123 lines
3.9 KiB
Markdown
123 lines
3.9 KiB
Markdown
# Abusive Account Detection
|
|
|
|
# Helpful bunnylol
|
|
|||
|
|
-|-
|
|
aad | aad wiki pages
|
|
go aadata | abusive accounts data
|
|
fblearner | model trainings are listed here.
|
|
orb | inmemory DB
|
|
|
|
|
|
# Data
|
|
|||
|
|
-|-
|
|
ig_signup_sigma_features |
|
|
ig_challenge_.... | accounts that were challenged
|
|
|
|
|
|
# proxy metrics
|
|
|||
|
|
-|-
|
|
enrolments | tested users (UFAC)
|
|
clear | the lower better (UFAC cleared)
|
|
|
|
# human labeling
|
|
|||
|
|
-|-
|
|
holdout | signed users, after 12days we label them by humans -> empty, bad, good (bennain) ~5K avccounts
|
|
|
|
false negarive
|
|
|
|
|
|
|
|
MAU prevalense
|
|
MIMA prevalence
|
|
|
|
# Folders
|
|
|
|
- ## Misc
|
|
- `fbcode/dataswarm-pipeline/tasks/si/fake_accounts`
|
|
- `fbcode/dper3/dper3_models/si/olf`
|
|
- `www/flib/intern/scripts/sigma/clssifiers/olf`
|
|
|
|
- `configerator/source/sigma/online_classifiers/runtimes`
|
|
- all our classifiers are here
|
|
- `configerator/source/si/fake_accounts`
|
|
- defines active classifiers and the defaults
|
|
|
|
- `si_sigma/Lib/FakeAccounts`
|
|
- sigma rules for the fake accounts, namely new_user_registration is processed here
|
|
|
|
- ## Models
|
|
- `fbcode/fblearner/flow/projects/fluent2/domains/si/aad_surfaces`
|
|
- fblearner models
|
|
|
|
- ## Sentry
|
|
- `configerator/source/si/sentry/prod/<namespace>/<category>.cconf`
|
|
- configuration of sentries.
|
|
- e.g. `namespcae=facebook, category=new_user_registration` defines what is passed to sigma rules. This is used for FB. IG has different config perhaps.
|
|
- `configerator/source/si/sentry/si_namespaces.thrift`
|
|
- sentry namespaces
|
|
- `www/flib/si/sentry/category/SentryCategory.php`
|
|
- existing categories
|
|
- `www/flib/si/sentry/preparable/filters/sigma/SigmaFilter.php`
|
|
- Sigma filter that can be found in sentry configuarations.
|
|
- bunnylol orb
|
|
- this can be used to query sentry logs
|
|
|
|
- ## Sigma
|
|
- `si_sigma/Endpoint/Sentry/SentryFollowProfile.hs`
|
|
- `si_sigma/Contexts/Sentry/SentryFollowProfile.hs`
|
|
- scuba sigma_profiling
|
|
- to profile
|
|
|
|
- ## QE
|
|
- `configerator/qe2_diff/newExperiments/vahagnk_fast_tiger_clone.txt`
|
|
|
|
- ## Reg Attack
|
|
- `configerator/source/si/reg_attacks/surface_definitions.cinc`
|
|
- This here we define surfaces.
|
|
- `configerator/source/si/reg_attacks/attack_definitions/`
|
|
- Attack definitions.
|
|
- `source/si/reg_attacks/reg_attacks.thrift`
|
|
- FieldTypes are here.
|
|
|
|
- ## Piplines
|
|
- [dataswarm piplines](https://www.internalfb.com/code/fbsource/fbcode/dataswarm-pipelines/tasks/si/fake_accounts/)
|
|
- [online_reg](https://www.internalfb.com/code/fbsource/fbcode/dataswarm-pipelines/tasks/si/fake_accounts/online_reg/)
|
|
|
|
- ## OLF
|
|
- phps OLFAdminV2 status --classifier reg_enthusiastic_impala
|
|
- [firefighting](https://www.internalfb.com/intern/wiki/OLF/Firefighting/)
|
|
|
|
|
|
|
|
# Model Training workflows
|
|
|
|
- Train the model
|
|
```
|
|
flow-cli canary si.olf.ig_signup.train@olf --run-as-secure-group=team_abusive_accounts_detection --entitlement si --parameters-file configs/ig_signup_andromeda_offline.json
|
|
```
|
|
to monitor progress use [bunnylol fblearner](https://www.internalfb.com/intern/fblearner).
|
|
|
|
- Publish model
|
|
```
|
|
aimps publish-model --manifold --oncall aad_surfaces --is-dper-model -d service_sharded <model_id>_<snapshot_id>
|
|
```
|
|
to monitor progress use [bunnylol predictor](https://www.internalfb.com/intern/predictor).
|
|
|
|
- Register model
|
|
```
|
|
phps --www-root /var/www OLFAdminV2 training --action=register_model --classifier-name <model_name> --problem IG_FA_ANDROMEDA --surface IG_SIGNUP --model-id <model_id> --threshold 0.5
|
|
```
|
|
model name is ig_signup_colorful_animal
|
|
|
|
- [Compare how model fires.](https://fburl.com/scuba/ig_signup_sigma_features/svhenbuq)
|
|
- Create experiment to compare enrolled vs cleared. [bunnylol qe2](https://www.internalfb.com/intern/experiments)
|
|
|
|
# Team identifiers
|
|
- fawg - this is abusive account detection group for diffs
|
|
|
|
# Tables
|