Sentiment analysis for fraud detection

A method comprising:

• accessing a log of a sequence of actions taken through a plurality of user accounts associated with a network-accessible software service;
• converting the log of the sequence of actions into a plurality of data structures, each of the plurality of data structures associated with a different user account of the plurality of user accounts;
• applying a word embedding algorithm to the plurality of data structures to produce a representation of the sequence of actions within a vector space;
• performing a sentiment analysis, using a trained prediction model, on the plurality of data structures;
• determining, based on a result of the sentiment analysis, whether one or more sequences of actions in the sequence of actions indicate a fraudulent account sentiment;
• determining at least one of the plurality of user accounts has the fraudulent account sentiment based on the sentiment analysis;
• and
• taking a mitigation action for each of the at least one of the plurality of user accounts that has the fraudulent account sentiment.

A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause performance of operations comprising:

• accessing a sequence of actions for a plurality of accounts, the plurality of accounts comprising a plurality of known non-fraudulent accounts and a plurality of known fraudulent accounts, the plurality of known non-fraudulent accounts comprising accounts with a first sequence of actions having a categorized benign sentiment and the plurality of known fraudulent accounts comprising accounts having a second sequence of actions with a categorized fraudulent sentiment;
• generating, using a word embedding algorithm on the sequence of actions, a representation of the sequence of actions within a vector space;
• accessing a prediction model for sentiment analysis;
• applying the representation of the sequence of actions within the vector space to the prediction model using a neural network that is configured to receive an input of a sequence of actions of an unclassified user account and an output a likelihood of prohibited user activity of the unclassified user account;
• retrieving the sequence of actions of the unclassified user account;
• and
• determining the likelihood of prohibited user activity of the unclassified user account using the prediction model and the sequence of actions of the unclassified user account.