Identification of fraudulent online profiles

Techniques are disclosed relating to methods that include training, by a new profile process executing on a computer system, a contrastive loss function to identify fraudulent images associated with a particular entity. The new profile process may receive new profile information that includes a new profile image and a new profile identifier and compare the new profile identifier to one or more existing profile identifiers. In response to determining that one or more existing profile identifiers satisfy a threshold identifier metric, a particular neural network, using the contrastive loss function, may compare the new profile image to one or more existing profile images corresponding to the one or more existing profile identifiers. The new profile process may determine, using the comparing, whether the new profile information is a possible fake profile of a legitimate profile.

BACKGROUND

Technical Field

This disclosure relates generally to computer system operations, and more particularly to identification of fraudulent online profiles.

Description of the Related Art

Various forms of social media are used not only by individuals, but also by businesses (small and large), government organizations, schools from pre-kindergartens to universities, community organizations, and the like, to disseminate information online, provide a convenient feedback loop, execute transactions, and other uses. Online security has become a more serious concern for social media platforms that desire safe, accurate, and clear communication between the account owners and those users. Malicious entities across the world may attempt to scam users or disrupt services provided by account owners for financial gain, personal attacks, and other illegal and/or unethical reasons.

One method for deceiving users involves attempting to get a user to visit a fake account that is posing as a legitimate account in order to trick the user. These fake accounts may include names and images that are deceptively close to the actual account being mimicked. The fake accounts may differ from the legitimate accounts by a single character in an account name and/or by using images that include similar logos or other forms of branding that include many features of the legitimate branding. These deceptive practices may fool users into believing the fake accounts are actually the legitimate accounts, resulting in the user receiving inaccurate information, providing sensitive information to the malicious entity, executing a deceptive transaction, and the like.

DETAILED DESCRIPTION

As described above, fake profiles may be utilized by malicious entities with illegitimate intentions, such as deceptively obtaining sensitive information, distributing false information, performing fraudulent transactions, and the like. A web-based service that provides legitimate online profiles for users may wish to detect and remove such fake profiles to increase user trust in the web-based service and provide the users with safe, accurate means for interacting with the user's audience. One method for reducing a number of fake profiles is to analyze requests for new profiles and determine if the new profile includes information that is deceptively close to an existing profile. Many social media profiles, however, include images as well as textual information. Managing profiles for a web-based service with millions, or even billions of users, however, may require a vast number of human resources to analyze all accounts and determine if a new request is too similar to an existing profile. In addition, current methods for automating such determinations may prove to be too inaccurate, particularly for image analysis, thereby still requiring the human resources to review decisions made by the automated analysis.

The present disclosure recognizes a desire for a technique that provides an automated technique for analyzing new profile requests and is capable of delivering accurate results with little to no human interaction. One embodiment of such a technique includes, training, by a new profile process executing on a computer system, a contrastive loss function (such as a triplet loss function) to identify fraudulent images associated with a particular entity. In response to receiving new profile information that includes a new profile image and a new profile identifier, this new profile process compares the new profile identifier to one or more existing profile identifiers. If one or more existing profile identifiers satisfy a threshold identifier metric, the new profile process, using the trained contrastive loss function, compares the new profile image to one or more existing profile images corresponding to the one or more existing profile identifiers. The new profile process uses the comparing to determine whether the new profile information is a possible fake profile of a legitimate profile. Using a trained contrastive loss function in this manner, the accuracy of image analysis may be increased, thereby allowing for an increased usage of automated profile analysis.

Use of such an automated method may increase a level of protection of user profiles against impostors by, for example, comparing all new profile requests to all existing user profiles. By accurately identifying potential imposter profiles, the imposters may be denied new profiles while legitimate new profile requests are fulfilled. In some embodiments, a potential imposter profile may be flagged for further analysis to reduce a number of false positive determinations.

A block diagram of an embodiment of a computer system that receives and analyzes new profile requests is illustrated inFIG.1. Computer system100includes new profile process101that receives new profile information115(including new profile identifier (ID)120and new profile image130) as part of a new profile request received from a client device (not shown). New profile process101uses neural networks105aand105bto compare new profile information115to profile information from existing profiles, including existing profile identifiers (IDs)125a-125n(collectively existing profile identifiers125) and existing profile images135a-135n(collectively existing profile images135). Neural networks105aand105bgenerate image metric140and identifier metric145, respectively, which new profile process101uses to generate fake metric150that provides an indication of whether new profile information115is part of a fraudulent profile request.

Computer system100, as illustrated, is part of an online service that allows users to create respective user profiles that may be used by the corresponding user to interact with other users, including sharing information, performing transactions between users, and/or receiving feedback from the other users. Users of the online service may include individuals, small or large businesses, educational institutions, community organizations, government entities, and the like. In various embodiments, computer system100may be a single computer system or a plurality of computer systems included, for example, in a server farm. In some embodiments, computer system100may be a subset of bandwidth of a server farm leased from a third party. New profile process101, as well as neural networks105aand105bmay be implemented as computer instructions stored on a non-transitory, computer-readable medium that are included in, or accessible by, computer system100. New profile process101and neural networks105aand105bmay include instructions that are executable by a computer system to perform some or all of the operations described herein. In some embodiments, some of the operations may be implemented as hardware, such as custom logic circuits, programmable logic arrays, or application-specific integrated circuits.

