检测多账户用户的方法
我正在开发一款手机应用程序，该应用程序涉及用户获取资金并将其兑现到他们的 PayPal/银行帐户/等。在这种情况下，安全显然是一个重要问题。现在我正在构建系统来检测创建多个帐户的用户。攻击者经常尝试创建许多帐户以通过脚本滥用系统。如果我们能够检测到链接帐户，那么当我们发现攻击时，我们可以禁止所有相关用户。
到目前为止，我已经通过查找识别数据并在帐户之间进行匹配来检测多帐户用户。例如，如果两个帐户使用相同的 android deviceId 登录，系统将假定它们都是由同一个人操作的。
目前，我们捕获并匹配以下内容：
- 电子邮件地址和基本电子邮件的变体
- 设备标识符（androidId/ios 设备令牌）
- 已验证的电话号码
- 贝宝/现金帐户信息
我捕获 IP 地址，但看起来许多用户最终可能会获得重叠的 IP因为他们使用相同的 VPN 服务。有些还具有难以检测的自托管 VPN。我们有一些技巧来检测人们何时使用 VPN，并且可以考虑到这一点，但如果不引入统计猜测，IP 似乎很难使用（例如，如果两个用户共享 5 个 IP，他们可能会链接）。有什么方法可以让它们更有用或获得更好的数据吗？
我们面临的一些攻击者/诈骗相对复杂。他们拥有大量基于云的模拟器和使用实体电话雇用的人员。因此，我认为涉及会话/cookie 的方法不太可能有效。
是否有其他方法用于检测/打击多帐户用户？我还可以访问任何其他身份信息吗？
I'm working on a phone app that involves users acquiring money and cashing out to their PayPal/bank account/etc. In that context, security is obviously an important concern. Right now I'm building systems to detect users creating multiple accounts. Attackers often try to create many accounts to abuse the system via scripts. If we can detect linked accounts, then we can ban all related users when we find an attack.
So far, I've approached detecting multi-account users by looking for identifying data and matching that between accounts. For example, if two accounts sign in using the same android deviceId, the system will assume they're both operated by the same person.
Currently we capture and match on:
- email addresses and variations on base emails
- device identifiers (androidId/ios device token)
- verified phone number
- paypal/cashout account info
I capture IP addresses, but it looks like many users end up with overlapping IPs eventually, likely because they're using the same VPN services. Some also have self-hosted VPNs which are difficult to detect. We have tricks to detect when people are on VPNs, and could take that into account, but it seems like IPs are difficult to use without introducing statistical guessing (e.g. if two users share 5 IPs they're probably linked). Is there any way to make them more useful or get better data?
Some of the attackers/scams that we face are relatively sophisticated. They have pools of cloud-based emulators and groups of people hired with physical phones. For that reason I think methods involving sessions/cookies are unlikely to be effective.
Are there any other methods used to detect/combat multi-account users? Is there any other identifying info I can get access to?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论