CPC G06F 21/577 (2013.01) [G06F 18/211 (2023.01); G06F 18/213 (2023.01); G06F 18/23 (2023.01); G06F 18/2415 (2023.01); G06F 18/285 (2023.01)] | 17 Claims |
1. A method comprising:
identifying one or more potential clusters of malicious accounts;
for each cluster, processing a collection of content associated with each account of the cluster, the processing comprising applying a plurality of models in series to determine whether the collection of content indicates a common pattern, the applying the plurality of models in series comprising:
applying a plurality of instances of a single user model to respective portions of the collection of content,
applying a multi-users model to the output of the plurality of instances of the single user model, and
applying a group model to the output of the multi-users model; and
based on the respective determinations, classifying the accounts of each cluster as either ordinary or suspicious.
|