We live in a digital world where fraud has become a common experience. Perhaps you've been a victim of credit card fraud; if you bank with a sophisticated institution, you might have been notified before the fraud even struck. Hyperscalers face fraud persistently and must protect their legitimate customers against it. Here we discuss the nature of fraud in the cloud business and ways to deal with the challenge.
Fraud Types
Payments fraud
The threat actor has access to the victim's payment instrument. A compromised card can be used to purchase cloud resources. When the victim realizes the fraud, she works with the cloud provider to revert the charges and reaches out to the card issuer to block the card. At that point, the bleeding stops.
Accounts fraud
Account fraud is more sinister — the threat actor has access to a legitimate user's account. The fraudster can create resources on the same account as the valid user, so only part of the usage is fraudulent. Even when we spot it, it's hard to identify the right set of resources to block. Once a bad behavior is banned, the fraudster can restart the fraud another way. The victim may be deeply involved in mitigation, raising cost for both the user and the provider.
Catching Fraud
A common way to detect fraud is velocity analysis. A legitimate user has patterns of transactions — she creates a certain number of resources, say virtual machines, in a given duration. Call this operation velocity. We can extend the idea to count the regions where operations occur — region velocity. In both cases we have a notion of "normal" behavior; when the user deviates from it, we can suspect fraud.
Metrics
Let's review some desirable attributes of the detection mechanism by defining metrics.
Accuracy
Industry practice is to measure precision and recall. These pull in opposite directions; if the business cares about one over the other, we can tune the system accordingly.
Precision
The percentage of fraudulent detections across all detections. High precision catches the fraudster without impacting legitimate usage.
Recall
The percentage of fraudulent detections across all frauds. High recall means we catch most of the fraud in the system.
Transparency
We are answerable to both the customer and the business. Capturing the reason behind a detection in a simple format is crucial to building trust and improving the system incrementally.
Impact
The business has to spend its energy on the most important tasks, so we measure the impact of each fraud to prioritize. Converting impact into a dollar amount lets us measure revenue lost to fraud and set a goal for coming cycles — for example, keeping fraud below 1% of revenue. That assumes fraud scales linearly with revenue growth.