Scalping Anomaly Detection Based on Mobile Internet Traffic Data

With the development of Internet and E-commerce, scalping phenomenon becomes more common and severe. Because of the giant profit, some software means such as scripts and batching-operation are utilized by the profiteers, to scalp tickets or discount coupons from retailers and sell to the buyers. So, an effective way to detect scalping on Internet is important and necessary for online retailers. In this paper, we propose a new integrated method called SADM (Scalping Anomaly Detection Method) to detect the special abnormal behavior, scalping. We collect mobile traffic data from ISPs (Internet Service Providers) and process them to the NFP data (Network Fingerprint data), which records detailed activities on mobile Internet created by users' cell phones. After that, SADM constructs the powerful feature set by the means of feature engineering consisting of feature extraction and feature selection. We combine statistic method and subspace method RPCA-ADMM (Robust PCA-Alternating Direction Method of Multipliers) for a more robust feature set. For anomaly detection models, clustering methods are used to produce the final scalping blacklist. The experiment results show that our SADM method is useful for detecting the special scalping behavior generated by malware.