Systems and methods for identifying illegitimate activities based on graph-based distance metrics

Abstract

Systems, methods, and non-transitory computer-readable media can generate a node graph comprising a plurality of user account nodes and a plurality of edge nodes connecting the plurality of user account nodes. A distance score is calculated for each user account node of the plurality of user account nodes. It is determined that a transaction is an illegitimate transaction based on the distance scores.

What is claimed is: 
     
         1 . A computer-implemented method comprising:
 generating, by a computing system, a graph comprising a plurality of user account nodes, a plurality of edge nodes, and a plurality of connections connecting the plurality of user account nodes to the plurality of edge nodes, wherein a first edge node of the plurality of edge nodes represents a shared characteristic between at least two user account nodes of the plurality of user account nodes and each node of the at least two user account nodes is connected to the first edge node representing the shared characteristic;   calculating, by the computing system, a first distance score for a first user account node of the plurality of user account nodes, wherein the first distance score represents a minimum distance from the first user account node to a nearest illegitimate node; and   determining, by the computing system, that a transaction associated with the first user account node is an illegitimate transaction based on the first distance score.   
     
     
         2 . The computer-implemented method of  claim 1 , further comprising:
 calculating, by the computing system, a second distance score for a second user account node of the plurality of user account nodes, wherein the second distance score represents a minimum distance from the second user account node to the nearest illegitimate node, wherein the second distance score is greater than the first distance score; and   determining, by the computing system, that the first user account node is less trustworthy than the second user account node.   
     
     
         3 . The computer-implemented method of  claim 1 , wherein the first distance score is calculated based on an iterative algorithm that terminates after a maximum number of iterations and assigns a distance score cap value to the first user account node after the maximum number of iterations. 
     
     
         4 . The computer-implemented method of  claim 1 , further comprising:
 generating, by the computing system, a plurality of node graphs, each node graph of the plurality of node graphs comprising the plurality of user account nodes, the plurality of edge nodes, and the plurality of connections connecting the plurality of user account nodes to the plurality of edge nodes,   wherein edge nodes of each node graph of the plurality of node graphs are associated with a particular edge characteristic between at least two user account nodes of the node graph, and   wherein the calculating a first distance score for the first user account node of the plurality of user account nodes comprises calculating a plurality of distance scores for the first user account node of the plurality of user account nodes, each distance score of the plurality of distance scores being calculated based on a respective one of the plurality of node graphs, wherein the first distance score for the first user account node is calculated based on the plurality of distance scores.   
     
     
         5 . The computer-implemented method of  claim 4 , further comprising:
 determining, by the computing system, a probability of illegitimate activity using one or more machine learning models based on the plurality of distance scores.   
     
     
         6 . The computer-implemented method of  claim 1 , wherein the nearest illegitimate node is a user account node of the plurality of user account nodes. 
     
     
         7 . The computer-implemented method of  claim 6 , wherein the first user account node is labeled as an illegitimate node based on the first distance score. 
     
     
         8 . The computer-implemented method of  claim 1 , wherein the nearest illegitimate node is an edge node of the plurality of edge nodes. 
     
     
         9 . The computer-implemented method of  claim 8 , wherein the edge node is labeled as an illegitimate node. 
     
     
         10 . The computer-implemented method of  claim 1 , wherein the shared characteristic comprises at least one of: IP address, advertisement landing page ID, computing device identification information, or payment information. 
     
     
         11 . A system comprising:
 at least one processor; and   a memory storing instructions that, when executed by the at least one processor, cause the system to perform a method comprising:   generating a graph comprising a plurality of user account nodes, a plurality of edge nodes, and a plurality of connections connecting the plurality of user account nodes to the plurality of edge nodes, wherein a first edge node of the plurality of edge nodes represents a shared characteristic between at least two user account nodes of the plurality of user account nodes and each node of the at least two user account nodes is connected to the first edge node representing the shared characteristic;   calculating a first distance score for a first user account node of the plurality of user account nodes, wherein the first distance score represents a minimum distance from the first user account node to a nearest illegitimate node; and   determining that a transaction associated with the first user account node is an illegitimate transaction based on the first distance score.   
     