As shown, when a user wants to create a profile, the user sends a new profile request to computer system100, the request including new profile information115. New profile information includes new profile identifier120and new profile image130. Profiles created with the online service include a profile identifier, selected by the user, that uniquely identifies a given profile from other profiles created in the online service. The given profile and content presented on the online service via the given profile is identified to other users by the profile identifier. A given user may use any suitable string of characters as the profile identifier, including, for example, their name or a portion thereof, a nickname, an online persona, a business/organization name, and the like.

Two different users, however, may have similar profile information, such as two individuals, one named “John Q. Smith” and the other named “John Z. Smith” or two small businesses with similar names such as “Acme Brick Company” and “Acme Building Supplies, Co.” In such cases, both users may request user profiles with a same profile identifier, e.g., “John Smith” or “Acme, Co.” New profile process101, however, may not allow the second requestor to have a profile identifier that is the same as an existing profile identifier. Accordingly, John Q. may be first to request the “John Smith” profile identifier and John Z. may therefore have to modify his request, e.g., to “John Z. Smith.” In these cases, profile images may be included in the profile information, and if the two users are legitimately unique, then the images may be expected to provide distinction between the two users. If, however, the second user is attempting to create a fraudulent user profile, then the second user may attempt to use images that are similar to the first user's images. For example, if “Acme Building Supplies, Co.” is an attempt to purposely confuse Acme Brick Company's customers into going to the “Acme Building Supplies, Co.” profile instead, then the second user may obtain images that similar to images found on the “Acme Brick Company” profile. Acme Brick Company may include a business logo in one or more of their images, and/or use an image of their storefront. The second user may create, find, or modify images to appear similar to the images of the “Acme Brick Company” profile.

To reduce a likelihood of fraudulent profiles being created, computer system100, as illustrated, performs new profile process101to receive new profile information115, determine if new profile information115is part of a legitimate new profile requests or if new profile information115appears to be part of a fraudulent profile request. Prior to receiving new profile requests, computer system100trains contrastive loss function110to identify fraudulent images associated with a particular entity. Contrastive loss function110may, in some embodiments, be a triplet loss function. Such training includes identifying images from a first entity that are similar to one or more images associated with a second entity, and identifying images from the first entity that are different from one or more other images that are also associated with the first entity. For example, images associated with a particular business are compared with very similar images associated with a different company, not associated with the particular business. These images may have various details, such as logos that include similar color schemes and/or shapes, and new profile process is trained to identify differences between the images from the different businesses. In addition, a variety of images that are associated with the particular business, but have very different shapes and/or colors are provided to new profile process101, which is then trained to identify similarities between the different images.

As illustrated, after new profile process101has been trained, new profile information115, including new profile image130and new profile identifier120, is received. New profile information115may be included in a request to create a new profile. In other embodiments, new profile information115may be received in response to a request from new profile process101after new profile process101has received the new profile request. Before approving the new profile request, new profile process101determines if there is an existing profile with profile information that matches new profile information115.

New profile process101compares new profile identifier120to one or more existing profile identifiers125stored by computer system100. As illustrated, neural network105bis used to perform the comparison of new profile identifier120to existing profile identifiers125. For example, alphanumeric characters in new profile identifier120may be compared to characters in existing profile identifiers125. If there is an exact match, then the new profile request may be rejected and/or a notification sent to the requestor indicating that new profile identifier120is already in use and that a different identifier must be used. Otherwise, one or more of existing profile identifiers125that are close matches to new profile identifier120are identified, and corresponding identifier metrics145are determined for each of the identified existing profile identifiers125.

As shown, in response to determining that at least one of existing profile identifiers125satisfies a threshold identifier metric relative to new profile identifier120, computer system100compares new profile image130to one or more existing profile images135corresponding to the at least one of existing profile identifiers125. Computer system100may perform this comparing using neural network105athat implements contrastive loss function110. The threshold identifier metric may provide an indication whether new profile identifier120satisfies a threshold level of similarity to a particular existing profile identifier125associated with a particular account. If a particular existing profile identifier125(e.g.,125b) is identified, then existing profile image135b, corresponding to the same profile as existing profile identifier125b, is compared to new profile image130. If multiple existing profile identifiers125satisfy the threshold identifier metric, then neural network105amay be run for each corresponding existing profile image135.

Neural network105auses contrastive loss function110to identify whether new profile image130is too similar to the one or more identified existing profile images135. As described above, contrastive loss function110is trained to identify differences between similar images associated with different entities, and to identify similarities between differing images associated with a same entity. Accordingly, contrastive loss function110may enable neural network105ato recognize potentially deceitful images that look like they are associated with an unassociated entity, and deceitful images in which a legitimate image associated with an entity have been modified to be distinct from the legitimate image but still potentially recognizable as associated with the entity. Additional details regarding the contrastive loss function are provided below in reference toFIG.2.

New profile process101, as illustrated, determines whether new profile information115is a possible fake profile of a legitimate profile. For example, in response to determining that new profile image130satisfies a threshold level of similarity to a particular existing profile image135(e.g.,135b) associated with a particular account, new profile process101identifies new profile information115as a possible fake profile of the particular account. In response to identifying new profile information115as a possible fake profile of the particular account, new profile process may select one of a set of actions based at least on a degree of similarity between new profile identifier120and existing profile identifier125b, as well as a degree of similarity between new profile image130and particular existing profile image135b.

