3 ms·

I'm kind of wondering how this will (or can) fit from a deployment set of concerns (cross-silos, compliance & audit, handling CDNs, etc.) into large-scale envir

I'm kind of wondering how this will (or can) fit from a deployment set of concerns (cross-silos, compliance & audit, handling CDNs, etc.) into large-scale environments like eBay or Paypal and whether the fraud models are appropriate for most that do business online. As a crude example, I might care about fraud in blog spam from SEO blackhats, which is not the same as credit card fraud patterns but both translate into real dollar loss for some businesses. Granted, the founders are ex-Googlers so perhaps this was done yesterday, but the way they present themselves and with their current customer list they make it look like it's mostly for direct financial transaction based sites. I'm suspecting things are overly simplified but I find it pretty hard to believe that inserting some Javascript snippets into a page could actually help when fraudsters could eventually start bypassing that JS (see: web scrapers). The API docs seem awful naive in number of possible cases. With that said, congratulations on the launch, I know this is not an easy problem to handle and I think you actually have fulfilled a major goal of ease-of-use for online fraud detection systems. The only comparable systems I've heard of are ridiculously expensive beasts of enterprise software or custom-grown for the company with incredible barriers to entry. Best of luck to you guys.

brandonb 14y ago
Hey Devon -- thanks for the thoughtful comments! Most of our customers do use Sift Science for financial fraud, but because it's a machine learning system, you can train it to detect other types of bad behavior like spam. We have customers in production using us to detect spam, fake inventory, and duplicate accounts. If you have a use-case that doesn't quite seem to fit, let me know and we can figure out how to train our system to recognize that type of behavior: brandon@siftscience.com. If a fraudster bypasses the JS, we still have REST events such as transactions (or any other custom event sent from the backend). Seeing a user who has REST events but no Javascript events is a suspicious signal in itself, so fraudsters can't circumvent the system by just turning off JS. FWIW, we're on some pretty major sites that we can't announce, so we've gone through a bunch of compliance, audit, security, and other concerns already.
- raverbashing 14y ago
  Can you explain better what exactly you do? It seems that you use ML to pinpoint fraud (or better, undesired behaviour) in $WEBSITE. So that could be fraud detection because they login from one country, ship to another and buy a certain combination of items. Or that could be "spam fighting" because they create an account with X and Y characteristics and post similar things. Am I right in my perception? (and you could use this not only for 'bad behaviour' but for good behaviour as well)
  - brandonb 14y ago
    You're right on. In theory, you could train our system to recognize good behavior if you sent us enough $label events, but most of the patterns we have today are really optimized around detecting bad behavior.
    - sdepablos 14y ago
      Could you develop a little more how duplicate accounts could be detected?

brandonb 14y ago

Hey Devon -- thanks for the thoughtful comments! Most of our customers do use Sift Science for financial fraud, but because it's a machine learning system, you can train it to detect other types of bad behavior like spam. We have customers in production using us to detect spam, fake inventory, and duplicate accounts. If you have a use-case that doesn't quite seem to fit, let me know and we can figure out how to train our system to recognize that type of behavior: brandon@siftscience.com. If a fraudster bypasses the JS, we still have REST events such as transactions (or any other custom event sent from the backend). Seeing a user who has REST events but no Javascript events is a suspicious signal in itself, so fraudsters can't circumvent the system by just turning off JS. FWIW, we're on some pretty major sites that we can't announce, so we've gone through a bunch of compliance, audit, security, and other concerns already.

raverbashing 14y ago
Can you explain better what exactly you do? It seems that you use ML to pinpoint fraud (or better, undesired behaviour) in $WEBSITE. So that could be fraud detection because they login from one country, ship to another and buy a certain combination of items. Or that could be "spam fighting" because they create an account with X and Y characteristics and post similar things. Am I right in my perception? (and you could use this not only for 'bad behaviour' but for good behaviour as well)
- brandonb 14y ago
  You're right on. In theory, you could train our system to recognize good behavior if you sent us enough $label events, but most of the patterns we have today are really optimized around detecting bad behavior.
  - sdepablos 14y ago
    Could you develop a little more how duplicate accounts could be detected?