Apparatus, method and article to facilitate automatic detection and removal of fraudulent user information in a network environment

• US 9,870,465 B1
• Filed: 12/04/2014
• Issued: 01/16/2018
• Est. Priority Date: 12/04/2013
• Status: Active Grant

• Current Assignee: Plentyoffish Media ULC (Match Group, Inc.)
• Original Assignee: Plentyoffish Media ULC (Match Group, Inc.)
• Inventors: Levi, Thomas, Oldridge, Steve
• Primary Examiner(s): Casanova, Jorge A
• Application Number:
  US14/561,004
• Time in Patent Office: 1,139 Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 67/306 User profiles

Abstract

A fraud detection system may obtain a number of known fraudulent end-user profiles and/or otherwise undesirable end-user profiles. Using statistical analysis techniques that include clustering the end-user profiles by attributes and attribute values and/or combinations of attributes and attribute values, the fraud detection system identifies on a continuous, periodic, or aperiodic basis those attribute values and/or attribute value combinations that appear in fraudulent or otherwise undesirable end-user profiles. Using this data, the fraud detection system generates one or more queries to identify those end-user profiles having attribute values or combinations of attribute values that likely indicate a fraudulent or otherwise undesirable end-user profile. The fraud detection system can run these queries against incoming registrations to identify and screen fraudulent end-user profiles from entering the system and can also run these queries against stored end-user profile databases to identify and remove fraudulent or otherwise undesirable end-user profiles from the end-user database.

Claims

1. A method of operation in at least a portion of a system to detect at least one of accounts or related profiles suspected of being fraudulent, the system which includes at least one processor and at least one nontransitory processor-readable medium that stores at least one of processor-executable instructions or processor-executable data, the at least one nontransitory processor-readable medium communicatively coupled to the at least one processor, the method of operation comprising:

for each of a plurality of profiles, computing by the at least one processor a representation of dissimilarity based at least in part on a respective attribute value of each of a plurality of attributes logically associated with the respective profile, wherein computing a representation of dissimilarity includes, for each of the profiles computing a dissimilarity matrix based on the respective values of each of the number of attributes logically associated with the profile;

performing a clustering of the profiles by the at least one processor, based on the representation of dissimilarity, the performance of the clustering resulting in a number of clusters, each cluster comprising one or more of the profiles, wherein performing a clustering of the profiles includes performing a clustering based on the dissimilarity matrices of the respective profiles and the performance of the clustering results in a dendrogram with a top-most node representing all of the plurality of profiles and the bottom-most nodes representing respective individual ones of the profiles, a plurality of intermediate nodes between the top-most and the bottom-most nodes representing respective sets of profiles where the profiles in any set of profiles are similar to one another to a degree;

selecting clusters of the profiles above a threshold, wherein selecting clusters of profiles above a threshold includes selecting clusters below a cut line in the dendrogram;

in a first pass,

for each of at least some of the selected clusters, identifying by the at least one processor each of a number of attributes and attribute value combinations that occur frequently in the profiles of the respective cluster;

in a second pass,

for each of at least some of the selected clusters and for each attribute identified as occurring frequently in the first pass, identifying by the at least one processor one or more additional attribute values for the respective attribute that occur frequently in the profiles of the respective cluster; and

for each of at least some of the selected clusters, preparing a respective query to identify the accounts or the related profiles suspected of being fraudulent based at least in part on the processor identified attribute and attribute value combinations and the processor identified one or more additional attribute values.

2. The method of claim 1 wherein computing a dissimilarity matrix includes computing the dissimilarity matrix via at least one of Manhattan distances, Euclidean distances or Gower coefficients.

3. The method of claim 1 wherein computing a dissimilarity matrix includes computing the dissimilarity matrix based on at least one of:

an identity of an Internet Service Provider (ISP) associated with the creation of the respective profile;

an identity of an operating system used during a most recent login associated with the respective profile;

a login associated with the respective profile;

an identified gender associated with the respective profile;

a cookie associated with the respective profile;

an electronic mail (email) domain associated with the respective profile;

a signup IP domain associated with the respective profile;

one or more profile details associated with the respective profile;

an IP country associated with the respective profile;

or

a time to create the respective profile.

4. The method of claim 1 wherein performing a clustering of the profiles includes performing an agglomerative clustering of the profiles based on the representation of dissimilarity.

