Katkat
Back

Fake Accounts [AE]

MetaData Scientist · Onsite
MediumData ScientistOnsiteStatistics & Math

Last updated

This question tests your ability to apply Bayes' Theorem in a low-prevalence classification scenario and your ability to engineer robust signals for detecting anomalous user behavior.

The Problem

You are a Data Scientist at a large social media platform. You are tasked with evaluating a new detection model designed to flag 'fake' accounts. You are given the following data points:

  • The platform has 1 billion active users.
  • Historical audits suggest the prevalence of fake accounts is 0.1% (1 in 1,000).
  • Your current classifier has a True Positive Rate (Sensitivity) of 95%.
  • The False Positive Rate (1 - Specificity) is 1%.

Part 1: Probability Analysis

  1. If the model flags an account as 'fake', what is the probability that the account is actually fake? (The Positive Predictive Value).
  2. How does the PPV change if you improve the model to have a False Positive Rate of 0.1%?

Part 2: Feature Engineering

Given the low prevalence of fake accounts, a simple threshold-based classifier often results in too many false positives to be useful for manual review. Propose four distinct types of features—categorized by behavioral, graph-based, device-based, and account metadata—that could help improve the precision of your model. Explain why these features are effective at separating fake accounts from legitimate ones.

Hints

Hint 1

Use Bayes' Theorem: P(Fake | Flagged) = [P(Flagged | Fake) * P(Fake)] / [P(Flagged | Fake) * P(Fake) + P(Flagged | Real) * P(Real)].

Hint 2

Remember that P(Real) is 1 minus the prevalence (0.999 in this case).

Hint 3

For feature engineering, think about how an automated bot script differs from a human in terms of network topology and interaction frequency.

Follow-up questions

  • If we implement this model and the PPV is still too low for human reviewers, what sampling strategies would you use to prioritize which accounts get reviewed?
  • How would you measure the cost of a False Positive versus a False Negative in this specific domain?
  • How might an attacker attempt to 'poison' these features to bypass your detection model?