Classification scheme for detecting illegitimate account creation

A system, comprising:

• a memory;
• and
• a processor coupled to the memory and configured to execute instructions that detect a malicious account in a web-based platform, wherein the instructions cause the processor to:
• detect suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an internet protocol (IP) address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account;
• analyze each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collection of account creation processes;
• and
• determine an alert condition based on at least one malicious event detection,
• wherein the domain classifier is trained by evaluating domains used to create prior accounts in order to determine a threshold, and wherein domain classifier:
• obtains the domain used for the new account;
• determines a number of accounts created with the domain during a predefined time period;
• and
• generates a suspicious event if the number of accounts exceeds the threshold.