# US 12,225,021 B2 · Classification scheme for detecting illegitimate account creation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,021 B2 - Document ID: US12225021B2 - Status: Granted - Kind: B2 - Application number: 17/321,847 - Filed: 2021-05-17 - Published: 2022-11-10 - Granted: 2025-02-11 - Earliest claimed: 2021-05-05 - Assignees: Citrix Systems, Inc. - Applicants: Citrix Systems, Inc. - Inventors: Andreas Varnavas; Ananthaneni Sai Teja Chowdary; Nikolaos Tsapakis; Premkumar S J; Manikam Muthiah - Web page: https://patentgrep.com/patent/US12225021B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04W 12/12: Detection or prevention of fraud - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A system and method that detects malicious account creation in a web-based platform. A method includes detecting suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an IP address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account; analyzing each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collections of account creation processes; and determining an alert condition based on at least one malicious event detection. ## Claims ### Claim 1 A system, comprising: a memory; and a processor coupled to the memory and configured to execute instructions that detect a malicious account in a web-based platform, wherein the instructions cause the processor to: detect suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an internet protocol (IP) address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account; analyze each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collection of account creation processes; and determine an alert condition based on at least one malicious event detection, wherein the domain classifier is trained by evaluating domains used to create prior accounts in order to determine a threshold, and wherein domain classifier: obtains the domain used for the new account; determines a number of accounts created with the domain during a predefined time period; and generates a suspicious event if the number of accounts exceeds the threshold. ### Claim 2 (depends on 1) The system of claim 1, wherein the username classifier is trained with a first dataset of legitimate usernames and a second dataset of illegitimate usernames, and wherein the username classifier: analyzes the username structure of a new username to predict whether the new username is legitimate or illegitimate; and flags an illegitimate username as a suspicious event. ### Claim 3 (depends on 2) The system of claim 2, wherein the username classifier is trained using N-grams in combination with a Naïve Bayes classifier. ### Claim 4 (depends on 1) The system of claim 1, wherein the username classifier is trained to predict whether the username comprises a suspicious event based on a number of characters in the username. ### Claim 5 (depends on 1) The system of claim 1, wherein the IP address classifier is trained by evaluating IP addresses used to create prior accounts in order to determine a threshold, and wherein IP address classifier: obtains the IP address used for the new account; determines a number of accounts created with the IP address during a predefined time period; and generates a suspicious event if the number of accounts exceeds the threshold. ### Claim 6 (depends on 1) The system of claim 1, wherein the density analysis classifier: evaluates a detected suspicious event relative to an associated time series of events within an associated time window in which the events are generated by at least one of the username classifier, IP address classifier and domain classifier; and classifies the detected suspicious event as a malicious event if a threshold number of events were flagged as suspicious events within the associated time window. ### Claim 7 (depends on 1) The system of claim 1, wherein each of the username classifier, IP address classifier, domain classifier and density analysis classifier are tuned to produce an overall target specificity that dictates a precision as a function of recall, wherein the precision is a ratio of correctly detected malicious events relative to a total number of detected events and recall is a probability that a malicious event will be detected. ### Claim 8 (depends on 7) The system of claim 7, wherein the overall target specificity is determined based on a historical prevalence of correctly detected malicious events. ### Claim 9 (depends on 7) The system of claim 7, wherein the overall target specificity is determined based on an assumption about a prevalence of malicious events in the web-based platform. ### Claim 10 A computerized method, comprising: detecting suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an internet protocol (IP) address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account; analyzing each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collection of account creation processes; and determining an alert condition based on at least one malicious event detection, wherein the domain classifier is trained by evaluating domains used to create prior accounts in order to determine a threshold, and wherein domain classifier: obtains the domain used for the new account; determines a number of accounts created with the domain during a predefined time period; and generates a suspicious event if the number of accounts exceeds the threshold. ### Claim 11 (depends on 10) The method of claim 10, wherein the username classifier is trained with a first dataset of legitimate usernames and a second dataset of illegitimate usernames, and wherein the username classifier: analyzes the username structure of a new username to predict whether the new username is legitimate or illegitimate; and flags an illegitimate username as a suspicious event. ### Claim 12 (depends on 11) The method of claim 11, wherein the username classifier is trained using N-grams in combination with a Naïve Bayes classifier. ### Claim 13 (depends on 10) The method of claim 10, wherein the username classifier is trained to predict whether the username comprises a suspicious event based on a number of characters in the username. ### Claim 14 (depends on 10) The method of claim 10, wherein the IP address classifier is trained by evaluating IP addresses used to create prior accounts in order to determine a threshold, and wherein IP address classifier: obtains the IP address used for the new account; determines a number of accounts created with the IP address during a predefined time period; and generates a suspicious event if the number of accounts exceeds the threshold. ### Claim 15 (depends on 10) The method of claim 10, wherein the density analysis classifier: evaluates a detected suspicious event relative to an associated time series of events within an associated time window in which the events are generated by at least one of the username classifier, IP address classifier and domain classifier; and classifies the detected suspicious event as a malicious event if a threshold number of events were flagged as suspicious events within the associated time window. ### Claim 16 (depends on 10) The method of claim 10, wherein each of the username classifier, IP address classifier, domain classifier and density analysis classifier are tuned to produce an overall target specificity that dictates a precision as a function of recall, wherein the precision is a ratio of correctly detected malicious events relative to a total number of detected events and recall is a probability that a malicious event will be detected. ### Claim 17 (depends on 16) The method of claim 16, wherein the overall target specificity is determined based on a historical prevalence of correctly detected malicious events. ### Claim 18 (depends on 16) The method of claim 16, wherein the overall target specificity is determined based on an assumption about a prevalence of malicious events in the web-based platform.