Microsoft Technology Licensing, LLC

James R Verbus

Beibei Wang

Ting Chen

Yi Wu

Jason Paul Chang

Mariem Boujelbene

Elham Shaabani

Embodiments of the disclosed technologies create a term frequency-inverse document frequency (tf-idf) model of interactions of user accounts with an online system, and, using the tf-idf model, identify a subset of the user accounts as being involved in a malicious use of the online system. The tf-idf model is created by, for a user account, storing a sequence of requests received by the online system from the user account over a time interval as a document, where a request includes a digital communication from the user account to the online system, and generating a feature embedding for the sequence of requests, where the feature embedding is based on a relationship between a frequency of occurrence of a request in the document and a number of documents that include the request.

Identifying coordinated malicious activities using sequences of requests

In an example embodiment, a deep learning algorithm is introduced that operates on a transition matrix formed from user activities in an online network. The transition matrix records the frequencies that particular transitions between paths of user activity have occurred (e.g., the user performed a login activity, which has one path in the network, and then performed a profile view action, which has another path in the network). Each transition matrix corresponds to a different user's activities.

Deep learning using activity graph to detect abusive user activity in online networks

In an example embodiment, a deep learning algorithm is introduced that operates directly on a raw sequence of user activity in an online network. This allows the system to scalably leverage more of the available signal hidden in the data and stop adversarial attacks more efficiently than other machine-learned models. More particularly, each specific request path is translated into a standardized token that indicates the type of the request (e.g., profile view, search, login, etc.). This eliminates the need for human curation of features. Then, the standardized request paths are standardized to integers based on the frequency of that request path across all users. This allows information about how common a given type of request is to be provided to the machine-learned model. The integer array is the activity sequence that is fed into the deep learning algorithm.

Growing community of inventors

San Mateo, CA, United States of America

James R Verbus