In response to determining that the degree of similarity to both existing profile identifier125band existing profile image135bsatisfies a different threshold, computer system100may reject the new account profile request. For example, fake metric150may be compared to a first threshold level to identify whether new profile information115is related to a possible fraudulent profile. Fake metric150may be compared to a second threshold level to determine if there is a strong indication that new profile information115is related to a fraudulent profile. If fake metric150produces a strong indication of fraud, then the request for the new account may be rejected. An indication that the request has been rejected may be sent to the requesting device. A reason for the rejection may or may not be provided in various embodiments.

Otherwise, if the degree of similarity to both existing profile identifier125band existing profile image135bfails to satisfy the different threshold, then the new profile request may be approved. An indication, however, may be included that new profile information115has similarities to the particular profile associated with existing profile identifier125b. For example, a log may be kept for new profile activations and a flag may be set in an entry for new profile identifier120indicating the satisfying of the first threshold level. A system administrator may review the log and perform an additional comparison of the new profile and any existing profiles that are indicated as potential matches.

It is noted that the embodiment ofFIG.1is merely an example. Elements of the computer system and processes have been simplified for clarity. In some embodiments, the operations described may occur in a different order. For example, the comparison of profile images is disclosed as occurring in response to a potential match between the new profile identifier and one or more existing profile identifiers. In other embodiments, the new profile image may be compared to existing profile images and a comparison of profile identifiers is performed in response to a potential image match.

The system ofFIG.1includes a description of a computer system that uses a contrastive loss function to compare images. As described, this contrastive loss function is trained identify similarities between two very different images associated with a same entity and to identify differences between two very similar images associated with different images. A particular example of training a contrastive loss function is shown inFIG.2.

Moving toFIG.2, two examples associated with training a contrastive loss function are depicted. As illustrated, training example200depicts a training comparison between anchor image235, associated with a particular anchor entity, and differing positive image233that is also associated with the anchor entity, the comparison producing image similarity metrics242. Training example250depicts a training comparison between anchor image235and similar negative image237that is associated with a different entity, and not the anchor entity, the comparison producing image differential metrics244. A goal is to train contrastive loss function110to identify images that are a positive match (e.g., are associated with the anchor entity), but look different from the anchor image. Another goal is to train contrastive loss function110to identify images that are a negative match (e.g., are not associated with the anchor entity) but that look similar to the anchor image.

As illustrated, computer system100performs the training, for example, using new profile process101or a different training process executing on computer system100. As stated, training example200includes training contrastive loss function110to identify similarities between two differing images associated with a common entity. Contrastive loss function110is trained to identify similarities between anchor image235corresponding to an anchor entity and differing positive image233that is also associated with the anchor entity. In this particular example, the images include a business logo with a capital “A” on top of one or more sine waves. The machine learning model is forced to find the relevant similarities in the two images, even though the two images have multiple differences, such as anchor image235having multiple sine waves in a gray color and differing positive image233having a single sine wave in a black color, and being thinner than the sine waves of anchor image235. In addition, differing positive image233includes a circular border and has been rotated ninety degrees in comparison to anchor image235.

To perform the comparison, contrastive loss function110determines a distance of differing positive image233from anchor image235. As used herein in regards to the contrastive loss function, “distance” refers to a numerical difference between two points in Euclidian space. To compare images, each image is processed to generate one or more vectors in the Euclidean space. This processing is accomplished by using pixel data from a plurality pixels in a given image. Each pixel includes a plurality of bits that form one or more values representing the color and luminance of the respective pixel. Any number of functions may be utilized to generate respective vectors that correspond to one or more characteristics of the image. Contrastive loss function110may take a particular vector from anchor image235and determine a distance value from a corresponding vector from differing positive image233. This may be repeated for a plurality of vectors from both images, creating a set of image similarity metrics242.

Computer system100, as shown, may further train contrastive loss function110to identify differences between two similar images associated with different entities. As disclosed, training example250includes training contrastive loss function110to identify differences between anchor image235and similar negative image237that is associated with a different entity from the anchor entity. Contrastive loss function110is forced to look for relevant differences between similar images that belong to different entities. In training example250, the two images include respective business logos. Anchor image235includes the capital “A” on top of four sine waves, while similar negative image237includes the characters “4K” on top of four triangle waves. In this example, the machine learning model is forced to find the relevant differences in the two similar images. For example, contrastive loss function110may detect the differences between the sine wave pattern and the triangle wave pattern, as well as the different characters and number of characters. As in training example,200, vector representations of the two images are generated and distances are calculated to generate a set of image differential metrics244.

The training, as illustrated, includes using image similarity metrics242and image differential metrics244to calculate a loss value using equation 1.

Equation 1 determines squares of the differences between vectors of anchor image235(fi∝) and vectors of differing positive image233(fip), and then subtracts squares of the differences between vectors of anchor image235(fi∝) and vectors of similar negative image237(fin). The functions used to determine the vector values may remove rotational and other differences between two images being compared. For example, in addition to rotational differences, color and or luminescence differences may be removed to focus the comparison on the general shapes.

The training of contrastive loss function110may be repeated for a set of differing positive images and/or similar negative images. Additionally, the training may be repeated for a plurality of anchor images. For each additional anchor image, a respective set of differing positive images and similar negative images may be included. Generally speaking, the more images that are used, the more accurate contrastive loss function110may perform.

