Classification scheme for detecting illegitimate account creation

Patent metadata

Field	Value
Publication number	US-2022360596-A1
Application number	US-202117321847-A
Country	US
Kind code	A1
Filing date	May 17, 2021
Priority date	May 5, 2021
Publication date	Nov 10, 2022
Grant date	—

Abstract

A system and method that detects malicious account creation in a web-based platform. A method includes detecting suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an IP address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account; analyzing each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collections of account creation processes; and determining an alert condition based on at least one malicious event detection.

First claim

We claim:

1 . A system, comprising:
a memory; and a processor coupled to the memory and configured to execute instructions that detect a malicious account in a web-based platform, wherein the instructions cause the processor to:
detect suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an internet protocol (IP) address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account;
analyze each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collection of account creation processes; and
determine an alert condition based on at least one malicious event detection.

2 . The system of claim 1 , wherein the username classifier is trained with a first dataset of legitimate usernames and a second dataset of illegitimate usernames, and wherein the username classifier:
analyzes the username structure of a new username to predict whether the new username is legitimate or illegitimate; and flags an illegitimate username as a suspicious event.

3 . The system of claim 2 , wherein the username classifier is trained using N-grams in combination with a Naïve Bayes classifier.

4 . The system of claim 1 , wherein the username classifier is trained to predict whether the username comprises a suspicious event based on a number of characters in the username.

5 . The system of claim 1 , wherein the IP address classifier is trained by evaluating IP addresses used to create prior accounts in order to determine a threshold, and wherein IP address classifier:
obtains the IP address used for the new account; determines a number of accounts created with the IP address during a predefined time period; and generates a suspicious event if the number of accounts exceeds the threshold.

6 . The system of claim 1 , wherein the domain classifier is trained by evaluating domains used to create prior accounts in order to determine a threshold, and wherein domain classifier:
obtains the domain used for the new account; determines a number of accounts created with the domain during a predefined time period; and generates a suspicious event if the number of accounts exceeds the threshold.

7 . The system of claim 1 , wherein the density analysis classifier:
evaluates a detected suspicious event relative to an associated time series of events within an associated time window in which the events are generated by at least one of the username classifier, IP address classifier and domain classifier; and classifies the detected suspicious event as a malicious event if a threshold number of events were flagged as suspicious events within the associated time window.

8 . The system of claim 1 , wherein each of the username classifier, IP address classifier, domain classifier and density analysis classifier are tuned to produce an overall target specificity that dictates a precision as a function of recall, wherein the precision is a ratio of correctly detected malicious events relative to a total number of detected events and recall is a probability that a malicious event will be detected.

9 . The system of claim 8 , wherein the overall target specificity is determined based on a historical prevalence of correctly detected malicious events.

10 . The system of claim 8 , wherein the overall target specificity is determined based on an assumption about a prevalence of malicious events in the web-based platform.

11 . A computerized method, comprising:
detecting suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an internet protocol (IP) address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account; analyzing each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collection of account creation processes; and determining an alert condition based on at least one malicious event detection.

12 . The method of claim 11 , wherein the username classifier is trained with a first dataset of legitimate usernames and a second dataset of illegitimate usernames, and wherein the username classifier:
analyzes the username structure of a new username to predict whether the new username is legitimate or illegitimate; and flags an illegitimate username as a suspicious event.

13 . The method of claim 12 , wherein the username classifier is trained using N-grams in combination with a Naïve Bayes classifier.

14 . The method of claim 11 , wherein the username classifier is trained to predict whether the username comprises a suspicious event based on a number of characters in the username.

15 . The method of claim 11 , wherein the IP address classifier is trained by evaluating IP addresses used to create prior accounts in order to determine a threshold, and wherein IP address classifier:
obtains the IP address used for the new account; determines a number of accounts created with the IP address during a predefined time period; and generates a suspicious event if the number of accounts exceeds the threshold.

16 . The method of claim 11 , wherein the domain classifier is trained by evaluating domains used to create prior accounts in order to determine a threshold, and wherein domain classifier:
obtains the domain used for the new account; determines a number of accounts created with the domain during a predefined time period; and generates a suspicious event if the number of accounts exceeds the threshold.

17 . The method of claim 1 , wherein the density analysis classifier:
evaluates a detected suspicious event relative to an associated time series of events within an associated time window in which the events are generated by at least one of the username classifier, IP address classifier and domain classifier; and classifies the detected suspicious event as a malicious event if a threshold number of events were flagged as suspicious events within the associated time window.

18 . The method of claim 1 , wherein each of the username classifier, IP address classifier, domain classifier and density analysis classifier are tuned to produce an overall target specificity that dictates a precision as a function of recall, wherein the precision is a ratio of correctly detected malicious events relative to a total number of detected events and recall is a probability that a malicious event will be detected.

19 . The method of claim 18 , wherein the overall target specificity is determined based on a historical prevalence of correctly detected malicious events.

20 . The method of claim 18 , wherein the overall target specificity is determined based on an assumption about a prevalence of malicious events in the web-based platform.

Assignees

• Citrix Systems Inc

Inventors

• Varnavas Andreas
• Sai Teja Chowdary Ananthaneni
• Tsapakis Nikolaos
• Sj Premkumar
• Muthiah Manikam

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• H04W12/12

  Detection or prevention of fraud · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title