     
         12 . The system of  claim 11 , wherein the instructions further cause the system to perform:
 calculating a second distance score for a second user account node of the plurality of user account nodes, wherein the second distance score represents a minimum distance from the second user account node to the nearest illegitimate node, wherein the second distance score is greater than the first distance score; and   determining that the first user account node is less trustworthy than the second user account node.   
     
     
         13 . The system of  claim 11 , wherein the first distance score is calculated based on an iterative algorithm that terminates after a maximum number of iterations and assigns a distance score cap value to the first user account node after the maximum number of iterations. 
     
     
         14 . The system of  claim 11 , wherein the instructions further cause the system to perform:
 generating a plurality of node graphs, each node graph of the plurality of node graphs comprising the plurality of user account nodes, the plurality of edge nodes, and the plurality of connections connecting the plurality of user account nodes to the plurality of edge nodes,   wherein edge nodes of each node graph of the plurality of node graphs are associated with a particular edge characteristic between at least two user account nodes of the node graph, and   wherein the calculating a first distance score for the first user account node of the plurality of user account nodes comprises calculating a plurality of distance scores for the first user account node of the plurality of user account nodes, each distance score of the plurality of distance scores being calculated based on a respective one of the plurality of node graphs, wherein the first distance score for the first user account node is calculated based on the plurality of distance scores.   
     
     
         15 . The system of  claim 14 , wherein the instructions further cause the system to perform:
 determining a probability of illegitimate activity using one or more machine learning models based on the plurality of distance scores.   
     
     
         16 . A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a computing system, cause the computing system to perform a method comprising:
 generating a graph comprising a plurality of user account nodes, a plurality of edge nodes, and a plurality of connections connecting the plurality of user account nodes to the plurality of edge nodes, wherein a first edge node of the plurality of edge nodes represents a shared characteristic between at least two user account nodes of the plurality of user account nodes and each node of the at least two user account nodes is connected to the first edge node representing the shared characteristic;   calculating a first distance score for a first user account node of the plurality of user account nodes, wherein the first distance score represents a minimum distance from the first user account node to a nearest illegitimate node; and   determining that a transaction associated with the first user account node is an illegitimate transaction based on the first distance score.   
     
     
         17 . The non-transitory computer-readable storage medium of  claim 16 , wherein the instructions further cause the computing system to perform:
 calculating a second distance score for a second user account node of the plurality of user account nodes, wherein the second distance score represents a minimum distance from the second user account node to the nearest illegitimate node, wherein the second distance score is greater than the first distance score; and   determining that the first user account node is less trustworthy than the second user account node.   
     
     
         18 . The non-transitory computer-readable storage medium of  claim 16 , wherein the first distance score is calculated based on an iterative algorithm that terminates after a maximum number of iterations and assigns a distance score cap value to the first user account node after the maximum number of iterations. 
     
     
         19 . The non-transitory computer-readable storage medium of  claim 16 , wherein the instructions further cause the computing system to perform:
 generating a plurality of node graphs, each node graph of the plurality of node graphs comprising the plurality of user account nodes, the plurality of edge nodes, and the plurality of connections connecting the plurality of user account nodes to the plurality of edge nodes,   wherein edge nodes of each node graph of the plurality of node graphs are associated with a particular edge characteristic between at least two user account nodes of the node graph, and   wherein the calculating a first distance score for the first user account node of the plurality of user account nodes comprises calculating a plurality of distance scores for the first user account node of the plurality of user account nodes, each distance score of the plurality of distance scores being calculated based on a respective one of the plurality of node graphs, wherein the first distance score for the first user account node is calculated based on the plurality of distance scores.   
     
     
         20 . The non-transitory computer-readable storage medium of  claim 19 , wherein the instructions further cause the computing system to perform:
 determining a probability of illegitimate activity using one or more machine learning models based on the plurality of distance scores.