It is noted that the example ofFIG.2is for demonstrating the disclosed concepts. Only details related to these concepts have been illustrated. Although business logos are used in the illustrated examples, any suitable images capable of representing an entity may be utilized. Although one each of a differing positive image and a similar negative image are shown for use with the illustrated anchor image, any suitable number of positive and negative images may be used.

FIG.2illustrates an example of training a contrastive loss function. Once the contrastive loss function has been adequately trained, it may be utilized in various ways by a machine learning model to compare a new profile image to an existing image. InFIG.3, an example of comparing a new profile image to an existing image is depicted.

Turning toFIG.3, an embodiment of a machine learning model for comparing a new profile image to an existing image is illustrated. Machine learning model300is implemented on computer system100and includes neural networks305nand305ewhich are used to generate vector representations360nand360eof new profile image330and existing image335, respectively. In the example ofFIG.3, machine learning model300uses vector representations360nand360eto compare new profile image330to existing image335.

As illustrated, machine learning model300uses neural network305nto generate vector representation360nof new profile image330, and uses neural network305eto generate vector representation360eof existing image335. Neural networks305nand/or305emay correspond to neural network105ainFIG.1and, in some embodiments, neural network305nand305emay be the same. For example, neural network305emay be performed on existing image335at first point in time when existing image335is first submitted to computer system100as part of a new profile request. The generated vector representation360emay be stored in a database in computer system100(or a storage device accessible by computer system100) after being generated. This use of two neural networks (or two performances of a same neural network) to generate comparable vector representations may be referred to as a “Siamese network.”

At a second point in time, new profile image330is submitted to new profile process101on computer system100as a part of a new profile request. Machine learning model300performs neural network305non new profile image330after the submission to generate vector representation360n. Machine learning model300may retrieve stored vector representations of one or more existing images to compare to vector representation360n, including vector representation360e. Machine learning model300may then generate distance metric365based on vector representations360nand360e. A value of distance metric365provides an indication of the degree of similarity between new profile image330and existing image335. Distance metric365may include a summation of differences between respective elements of vector representations360nand360e. For example, similar images may have fewer differences than dissimilar images, resulting in a lower value of distance metric365.

To generate vector representation360n, neural network305nsends pixel data of new profile image330to a first of convolution layers (convolution)352n. The output of the first convolution layer352nmay then be sent to a next one of convolution layers352n. This process repeats until all convolution layers352nhave been performed. Each of convolution layers352nmay process a different characteristic of new profile image330. For example, one of convolution layers352nmay place a higher weight on particular colors, and or be configured to identify particular types of shapes in the pixel data.

Outputs from some or all of convolutional layers352nmay then be sent to one or more pooling layers (pool)354n. Pooling layers354nmay be configured to combine particular outputs of convolutional layers352nto reduce a size of the output. For example, if new profile image330is 800 pixels wide by 600 pixels tall, then the image has a total of 480000 pixels. The output of each convolutional layer352nmay have a similar number of outputs. Pooling layers354nmay combine a portion of these outputs to reduce the number of outputs, for example to reduce a complexity of further analysis.

The outputs of pooling layers354nare a plurality of nodes356n. Each node356nmay correspond to a degree to which new profile image330exhibits a particular characteristic. Nodes356nmay be combined in a variety of ways to generate vector representation360n. Vector representation360nprovides a series of numeric values indicative of various characteristics of new profile image330and may, therefore, be used to compare two different images to determine a degree of similarity between the two images.

Neural network305emay generate vector representation360ein a similar manner as neural network305n. Pixel data of existing image335is processed using convolution layers352eto determine one or more different characteristics of existing image335. The output of convolution layers352eis sent to pooling layers354eto reduce a size of the output. The resulting output is a plurality of nodes356e, providing indications of degrees to which existing image335exhibits various characteristics. Vector representation360emay then be generated using nodes356e. Formats for vector representations360nand360emay be selected to enable an accurate comparison to determine whether new profile image330appears to be a deceptive version of existing image335.

The training of the contrastive loss function may be used to modify how neural network305ngenerates the vector representations. For example, weights used in one or more of convolutional layers352nmay be modified based on the training. In some embodiments, the training includes replacing, by computer system100in neural network305n, values in a particular number of convolutional layers352nwith values learned during the training of contrastive loss function110. In addition, the training may be used to weight various combinations of nodes356nwhen generating vector representation360n. As disclosed above, neural networks305nand305emay correspond to different performances of the same neural network.

It is noted thatFIG.3is merely an example for demonstrating the disclosed concepts. A limited number of elements (e.g., convolution layers, pooling layers, etc.) for describing the concepts have been illustrated. In other embodiments, additional elements may be included, such as additional convolution and/or pooling layers.

FIGS.2and3describe techniques involved in comparing images. The new profile information, as disclosed, includes profile identifiers. In addition to comparing a new profile image to existing images, a new profile identifier may be compared to existing identifiers. InFIG.4, an example of a technique for comparing identifiers is presented.

Proceeding toFIG.4, an embodiment of a neural network that utilizes a similarity metric, such as Hamming distance, for comparing two strings is depicted. Neural network105bperforms an analysis of two strings to determine a degree of similarity between the two. In the example ofFIG.4, new profile identifier120is a first input string and existing profile identifier125ais a second input string. Similarity metric466is determined based on identifier similarities462and identifier differences464. In addition, known text substitutions470may be used to weight a resulting Similarity metric466to generate identifier metric145.

