notes/Facebook/aad.md

Abusive Account Detection

Helpful bunnylol

aad	aad wiki pages
go aadata	abusive accounts data
fblearner	model trainings are listed here.
orb	inmemory DB

Data

ig_signup_sigma_features
ig_challenge_....	accounts that were challenged

proxy metrics

enrolments	tested users (UFAC)
clear	the lower better (UFAC cleared)

human labeling

holdout	signed users, after 12days we label them by humans -> empty, bad, good (bennain) ~5K avccounts

false negarive

MAU prevalense MIMA prevalence

Folders

• Misc

  • fbcode/dataswarm-pipeline/tasks/si/fake_accounts

  • fbcode/dper3/dper3_models/si/olf

  • www/flib/intern/scripts/sigma/clssifiers/olf

  • configerator/source/sigma/online_classifiers/runtimes

    • all our classifiers are here

  • configerator/source/si/fake_accounts

    • defines active classifiers and the defaults

  • si_sigma/Lib/FakeAccounts

    • sigma rules for the fake accounts, namely new_user_registration is processed here

• Models

  • fbcode/fblearner/flow/projects/fluent2/domains/si/aad_surfaces
    • fblearner models

• Sentry

  • configerator/source/si/sentry/prod/<namespace>/<category>.cconf
    • configuration of sentries.
    • e.g. namespcae=facebook, category=new_user_registration defines what is passed to sigma rules. This is used for FB. IG has different config perhaps.
  • configerator/source/si/sentry/si_namespaces.thrift
    • sentry namespaces
  • www/flib/si/sentry/category/SentryCategory.php
    • existing categories
  • www/flib/si/sentry/preparable/filters/sigma/SigmaFilter.php
    • Sigma filter that can be found in sentry configuarations.
  • bunnylol orb
    • this can be used to query sentry logs

• Sigma

  • si_sigma/Endpoint/Sentry/SentryFollowProfile.hs
  • si_sigma/Contexts/Sentry/SentryFollowProfile.hs
  • scuba sigma_profiling
    • to profile

• QE

  • configerator/qe2_diff/newExperiments/vahagnk_fast_tiger_clone.txt

• Reg Attack

  • configerator/source/si/reg_attacks/surface_definitions.cinc
    • This here we define surfaces.
  • configerator/source/si/reg_attacks/attack_definitions/
    • Attack definitions.
  • source/si/reg_attacks/reg_attacks.thrift
    • FieldTypes are here.

• Piplines

  • dataswarm piplines
    • online_reg

• OLF

  • phps OLFAdminV2 status --classifier reg_enthusiastic_impala
  • firefighting

Model Training workflows

• Train the model

flow-cli canary si.olf.ig_signup.train@olf --run-as-secure-group=team_abusive_accounts_detection --entitlement si --parameters-file configs/ig_signup_andromeda_offline.json

to monitor progress use bunnylol fblearner.

• Publish model

aimps publish-model --manifold --oncall aad_surfaces --is-dper-model -d service_sharded <model_id>_<snapshot_id>

to monitor progress use bunnylol predictor.

• Register model

phps --www-root /var/www OLFAdminV2 training --action=register_model --classifier-name <model_name> --problem IG_FA_ANDROMEDA --surface IG_SIGNUP --model-id <model_id> --threshold 0.5

model name is ig_signup_colorful_animal

• Compare how model fires.
• Create experiment to compare enrolled vs cleared. bunnylol qe2

Team identifiers

• fawg - this is abusive account detection group for diffs

Tables