Evolution: From Email Strings to Account Behaviour
The email classifier reads a single artefact — the address string. Its natural next generation reads what an account does: a behavioural model that scores each account from the signals it emits across its early lifecycle — from signup, to first visit, to first product action, and beyond. Learn the patterns that separate automated abuse from genuine users, applied to behaviour instead of text.
The behavioural model is deliberately small in production and draws from a much larger catalogue of candidate signals. Both are listed below, described generically.
Production Feature Set (Example)
The signals the live behavioural model scores on today:
- Payment intent — genuine paid customer vs. free/trial entry
- Signup method — the registration channel used
- Time to first visit — how long after signup the account first returns
- Returned-after-signup flag — whether it ever came back at all
- Shared-device cluster size — how many accounts share the account's device
- Single-operator band flag — device cluster in the mid-range typical of one operator running many accounts
- Time to first product action — how quickly the account starts using the product
- Product-activity flag — whether the account used the product at all
- Data-extraction flag — any export / bulk-pull activity
- Extraction-to-usage ratio — how much it pulls relative to normal use ("harvest without creating")
Future Enhancements
Potential improvements:
- Incorporate behavioral features (registration velocity, IP reputation, device fingerprinting)
- Implement online learning to adapt to evolving bot patterns without full retraining
- Add explainability layer to surface which features triggered high-risk scores
- Expand to other authentication vectors beyond email (username patterns, etc.)