As disclosed above, new profile process101performs a comparison to determine whether new profile identifier120satisfies a threshold identifier metric when compared to any existing profile identifiers125. This comparing includes, using, by computer system100, neural network105bfor detecting new profile identifier120similarities by analyzing a number of characters of new profile identifier120that are different from ones of existing profile identifiers125. Satisfying the threshold identifier metric includes determining, by computer system100using neural network105b, that new profile identifier120is different than the one or more existing profile identifiers125, and further determining that new profile identifier120differs from of the existing profile identifier125aby less than a threshold number of characters.

Similarity metric466is determined by comparing two strings of a same length and determining how many changes are needed to transform new profile identifier120to existing profile identifier125. In the illustrated example, new profile identifier120is “4cme Comp.” and existing profile identifier125ais “Acme Corp.” As shown by identifier similarities462, all characters but two are the same. Identifier differences464indicates that the characters “4” and “m” are included in new profile identifier120in place of the characters “A” and “r” found in the same character positions of existing profile identifier125a. This difference results in a Similarity metric466of 2.

Neural network105bfurther analyzes identifier differences464to determine whether the characters that are different include known text substitutions470. Text substitution may be utilized by a user to differentiate a profile identifier from an existing identifier while maintaining a similar look. For example, a user named “Steve Smith” may wish to use his name as a profile identifier, but learn that this profile identifier is already in use. One character substitution may include replacing a capital “S” with the number “5.” Accordingly, Steve may attempt to establish his profile using the identifier “Steve Smith.” Such a collection of known text substitutions470may be used to determine if new profile identifier120may be more similar to existing profile identifier125athan Similarity metric466indicates. In the illustrated example, “m” and “r” are not considered a common text substitute, but the use of “4” in place of a capital “A” is a known substitute. Accordingly, identifier metric145may be assigned a value less than 2.

New profile process101may receive identifier metric145and make a determination whether new profile identifier120is part of an attempt to create a fraudulent profile to deceive users of Acme Corp.'s profile. For example, new profile process101may compare identifier metric145to one or more threshold values to determine if a threshold value is satisfied. If so, then new profile process may take a particular action, such as performing additional analysis, rejecting the new profile request, and/or flagging request for the attention of a system administrator.

It is noted thatFIG.4is an example. In other embodiments, additional elements and/or a different set of elements may be included. For example, as shown, Hamming distance and text substitution are shown as two forms of analysis. In other embodiments, additional forms of analysis may be used, such as a vocabulary analysis that determines is words with similar meanings are substituted, e.g., “company” in place of “corporation.” Furthermore, in addition to, or in place of, the Hamming distance, a value indicative of the percentage difference of characters between the new profile identifier and an existing profile identifier may be determined.

The techniques described in regards toFIGS.1-4use new profile information submitted by a user to determine if the new profile request is legitimate or a potential fraudulent profile. In some embodiments, additional information may be available to help make the determination. InFIG.5, use of location data to further make a determination is depicted.

Moving now toFIG.5, an example of using location data of a device associated with a new profile request in determining legitimacy of the request is shown.FIG.5depicts map500, representative of a street map on to which is projected client device location530. Client device location530indicates a geographic location of a mobile device used by a user submitting a new profile request. Addresses510-523are building addresses located in the vicinity of client device location530.

As illustrated, new profile process101may use client device location530when making a determination whether a new profile request received from the client device is legitimate. After receiving the new profile request, new profile process101may use neural networks105aand105bto determine image metric140and identifier metric145as shown inFIG.1. If these two metrics provide indications that the new request may be a fraudulent copy of a particular legitimate profile, then new profile process101may attempt to determine, if available, client device location530. Client device location530may be determined using any suitable technique, such as requesting global positioning system (GPS) coordinates from the client device, and/or using network information corresponding to one or more networks to which the client device is currently connected.

Using client device location530, new profile process101may be capable of determining if the client device is making the new profile request while in the vicinity of an address associated with the particular profile. For example, if address513is a location of a business associated with the particular profile, new profile process101may determine that client device location530is in the same vicinity. Using this information, new profile process101may increase the likelihood that the new profile request is potentially fraudulent.

The new profile requestor may be attempting to create a fraudulent profile before entering the place of business. In some embodiments, the business profile may be used by customers and/or employees to process payments, reserve appointments or products, provide indications of customer loyalty rewards, and the like. Using a fraudulent profile, a malicious entity may attempt to defraud the business using fake payments, rewards, reservations and such. Accordingly, new profile process101may flag new profiles created in the vicinity of locations associated with existing profiles as potentially deceptive.

FIGS.1-5describe systems and techniques for analyzing new profile requests and making determinations whether the requests are legitimate or potentially fraudulent. These techniques may be implemented using a variety of methods,FIGS.5-8depict three methods that may be utilized for analyzing new profile requests.

Proceeding now toFIG.6, a flow diagram of an embodiment of a method for determining whether a new online profile is a possible fake is illustrated. In some embodiments, method600may be performed by computer system100inFIG.1. Computer system100may, for example, include (or have access to) a non-transitory, computer-readable medium having program instructions stored thereon that are executable by the computer system to cause the operations described with reference toFIG.6. Referring collectively toFIG.1and method600, the method begins in block610.

