Detection of anomalous instances through dynamic feature selection analysis

Abstract

This specification describes technologies relating to detecting anomalous user accounts. A computer implemented method is disclosed which evaluates an unknown status user account. The method described compares features associated with a plurality of known anomalous user accounts stored in a database to features present in the unknown account. A correlation value corresponding to the probability of a specific feature occurring in a particular anomalous user account is calculated and a dependence value corresponding to the degree of dependence between the given feature and at least one other feature is also calculated. A subset of features in the unknown account is generated comprising those features that possess a correlation value less than a threshold value and a dependence value below a maximum correlation value. A risk score for the unknown account is calculated by selecting those features from the subset that maximizes the correlation value. The unknown account is then reviewed by an account reviewer if the risk score exceeds a threshold value.