System and methods for digital account threat detection

A method of identifying malicious appropriation and/or malicious access of an online account, the method comprising:

• implementing an application programming interface that is in operable communication with a remote digital threat mitigation service and that is configured to generate an API request to the remote digital threat mitigation service for an account takeover (ATO) risk score for an activity session involving the online account;
• at a remote digital threat mitigation service implemented by one or more computing servers that receive, via a communication network, the API request for the ATO risk score:
• collecting digital event data associated with the online account;
• implementing ATO feature extractors for a machine learning classifier that is trained to classify a plurality of disparate ATO features from the collected digital event data and extract ATO features that signal a positive likelihood of an existence of malicious activity in the activity session involving the online account;
• and
• implementing an ATO classifier that evaluates a plurality of distinct ATO heuristics based on inputs of the ATO features extracted from the collected digital event data and classifies which of the plurality of distinct ATO heuristics is triggered by the ATO features, wherein evaluating the plurality of distinct ATO heuristics includes mapping each of the ATO features to one or more distinct ATO heuristics of the plurality of distinct ATO heuristics;
• identifying the one or more distinct ATO heuristics of the plurality of distinct ATO heuristics with a mapping to at least one of the ATO features;
• identifying one or more distinct ATO risk levels based on a mapping of each of the identified one or more distinct ATO heuristics to each of a plurality of distinct ATO risk levels;
• computing the ATO risk score for the activity session involving the online account based on the identified one or more distinct ATO risk levels, wherein the ATO risk score indicates a likelihood that the activity session involving the online account is a result of malicious appropriation or malicious access of the online account;
• and
• returning, via the API, the ATO risk score thereby enabling an online service provider associated with the online account to perform one or more of automatically requesting user verification, approving, holding, and cancelling an activity or an online transaction associated with the activity session if the ATO risk score satisfies an ATO threat threshold.

A non-transitory computer program product storing computer-executable instructions, that when executed by one or more computer processors, performs the steps of:

• collecting digital event data associated with the online account;
• implementing ATO feature extractors for a machine learning classifier that is trained to classify a plurality of disparate ATO features from the collected digital event data and extract ATO features that signal a positive likelihood of an existence of malicious activity in the activity session involving the online account;
• and
• implementing an ATO classifier that evaluates a plurality of distinct ATO heuristics based on inputs of the ATO features extracted from the collected digital event data and classifies which of the plurality of distinct ATO heuristics is triggered by the ATO features, wherein evaluating the plurality of distinct ATO heuristics includes mapping each of the ATO features to one or more distinct ATO heuristics of the plurality of distinct ATO heuristics;
• identifying the one or more distinct ATO heuristics of the plurality of distinct ATO heuristics with a mapping to at least one of the ATO features;
• identifying one or more distinct ATO risk levels based on a mapping of each of the identified one or more distinct ATO heuristics to each of a plurality of distinct ATO risk levels;
• computing the ATO risk score for the activity session involving the online account based on the identified one or more distinct ATO risk levels, wherein the ATO risk score indicates a likelihood that the activity session involving the online account is a result of malicious appropriation or malicious access of the online account;
• and
• returning, via an application programming interface, the ATO risk score thereby enabling an online service provider associated with the online account to perform one or more of automatically requesting user verification, approving, holding, and cancelling an activity or an online transaction associated with the activity session if the ATO risk score satisfies an ATO threat threshold.