Graph-based detection of abusive computational nodes

A method comprising:

• receiving first input data describing a first plurality of computational nodes and first data identifying a dimension along which to parse the first plurality of computational nodes;
• generating, using a first computing device, input graph data representing the first plurality of computational nodes, wherein computational nodes of the first plurality of computational nodes that share corresponding values for the dimension are connected to one another in the input graph data;
• determining a first known abusive computational node;
• performing a first graph-based label propagation for the input graph data based at least in part on the first known abusive computational node, wherein the first graph-based label propagation generates a first risk score for a first candidate computational node;
• generating induced subgraph data comprising the first candidate computational node;
• determining, for the first candidate computational node, a second risk score that is different from the first risk score;
• performing a second graph-based label propagation using the second risk score, wherein the second graph-based label propagation generates a respective first updated risk score for each of the computational nodes of the induced subgraph data;
• and
• terminating network access of a first computational node of the induced subgraph data based at least in part on the first updated risk score for the first computational node.

A system, comprising:

• at least one processor;
• and
• at least one non-transitory computer-readable memory configured in communication with the at least one processor, the at least one non-transitory computer-readable memory storing instructions that, when executed by the at least one processor, are effective to program the at least one processor to:
• receive first input data describing a first plurality of computational nodes and first data identifying a dimension along which to parse the first plurality of computational nodes;
• generate, using a first computing device, input graph data representing the first plurality of computational nodes, wherein computational nodes of the first plurality of computational nodes that share a same value for the dimension are connected to one another in the input graph data;
• determine, a first known abusive computational node;
• perform a first graph-based label propagation for the input graph data based at least in part on the first known abusive computational node, wherein the first graph-based label propagation generates a first risk score for a first candidate computational node;
• generate induced subgraph data comprising the first candidate computational node;
• determine, for the first candidate computational node, a second risk score that is different from the first risk score;
• perform a second graph-based label propagation using the second risk score, wherein the second graph-based label propagation generates a respective first updated risk score for each of the computational nodes of the induced subgraph data;
• and
• terminate network access of a first computational node of the induced subgraph data based at least in part on the first updated risk score for the first computational node.