Apparatus, method and article to facilitate automatic detection and removal of fraudulent user information in a network environment

A method of operation in at least a portion of a system to detect at least one of accounts or related profiles suspected of being fraudulent, the system which includes at least one processor and at least one nontransitory processor-readable medium that stores at least one of processor-executable instructions or processor-executable data, the at least one nontransitory processor-readable medium communicatively coupled to the at least one processor, the method of operation comprising:

• for each of a plurality of profiles, computing by the at least one processor a representation of dissimilarity based at least in part on a respective attribute value of each of a plurality of attributes logically associated with the respective profile, wherein computing a representation of dissimilarity includes, for each of the profiles computing a dissimilarity matrix based on the respective values of each of the number of attributes logically associated with the profile;
• performing a clustering of the profiles by the at least one processor, based on the representation of dissimilarity, the performance of the clustering resulting in a number of clusters, each cluster comprising one or more of the profiles, wherein performing a clustering of the profiles includes performing a clustering based on the dissimilarity matrices of the respective profiles and the performance of the clustering results in a dendrogram with a top-most node representing all of the plurality of profiles and the bottom-most nodes representing respective individual ones of the profiles, a plurality of intermediate nodes between the top-most and the bottom-most nodes representing respective sets of profiles where the profiles in any set of profiles are similar to one another to a degree;
• selecting clusters of the profiles above a threshold, wherein selecting clusters of profiles above a threshold includes selecting clusters below a cut line in the dendrogram;
• in a first pass,
• for each of at least some of the selected clusters, identifying by the at least one processor each of a number of attributes and attribute value combinations that occur frequently in the profiles of the respective cluster;
• in a second pass,
• for each of at least some of the selected clusters and for each attribute identified as occurring frequently in the first pass, identifying by the at least one processor one or more additional attribute values for the respective attribute that occur frequently in the profiles of the respective cluster;
• and
• for each of at least some of the selected clusters, preparing a respective query to identify the accounts or the related profiles suspected of being fraudulent based at least in part on the processor identified attribute and attribute value combinations and the processor identified one or more additional attribute values.