Anomaly detection for online endorsement event

A computer program product comprising a non-transitory computer usable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to:

• retrieve event data describing one or more endorsement events;
• determine activity data associated with the one or more endorsement events;
• aggregate the activity data to an aggregation level, wherein aggregating the activity data comprises:
• determining the aggregation level;
• generating an aggregation value for the aggregation level from the activity data, the aggregation value representing a number of endorsement events performed in the aggregation level;
• and storing the aggregation value in an aggregation table;
• detect, based at least in part on the aggregation level of the activity data, one or more anomalies, wherein the one or more anomalies represent suspicious behavior associated with the one or more endorsement events;
• and
• take one or more protection actions responsive to the detection of the one or more anomalies.

A system comprising:

• one or more processors, the one or more processors being configured to:
• retrieve event data describing one or more endorsement events;
• determine activity data associated with the one or more endorsement events;
• aggregate the activity data to an aggregation level, wherein the one or more processors aggregate the activity data by:
• determining the aggregation level;
• generating an aggregation value for the aggregation level from the activity data, the aggregation value representing a number of endorsement events performed in the aggregation level;
• and storing the aggregation value in an aggregation table;
• detect, based at least in part on the aggregation level of the activity data, one or more anomalies, wherein the one or more anomalies represent suspicious behavior associated with the one or more endorsement events;
• and
• take one or more protection actions responsive to the detection of the one or more anomalies.