Method600, in block610, includes training, by computer system100, contrastive loss function110to identify fraudulent images associated with a particular entity. Prior to receiving new profile requests, contrastive loss function110may be trained to identify fraudulent images associated with a particular entity. This training of contrastive loss function110may include comparing one or more images from an anchor entity to one or more negative images that appear similar to the anchor image, but are associated with a different entity than the anchor entity. The training further includes comparing the anchor images to one or more positive images that are associated with the anchor entity, but have a different appearance from the anchor images. Using a contrastive loss function for training may teach a machine learning model to recognize differences between images of different entities, and to recognize the characteristics of a common entity that remain consistent across a variety of different images.

At block620, method600further includes receiving, by computer system100, new profile information115that includes new profile image130and new profile identifier120. As shown, a user desiring to create a new online profile may submit new profile information115as part of a new profile request. In various embodiments, new profile information115may be sent by the user with the initial request, or new profile process101may request the user provides new profile information115after the new profile request is received. Before approving the new profile request, new profile process101determines if there is an existing profile with profile information that matches new profile information115.

Method600also includes, at block630, comparing, by computer system100, new profile identifier120to one or more existing profile identifiers125stored by computer system100. As illustrated, new profile process101may use neural network105bto perform the comparison of new profile identifier120to existing profile identifiers125. For example, Similarity metric466ofFIG.4may be determined between strings included in new profile identifier120and strings included in respective ones of existing profile identifiers125. If there is an exact match (e.g., a Hamming distance of “0”), then no further analysis may be necessary and the new profile request may be rejected. In some embodiments, a notification may be sent to the user indicating that new profile identifier120is already in use, and request the user submit a different identifier. Otherwise, if there is not an exact match, then one or more of existing profile identifiers125that are close matches to new profile identifier120are identified. An identifier metric145may be determined for each of the identified existing profile identifiers125, the identifier metrics indicating a respective degree of similarity between a given existing profile identifier125and new profile identifier120.

Method600, at block640, also includes in response to determining that at least one existing profile identifier125satisfies a threshold identifier metric relative to new profile identifier120, comparing, by computer system100, new profile image130to one or more existing profile images135corresponding to the at least one existing profile identifier125. If at least one of existing profile identifiers125is relatively similar to new profile identifier120, without being an identical match, then computer system100compares new profile image130to one or more existing profile images135corresponding to the at least one of existing profile identifiers125. The comparing may use neural network105athat implements contrastive loss function110, resulting in generation of image metric140. Image metric140provides an indication of a degree of similarity between new profile image130and a corresponding one of existing profile images135. If multiple existing profile identifiers125satisfy the threshold identifier metric, then neural network105amay be run for all existing profile images135that correspond to any of the corresponding multiple existing profile identifiers125.

At block650, method600also includes determining, by computer system100using results of the comparing, whether new profile information115is a possible fake profile of a legitimate profile stored by computer system100. As illustrated, in response to determining that new profile image130satisfies a threshold level of similarity to a particular existing profile image135(e.g.,135b) associated with a particular existing profile, new profile information115is identified as a possible fake profile of that particular existing profile. In response to identifying new profile information115as a possible fake profile of the particular existing profile, new profile process may select one of a set of actions based at least on a degree of similarity between new profile identifier120and existing profile identifier125b, as well as a degree of similarity between new profile image130and particular existing profile image135b.

By using the disclosed techniques, a user may be prevented from creating a fraudulent online profile, or a suspicious online profile may be tagged for further investigation by a system administrator or other agent of the provider of the online service. The disclosed techniques may provide a real-time analysis of new profile requests, such that fraudulent profiles that have a high degree of obviousness may be prevented from being approved, and more subtle fraudulent profiles that may have enough differences from existing profiles to be approved, may still be flagged for further review. An additional review may be able to prevent fraudulent activity from occurring or may at least reduce an amount of time during which such fraudulent activity may occur.

It is noted that the method ofFIG.6includes elements610-650. Method600may be repeated in response to receiving a subsequent new profile request, for example, returning to block620. In some cases, method600may be performed concurrently with itself. For example, computer system100may include multiple processor cores, allowing two or more processor cores to perform method600independently from one another in response to receiving different new profile requests.

Moving toFIG.7, a flow diagram of another embodiment of a method for determining whether a new online profile is a possible fake is shown. In a similar manner as method600, method700may, in some embodiments, be performed by computer system100inFIG.1. Computer system100may, for example, include (or have access to) a non-transitory, computer-readable medium having program instructions stored thereon that are executable by computer system100to cause the operations described with reference toFIG.7. Referring collectively toFIG.1and method700inFIG.7, the method begins in block710.

At block710, method700includes training, by computer system100, contrastive loss function110to identify fraudulent images associated with a particular entity. As described above, contrastive loss function110is trained to identify potentially fraudulent images associated with a given entity. Contrastive loss function110is trained to recognize differences between similar images from different entities and to recognize similarities between different images from a same entity.

Method700also includes, at block720, receiving, by computer system100, a request to create a new account profile, the request including new profile information115with new profile image130and a new profile identifier120. When a user wants to setup a new profile in an online service, the user submits a request for a new profile. While most users may have legitimate intentions for use of this new profile, some users may have malicious intentions. For example, a malicious user may intend to defraud a business by deceiving employees of the business into believing that the fraudulent new profile is associated with the business when it is not. Accordingly, new profile process101is used to identify a new profile request that is potentially a fraudulent version of a legitimate profile.