5. The method of claim 1 wherein performing a clustering of the profiles includes forming combinations of profiles that minimize an average of dissimilarities between one cluster of profiles and another cluster of profiles.

6. The method of claim 1 wherein selecting clusters of profiles above a threshold includes selecting clusters which include at least a threshold number of profiles.

7. The method of claim 1 wherein performing a clustering of the profiles includes performing an agglomerative nesting clustering of the profiles.

8. The method of claim 7 wherein performing an agglomerative nesting clustering of the profiles includes performing an agglomerative nesting clustering of the profiles using at least one of:

a nearest neighbor method, a furthest neighbor method, a pair group average method, a centroid method, a median method, and Ward'"'"'s method.

9. The method of claim 1 wherein performing a clustering of the profiles includes performing a divisive analysis clustering of the profiles.

10. The method of claim 1 wherein identifying each of a number of attributes and attribute value combinations that occur frequently in the profiles of the respective cluster includes identifying attributes and attribute value combinations that are above a minimum support threshold.

11. The method of claim 10 wherein identifying any additional attribute values for the respective attribute that occur frequently in the profiles of the respective cluster includes identifying any additional attribute values that occur above a combine threshold.

12. The method of claim 1, further comprising:

normalizing the attribute values for at least some of the attributes before performing the clustering of the profiles.

13. The method of claim 1 wherein in the first pass identifying each of a number of attributes and attribute value combinations that occur frequently in the profiles of the respective cluster includes performing association rule learning on each of the at least some of the selected clusters.

14. The method of claim 1 wherein in the first pass identifying each of a number of attributes and attribute value combinations that occur frequently in the profiles of the respective cluster includes conducting a depth-first search for the combinations of attribute and attribute values that form a defined minimum percentage subset of the respective cluster.

15. The method of claim 14 wherein conducting a depth-first search includes executing an association rule learning method on the profiles of the respective cluster that includes at least one of:

an É

clat algorithm, an Apriori algorithm, an FP-growth algorithm, GUHA Procedure ASSOC, or an OPUS search.

16. The method of claim 1 wherein the method includes, in the second pass, for each identified additional value, adding the identified additional value to a set of identified values for the respective attribute.

17. The method of claim 1 wherein preparing a respective query includes defining attribute values for each of a number of the attributes which are indicative of a pattern of fraudulently generated profiles, further comprising:

uploading the queries to a production system, the production system comprising at least one processor that is separate and distinct from the at least one processor of the system.

18. The method of claim 1, further comprising:

identifying a subset of suspicious profiles from a set of profiles; and

providing the subset of suspicious profiles to the at least one processor as the plurality of profiles.

19. The method of claim 18 wherein identifying the subset of suspicious profiles includes applying a semi-naï

ve Bayesian classification against the set of profiles.

20. The method of claim 1, further comprising:

for each of at least some of the selected clusters, preparing a respective second query to identify the accounts or the related profiles suspected of being fraudulent based at least in part on the processor identified attribute and attribute value combinations and the processor identified one or more additional attribute values; and

combining by the at least one processor the query and the second query to generate a third query to identify the accounts or the related profiles suspected of being fraudulent based at least in part on the processor identified attribute and attribute value combinations and the processor identified one or more additional attribute values.

21. A system to detect at least one of accounts or related profiles suspected of being fraudulent, the system comprising:

at least one processor; and

at least one nontransitory processor-readable medium that stores at least one of processor-executable instructions or processor-executable data, the at least one nontransitory processor-readable medium communicatively coupled to the at least one processor, wherein the at least one processor;

for each of a plurality of profiles, computes a representation of dissimilarity based at least in part on a respective attribute value of each of a plurality of attributes logically associated with the respective profile, wherein for each of the profiles, the at least one processor computes a dissimilarity matrix based on the respective values of each of the number of attributes logically associated with the profile in order to compute the representation of dissimilarity;

performs a clustering of the profiles based on the representation of dissimilarity, which results in a number of clusters, each cluster comprising one or more of the profiles wherein the at least one processor performs the clustering based on the dissimilarity matrices of the respective profiles and the performance of the clustering results in a dendrogram with a top-most node representing all of the plurality of profiles and the bottom-most nodes representing respective individual ones of the profiles, a plurality of intermediate nodes between the top-most and the bottom-most nodes representing respective sets of profiles where the profiles in any set of profiles are similar to one another to a degree;

selects clusters of the profiles above a threshold, wherein clusters below a cut line in the dendrogram are selected;

in a first pass,

for each of at least some of the selected clusters, identifies each of a number of attributes and attribute value combinations that occur frequently in the profiles of the respective cluster;

in a second pass,

for each of at least some of the selected clusters and for each attribute identified as occurring frequently in the first pass, identifies one or more additional attribute values for the respective attribute that occur frequently in the profiles of the respective cluster; and

for each of at least some of the selected clusters, prepares a respective query to identify the accounts or the related profiles suspected of being fraudulently generated based at least in part on the processor identified attribute and attribute value combinations and the one or more processor identified additional attribute values.

