31% of anomalous accounts are tagged as content fraud, 47% as service fraud, and 21% as account fraud. These anomalous accounts have been true with the heuristics described previously. Over 30 days 1,030,005 benign accounts are gathered and 28,045 are anomalous. With the heuristics defined, the dataset created contains three main subsets of labels: rapid license acquisition, too many failed attempts at streaming, and unusual combinations of device type and DRM. The fraud categories considered in the development of this framework are content fraud, service fraud, and account fraud.
At the label stage, the Synthetic Minority Over-sampling Technique (SMOTE) is used to avoid the problems tied to label imbalanced datasets. So a set of rule-based heuristics are defined, based on the experience of security experts, to identify anomaly behaviors of clients and label them to create a dataset. Data labeling is an important stage for the model development process but there were no already labeled datasets to train the models for this specific domain. The fraud framework developed is based on semi-supervised models and supervised models. These models highly rely on the availability of context specific data (and labeled). This approach is more scalable and implementable for real-time analysis. On the other hand, model-based anomaly detection is based on the development of models built and used to detect abnormal behaviors in some automatic way. The deployment and use of these anomaly detection methods could be expensive and time consuming at scale, and is not implementable for real-time analysis. Domain experts define the anomaly and define a set of rules to discover these incidents. Rule-based use a set of rules specified by the domain experts. There are two kinds of anomaly detection approaches: rule-based and model-based. The attack surface for these kinds of services could be very wide, this is why a machine-learning approach could be useful to help secure these services. Streaming services have, potentially, a lot of onboarded users on multiple devices.
Netflix has developed a fraud and abuse detection framework for streaming services, based on artificial intelligence models and data-driven anomaly detections trained on the behavior of the users.
0 kommentar(er)
