IDENTIFYING COORDINATED MALICIOUS ACTIVITIES USING SEQUENCES OF REQUESTS

Embodiments of the disclosed technologies create a term frequency-inverse document frequency (tf-idf) model of interactions of user accounts with an online system, and, using the tf-idf model, identify a subset of the user accounts as being involved in a malicious use of the online system. The tf-idf model is created by, for a user account, storing a sequence of requests received by the online system from the user account over a time interval as a document, where a request includes a digital communication from the user account to the online system, and generating a feature embedding for the sequence of requests, where the feature embedding is based on a relationship between a frequency of occurrence of a request in the document and a number of documents that include the request.