Fraud score heuristic for identifying fradulent requests or sets of requests
AssigneeAmazon Technologies, Inc.
InventorNicholas Alexander Allen
Life of this patent
Estimating the term…
Abstract
The disclosure relates to training a fraud heuristic and using the fraud heuristic to identify fraudulent requests. One example includes a system that receives a set of requests from known malicious users and updates a fraud score heuristic based these known malicious requests. The system then receives one or more uncategorized request and categorizes the one or more uncategorized request as being fraudulent or non-fraudulent using the updated fraud score heuristic.
Claims20
A computer-implemented method, comprising:
- obtaining a first plurality of requests associated with computing resources;
- associating each of the plurality of requests with a respective credential type, at least a portion of the plurality of requests being associated with a honeypot credential type;
- extracting, from the at least a portion of the plurality of requests associated with the honeypot credential type, a set of honeypot request characteristics;
- updating a fraud score heuristic based on at least a portion of the extracted set of honeypot request characteristics from the at least a portion of the plurality of requests associated with the honeypot credential type;
- obtaining a second request associated with the computing resources;
- extracting, from the second request, a set of request characteristics corresponding to the second request;
- using the updated fraud score heuristic to calculate a fraud score corresponding to the second request based at least on a portion of the set of request characteristics corresponding to the second request;
- and
- providing a lower performance set of computing resources to handle the second request, wherein, providing the lower performance set of computing resources is dependent at least in part on a classification corresponding to the second request made using the fraud score to provide degraded performance.
A system, comprising:
- memory to store instructions that, if executed by one or more processors of the system, cause the system to:
- extract, from a first request associated with honeypot credentials, a first set of honeypot request characteristics corresponding to the first request;
- update a fraud score heuristic based on at least a portion of the extracted first set of honeypot request characteristics from the first request associated with honeypot credentials;
- extract, from one or more second requests, a second set of request characteristics corresponding to the one or more second requests;
- calculate a fraud score using the updated fraud score heuristic, the calculating based at least on a portion of the second set of request characteristics corresponding to the one or more second requests;
- and
- allocate a lower performance set of computing resources to handle the one or more second requests, wherein, allocating the lower performance set of computing resources is dependent at least in part on a classification of the one or more second requests made using the fraud score to provide degraded performance.
A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
- extract, from a request associated with honeypot credentials, a first set of honeypot request characteristics corresponding to the request;
- update a fraud score heuristic based on at least a portion of the extracted set of honeypot request characteristics extracted from the request associated with honeypot credentials;
- provide the updated fraud score heuristic to classify one or more second requests as being fraudulent by comparing a fraud score of the one or more second requests to the updated fraud score heuristic;
- and
- allocate a lower performance set of computing resources to handle the one or more second requests wherein, allocating the lower performance set of computing resources is dependent at least in part on a classification of the one or more second requests made using the fraud score to provide degraded performance.
Dependencies are inferred from the claim text.