22. The system of claim 21 wherein the at least one processor computes the dissimilarity matrix via at least one of Manhattan distances, Euclidean distances or Gower coefficients.

23. The system of claim 21 wherein the at least one processor computes the dissimilarity matrix based on at least one of:

an identity of an Internet Service Provider (ISP) associated with the creation of the respective profile;

an identity of an operating system used during a most recent login associated with the respective profile;

a login associated with the respective profile;

an identified gender associated with the respective profile;

a cookie associated with the respective profile;

an electronic mail (email) domain associated with the respective profile;

a signup IP domain associated with the respective profile;

one or more profile details associated with the respective profile;

an IP country associated with the respective profile;

or

a time to create the respective profile.

24. The system of claim 21 wherein the at least one processor forms combinations of profiles that minimize a measure of dissimilarities between one cluster of profiles and another cluster of profiles in order to perform the clustering of the profiles.

25. The system of claim 21 wherein clusters of profiles are selected which include at least a threshold number of profiles.

26. The method of claim 21 wherein the at least one processor performs an agglomerative nesting clustering of the profiles based on the representation of dissimilarity.

27. The method of claim 26 wherein the at least one processor performs an agglomerative nesting clustering of the profiles based on the representation of dissimilarity using at least one of:

a nearest neighbor method, a furthest neighbor method, a pair group average method, a centroid method, a median method, and Ward'"'"'s method.

28. The method of claim 21 wherein the at least one processor performs a divisive analysis clustering of the profiles based on the representation of dissimilarity.

29. The system of claim 21 wherein the at least one processor identifies attributes and attribute value combinations that are above a minimum support threshold in order to identify each of the number of attributes and attribute value combinations that occur frequently in the profiles of the respective cluster.

30. The system of claim 29 wherein the at least one processor identifies any additional attribute values that occur above a combine threshold.

31. The system of claim 21 wherein the at least one processor further:

normalizes the attribute values for at least some of the attributes before the clustering of the profiles.

32. The system of claim 21 wherein the at least one processor performs association rule learning on each of the at least some of the selected clusters, in order to identify each of the number of attributes and attribute value combinations that occur frequently in the profiles of the respective cluster in the first pass.

33. The system of claim 21 wherein the at least one processor conducts a depth-first search for the combinations of attribute and attribute values that form a defined minimum percentage subset of the respective cluster, in order to identify each of the number of attributes and attribute value combinations that occur frequently in the profiles of the respective cluster in the first pass.

34. The system of claim 33 wherein the at least one processor conducts a depth-first search that includes executing an association rule learning method on the profiles of the respective cluster that includes at least one of:

an É

clat algorithm, an Apriori algorithm, an FP-growth algorithm, GUHA Procedure ASSOC, or an OPUS search.

35. The system of claim 21 wherein the at least one processor adds the identified additional value to a set of identified values for the respective attribute, as part of the second pass.

36. The system of claim 21 wherein the at least one processor further:

uploads the queries to a production system, the production system comprising at least one processor that is separate and distinct from the at least one processor of the system.

37. The system of claim 21 wherein the at least one processor further:

receives a subset of suspicious profiles as the plurality of profiles, the subset of suspicious profiles selected from a set of profiles.

38. The system of claim 21 wherein the profiles are profiles of individuals and the attributes values include both self-reported attribute values and non-self-reported attribute values.

39. The system of claim 21 wherein the at least one processor further:

for each of at least some of the selected clusters, prepares a respective second query to identify the accounts or the related profiles suspected of being fraudulently generated based at least in part on the processor identified attribute and attribute value combinations and the processor identified one or more additional attribute values; and

combines the query and the second query to generate a third query to identify the accounts or the related profiles suspected of being fraudulently generated based at least in part on the processor identified attribute and attribute value combinations and the processor identified one or more additional attribute values.