribute value combinations that occur frequently in the profiles of the respective selected cluster; in a second pass, that follows the first pass, for each of at least some of the selected clusters and for each attribute identified as occurring frequently in the first pass, identifies one or more additional attribute values for the respective attribute that occur frequently in the profiles of the respective selected cluster; and for each of at least some of the selected clusters, prepares a respective query to identify the accounts or the related profiles suspected of being fraudulently generated based at least in part on the processor identified attribute and attribute value combinations and the one or more processor identified additional attribute values. - View Dependent Claims (25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45)
-
Specification