Method700, at block730, further includes using, by computer system100, contrastive loss function110to determine image metric140indicative of a degree of similarity between new profile image130and an existing profile image135associated with a particular account. As illustrated, computer system100has access to a database that includes existing profile images135associated with a variety of existing profiles. Neural network105a, using the trained contrastive loss function110, determines if new profile image130is suspiciously similar to any of these existing profile images135. In some embodiments, vector representations (e.g., vector representation360eofFIG.3) of existing profile images135have been previously generated by neural network105a, and stored in a database accessible to computer system100. For example, the vector representations may be generated when each of existing profile images135was initially submitted as part of a respective profile request. Using previously generated vector representations may reduce a computational load of computer system100when performing the comparison of new profile image130to existing profile images135, particularly if there are a high number of existing images (e.g., hundreds of thousands or millions). Neural network105agenerates a respective image metric140for each existing profile image135used in the comparison.

At block740, method700also includes, in response to determining that the determined image metric140satisfies a threshold value, determining, by computer system100, whether a difference between new profile identifier120and an existing profile identifier125associated with the particular account satisfies a threshold identifier metric. New profile process101may compare each generated image metric140to a threshold value. In various embodiments, satisfying the threshold value may correspond to being greater than or being less than the threshold value, depending on whether a value of image metric140is higher or lower when the two compared images are too similar. For example, image metric140may be a value between 0 and 1, where a value of 0 indicates no fraudulent similarities were found between two images and a value of 1 indicates a highest probability of fraudulent similarities, or vice versa. It is noted that the threshold value may be set by a system administrator based on a desired level of detection. If for example, false positive fraudulent determinations are more acceptable than false negative determinations, then the threshold value may be set to a value that is satisfied more easily. In contrast, if false positive fraudulent determinations are to be limited, then the threshold value may be set to a value that is more difficult to satisfy.

As shown, a corresponding existing profile identifier125is determined for each of the existing profile images135in which the image metric satisfies the threshold value. Neural network105bmay be performed for each of the set of corresponding existing profile identifiers125to compare each existing profile identifier125of the set to new profile identifier120. Similar to neural network105a, neural network105bmay generate a respective identifier metric145for each comparison, which may then be compared to a threshold identifier metric. In a similar manner as for the image metric threshold value, the threshold identifier metric may be set based on a desired level of possible fraud detection.

Method700further includes, at block750, in response to determining that the threshold identifier metric is satisfied, identifying, by computer system100, new profile information115as a possible fake profile of the particular account. As illustrated, if both an identifier metric145and an image metric140associated with a same existing profile satisfy their respective threshold values, then new profile information115is identified as a potential fraudulent imitation of this existing profile. In various embodiments, the fraudulent determination may result in the new profile request being rejected. In other embodiments, the new profile request may be approved, but the profile flagged for further review by, for example, a system administrator. In some embodiments, the action taken by computer system100may depend on the values of image metric140and identifier metric145. For example, each of image metric140and identifier metric145may be compared to one or more different threshold values to estimate a probability that the new profile request is fraudulent. If both image metric140and identifier metric145provide strong indications that the new profile request is fraudulent, then the new profile request may be rejected. Otherwise, if the two metrics do not provide a strong indication, then the new profile may be approved and flagged.

It is noted that method700ofFIG.7may repeat, for example, in response to receiving another new profile request. Method700may, in such cases, return to block720in response to receiving a new profile request. In a similar manner as method600, method700may be performed concurrently with itself.

Turning toFIG.8, a flow diagram of an embodiment of a method for training a neural network that utilizes a contrastive loss function to determine if a new profile image is a potential fake of an existing profile image is illustrated. In a similar manner as methods600and700, method800may be performed by computer system100inFIG.1. For example, computer system100may include (or have access to) a non-transitory, computer-readable medium having program instructions stored thereon that are executable by computer system100to cause the operations described with reference toFIG.8. Referring collectively toFIGS.2and8, method800begins in block810.

Method800includes, at block810, training, by computer system100, contrastive loss function110to identify similarities between a plurality of anchor images associated with a variety of given entities and differing images associated with the given entities. As shown, computer system100utilizes a set of anchor images for training contrastive loss function110, which may be a triplet loss function. In other embodiments, other types of functions may be utilized, such as large margin nearest neighbor, max margin contrastive loss, multi-class N-pair loss, supervised NT-Xent loss, and information theoretic metric learning (ITML) functions. Each anchor image is compared to one or more different positive images, with contrastive loss function110receiving positive feedback when similar characteristics of the two images are identified. If contrastive loss function110fails to identify one or more similar characteristics or identifies a different characteristic as being similar, then corrections are provided to increase a likelihood of similar characteristics being identified in future comparisons. A “positive” image, as used herein, refers to an image that is associated with a same entity as the anchor image. Differences between the anchor image and positive image may include color changes, different degrees of rotation of objects within the images, different numbers of common shapes, and the like. The purpose of this portion of training is to teach contrastive loss function110to recognize elements that correspond to the anchor image even when the positive image has a number of differences from the anchor image.

At block820, method800further includes training, by computer system100, contrastive loss function110to identify differences between the anchor images and similar image associated with different entities. As a complementary step in the training of contrastive loss function110, computer system100may compare each of the anchor images to one or more similar negative images, with contrastive loss function110receiving positive feedback when differences between the two images are identified. If contrastive loss function110fails to identify one or more differences or incorrectly identifies a similar characteristic as a difference, then corrections are provided in a similar manner as described for block810. A “negative” image, as used herein, refers to an image that is associated with a different entity then the anchor image.

