Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting suspicious accounts. One of the methods includes identifying one or more potential clusters of malicious accounts; for each cluster, processing a collection of content associated with each account of the cluster, the processing comprising applying a plurality of models in series to determine whether the collection of content indicates a common pattern; and based on the respective determinations, classifying the accounts of each cluster as ordinary or suspicious.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting suspicious accounts. One of the methods includes identifying one or more potential clusters of malicious accounts; for each cluster, processing a collection of content associated with each account of the cluster, the processing comprising applying a plurality of models in series to determine whether the collection of content indicates a common pattern; and based on the respective determinations, classifying the accounts of each cluster as ordinary or suspicious.