Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting suspicious accounts. One of the methods includes identifying one or more potential clusters of malicious accounts; for each cluster, processing a collection of content associated with each account of the cluster, the processing comprising applying a plurality of models in series to determine whether the collection of content indicates a common pattern; and based on the respective determinations, classifying the accounts of each cluster as ordinary or suspicious.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting fraudulent accounts. One of the methods includes obtaining raw data from network events associated with a collection of user accounts of an online service; processing the raw data including determining a feature set and applying the feature set to generate user groups each comprising one or more user account; evaluating each user group based on feature distributions including performing one or more Major-Key-Shared (MKS) correlation calculations on pairs of features from the feature set for the group; scoring each group based on the evaluation; and identifying groups having a score that exceeds a specified threshold as fraudulent.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for fraud detection. One of the methods includes partitioning a feature space into a plurality of sub feature spaces, wherein the feature space comprises features associated with user account events for an online service; generating one or more clusters of users for each of one or more sub feature spaces; comparing a feature profile of one or more of the clusters with a global feature profile to determine features of one or more the clusters that have concentrated key values that exceed a respective threshold value; for each of the one or more clusters, scoring the cluster including aggregating the degree to which the key values for features exceed the corresponding threshold values; and based on the scores of the one or more clusters, determining one or more fraud detection actions.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting suspicious accounts. One of the methods includes identifying one or more potential clusters of malicious accounts; for each cluster, processing a collection of content associated with each account of the cluster, the processing comprising applying a plurality of models in series to determine whether the collection of content indicates a common pattern; and based on the respective determinations, classifying the accounts of each cluster as ordinary or suspicious.