Method800, at block830, also includes, using values based on the training, generating, by computer system100, values for a plurality of layers of neural network105a. As illustrated, when used by new profile process101, neural network105ais used to compare a new profile image to a plurality of existing profile images to determine if the new image is intended to be used as part of a fraudulent profile. In some embodiments, neural network105ais a Siamese network, using a same set of weight values when used with two or more different image inputs. Neural network105amay include a plurality of layers (e.g., convolution layers352nand352einFIG.3), each layer including a respective set of weight values. These weight values, as shown, are generated, at least in part, based on the training performed in blocks810and820using contrastive loss function110.

Method800further includes, at block840, repeating, by computer system100, the training using images associated with business logos. The anchor, positive, and negative images used in blocks810and820may include any suitable images that can be associated with a given entity. The entities may include a variety of suitable subjects. For example, the images may include various human faces, types of animals, types of plants, various architectural elements, landmarks, art work, etc. For example, a given anchor image may be a particular image of particular person in a particular pose. Positive images may be images of the same person in a variety of different poses, wearing clothes, positioned in front of different backgrounds, and the like. Negative images may include various images of different individuals in similar poses, in similar clothes, and/or in front of similar backgrounds as the anchor image.

In block840, training steps similar to blocks810and820are repeated using images of various business logos. An anchor image of a logo of a particular business is selected and positive images may include the same logo in different colors and/or rotated in relation to the anchor image. Positive images may further include different versions of the same logo, such as different generations of a logo that has been modified over time. The negative logos may include logos of different companies that share similar characteristics as the anchor logo, such as colors, shapes, text, fonts, and the like.

At block850, method800further includes replacing, by computer system100in neural network105a, values in a particular number of layers of neural network105awith values learned during the repeated training with the business logos. As illustrated, one or more layers (e.g., convolution layers352n) of neural network105aare replaced using weight values determined during the training of block840. Replacing one or more layers with values determined using business logos may enable neural network105ato more accurately identify a potentially fraudulent image that is associated with a business entity. Business entities may be more likely targets of fraudulent profiles due to a greater potential to use the fraudulent profile for financial gain.

The method ofFIG.8, it is noted, includes elements810-850. Method800, or a portion thereof, may be repeated to improve an accuracy for correctly identifying fraudulent images. For example, results from use of neural network105amay be reviewed at various points in time. If a reviewer determines that legitimate profile images are too frequently being flagged as potential frauds, or that fraudulent profiles are being allowed at an unacceptable rate, then neural network105aand contrastive loss function110may retrained as an attempt to improve the accuracy. In such cases, improperly identified images may be used as part of additional training.

Although operations of method800are shown as occurring in a serial fashion, at least some portion of the operations may occur in a different or overlapping order. For example, operations810and820may be performed in a different order, including overlapping. It is further noted that any or all of methods600-800may be performed in an automated fashion without user input.

Referring now toFIG.9, a block diagram of an example computer system900is depicted. Computer system900may, in various embodiments, implement disclosed computer systems, such as computer system100inFIG.1and/or client devices such as described in regards toFIG.5. Computer system900includes a processor subsystem920that is coupled to a system memory940and I/O interfaces(s)960via an interconnect980(e.g., a system bus). I/O interface(s)960is coupled to one or more I/O devices970. Computer system900may be any of various types of devices, including, but not limited to, a server computer system, personal computer system, desktop computer, laptop or notebook computer, mainframe computer system, server computer system operating in a datacenter facility, tablet computer, handheld computer, smartphone, workstation, network computer, etc. Although a single computer system900is shown inFIG.9for convenience, computer system900may also be implemented as two or more computer systems operating together.

Processor subsystem920may include one or more processors or processing units. In various embodiments of computer system900, multiple instances of processor subsystem920may be coupled to interconnect980. In various embodiments, processor subsystem920(or each processor unit within920) may contain a cache or other form of on-board memory.

System memory940is usable to store program instructions executable by processor subsystem920to cause computer system900perform various operations described herein. System memory940may be implemented using different physical, non-transitory memory media, such as hard disk storage, floppy disk storage, removable disk storage, flash memory, random access memory (RAM-SRAM, EDO RAM, SDRAM, DDR SDRAM, LPDDR SDRAM, etc.), read-only memory (PROM, EEPROM, etc.), and so on. Memory in computer system900is not limited to primary storage such as system memory940. Rather, computer system900may also include other forms of storage such as cache memory in processor subsystem920and secondary storage on I/O devices970(e.g., a hard drive, storage array, etc.). In some embodiments, these other forms of storage may also store program instructions executable by processor subsystem920.

I/O interfaces960may be any of various types of interfaces configured to couple to and communicate with other devices, according to various embodiments. In one embodiment, I/O interface960is a bridge chip (e.g., Southbridge) from a front-side to one or more back-side buses. I/O interfaces960may be coupled to one or more I/O devices970via one or more corresponding buses or other interfaces. Examples of I/O devices970include storage devices (hard drive, optical drive, removable flash drive, storage array, SAN, or their associated controller), network interface devices (e.g., to a local or wide-area network), or other devices (e.g., graphics, user interface devices, etc.). In one embodiment, I/O devices970includes a network interface device (e.g., configured to communicate over WiFi, Bluetooth, Ethernet, etc.), and computer system900is coupled to a network via the network interface device.