Systems and methods for machine learning-based detection of an automated fraud attack or an automated abuse attack

A method for machine learning-based detection of an automated fraud or abuse attack, the method comprising:

• identifying, via a computer network, a digital event associated with a suspected automated fraud or abuse attack;
• composing, via one or more computers, a digital activity signature of the suspected automated fraud or abuse attack based on digital activity associated with the suspected automated fraud or abuse attack;
• computing, via a machine learning model, an encoded representation of the digital activity signature;
• searching, via the one or more computers, an automated fraud or abuse signature registry based on the encoded representation of the digital activity signature,
• wherein:
• the automated fraud or abuse signature registry includes a plurality of distinct digital fraud or abuse clusters,
• each of the plurality of distinct digital fraud or abuse clusters relates to a distinct type of fraud or abuse, and
• each of the plurality of distinct digital fraud or abuse clusters includes encoded representations of digital activity signatures associated with the distinct type of fraud or abuse;
• wherein the searching includes:
• calculating a distance between the encoded representation of the digital activity signature and a centroid of each of a plurality of distinct digital fraud or abuse clusters;
• and
• identifying digital fraud or abuse clusters whose centroid is within the threshold distance of the encoded representation of the digital activity signature;
• determining a likely origin of the digital event based on the searching of the automated fraud or abuse signature registry;
• and
• selectively implementing one or more automated threat mitigation actions based on the likely origin of the digital event.

A method for machine learning-based detection of an automated fraud or abuse attack, the method comprising:

• identifying, via one or more computers, a digital event associated with a suspected automated fraud or abuse attack;
• deriving a corpus of feature data based on data associated with the digital event;
• composing, via the one or more computers, a digital activity signature of the suspected automated fraud or abuse attack based at least on the corpus of feature data, wherein the digital activity signature comprises a graphical, time-based representation of digital activity associated with the suspected automated fraud or abuse attack;
• computing, via one or more machine learning models, an encoded representation of the digital activity signature based on providing the digital activity signature, as input, to the one or more machine learning models;
• searching, via the one or more computers, an automated fraud or abuse signature registry based on the encoded representation of the digital activity signature, wherein searching the automated fraud or abuse signature registry includes searching for labeled digital fraud or abuse clusters that are within a threshold distance of the encoded representation of the digital activity signature,
• wherein:
• the automated fraud or abuse signature registry includes a plurality of distinct digital fraud or abuse clusters,
• each of the plurality of distinct digital fraud or abuse clusters relates to a distinct type of fraud or abuse, and
• each of the plurality of distinct digital fraud or abuse clusters includes encoded representations of digital activity signatures associated with the distinct type of fraud or abuse;
• wherein the searching includes:
• calculating a distance between the encoded representation of the digital activity signature and a centroid of each of the plurality of distinct digital fraud or abuse clusters;
• and
• identifying digital fraud or abuse clusters whose centroid is within the threshold distance of the encoded representation of the digital activity signature;
• determining whether the digital event is associated with an automated fraud attack or an automated abuse attack based on the searching of the automated fraud or abuse signature registry;
• and
• selectively implementing one or more automated threat mitigation actions if the digital event is determined to be associated with the automated fraud attack or the automated abuse attack.