Evolution: From Email Strings to Account Behaviour
The email classifier reads a single artefact — the address string. Its natural next generation reads what an account does: a behavioural model that scores each account from the signals it emits across its early lifecycle — from signup, to first visit, to first product action, and beyond. Same core idea (learn the patterns that separate automated abuse from genuine users), applied to behaviour instead of text.
The behavioural model is deliberately small in production and draws from a much larger catalogue of candidate signals. Both are listed below, described generically.
Production Feature Set (Current)
The signals the live behavioural model scores on today:
- Payment intent — genuine paid customer vs. free/trial entry
- Signup method — the acquisition / registration channel used
- Time to first visit — how long after signup the account first returns
- Returned-after-signup flag — whether it ever came back at all
- Shared-device cluster size — how many accounts share the account's device
- Single-operator band flag — device cluster in the mid-range typical of one operator running many accounts
- Time to first product action — how quickly the account starts using the product
- Product-activity flag — whether the account used the product at all
- Data-extraction flag — any export / bulk-pull activity
- Extraction-to-usage ratio — how much it pulls relative to normal use ("harvest without creating")
Full Feature Catalogue (Candidate Signals)
The broader signal space explored during research, grouped by lifecycle stage. Only the subset above is in production; the rest are candidates for future iterations.
Signup (time zero)
- Payment intent (paid vs. free/trial)
- Acquisition channel / signup source
- Marketing channel
- Selected plan tier
- Email domain age
- Email reputation score (third-party)
- Email-string statistics — entropy, length, digit runs, look-alike top-level domains
First visit & device
- Time from signup to first visit
- Returned-after-signup flag
- All-time shared-device cluster size
- Single-operator band flag (mid-range cluster)
- Large-cluster flag (shared network / proxy noise)
- Same-day device fan-out — distinct accounts seen on one device in a single day
- Bot-challenge / CAPTCHA session-risk score (third-party)
- Device-fingerprint cross-account clustering (third-party)
First product action
- Time from signup to first product action
- Product-action flag
- Time from first visit to first action
- Delayed-activation band flag
- Instant-action flag (near-zero delay)
Early behaviour
- Active span (first to last action)
- Distinct actions / items
- Distinct categories used
- Early action volume
- Night-time activity fraction
- Distinct locales
- Average response time
- Action-uniqueness ratio (distinct ÷ total)
- Distinct user-agents
- Actions per active hour
- Request-text sequence score (character-pattern model)
Extraction
- Time to first export
- Export-reached flag
- Export-to-activity ratio
Monetisation & order
- Saw-paywall flag
- Time to paywall
- Purchased flag
- Time to purchase
- Shared payment-card fan-out (accounts per card)
- Invoice discount amount
- Third-party payment-fraud vendor score and reason code
Cross-stage / composite
- Unsupervised anomaly score (isolation-forest style)
- Conjunction rule — delayed activation × engaged × single-operator cluster
Technical Skills Demonstrated
- End-to-end ML pipeline development (data collection, feature engineering, training, deployment)
- Production ML operationalization and real-time inference systems
- Custom tooling development for security automation
- Security data analysis and threat pattern recognition
- Performance optimization for low-latency security decisions
Key Takeaway: This project demonstrates ability to move beyond proof-of-concept ML models to production-grade security systems. The challenge wasn't just building an accurate model—it was engineering the infrastructure to deploy it reliably at scale in a security-critical authentication flow.
Future Enhancements
Potential improvements identified during development:
- Incorporate behavioral features (registration velocity, IP reputation, device fingerprinting)
- Implement online learning to adapt to evolving bot patterns without full retraining
- Add explainability layer to surface which features triggered high-risk scores
- Expand to other authentication vectors beyond email (username patterns, etc.)