Navigating the Unknowns: Fraud Mitigation for Netflix Live Events

Navigating the Unknowns: Fraud Mitigation for Netflix Live Events

Speakers: Aditi Gupta, Yue Wang

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: Watch the full talk

Reading time: ~7 minutes

TL;DR

When Netflix began streaming live events in 2023, its Trust and Safety team faced a fraud problem without historical precedent: no baseline traffic patterns, conflicting priorities between user experience and attack prevention, and adversaries who knew exactly when to strike. Aditi Gupta and Yue Wang describe the threat types they encountered — content piracy, account takeover, and DDoS — and the before/during/after operational framework Netflix built to defend live events it had never seen before.

Introduction

Netflix entered live streaming in 2023, and 2024 was a breakout year: NFL games on Christmas Day, the Jake Paul vs. Mike Tyson boxing match, comedy specials, and more. These events drew massive audiences — and the attention of a different kind of viewer. Fraudsters saw an opportunity. Content pirates saw inventory worth stealing. DDoS operators saw precise attack windows with showtime publicly listed on Netflix's own platform.

The core challenge Aditi Gupta and Yue Wang present is not technical sophistication so much as fundamental uncertainty. Fraud detection systems are built on baselines: this is what normal looks like; a deviation is suspicious. Live events destroyed that assumption. Netflix had never streamed live before. There was no baseline. Traffic during a live event looks erratic by design — spikes at the start, surges during key moments, and wildly different patterns depending on whether the event is a boxing match or a comedy special. Building a fraud detection system for something you have never seen, while protecting a service that cannot tolerate false positives, is the central engineering and operations problem the talk addresses.

▶ Watch: Why live streaming attracted malicious actors (02:00)

The Threat Landscape: Three Attack Categories

Using a GenAI threat modeling prompt as an opening device, Gupta walks through the top fraud risks Netflix anticipated — and observed — during live events:

Content piracy was immediate and visible. During the Paul-Tyson fight, a screenshot captured more than 500,000 concurrent viewers on a single piracy website. Illegal streams appeared across cheap or suspicious domains and spread through major social media platforms. Live content is especially attractive to pirates: time-sensitive events drive urgency, and a pirated stream of a boxing match has full value only during the fight itself.

Account takeover follows a predictable spike pattern: credential stuffing and account hijacking increase notably in the days before a high-profile live event, as fraudsters stock up on compromised accounts to watch — or resell access to — premium content. Netflix's public earnings calls, which discuss upcoming live events, effectively serve as advance notice to the attacker community.

DDoS attacks present the most operationally dangerous scenario. Because all Netflix live showtimes are public, attackers can schedule attacks with precision. Live streaming competitors have experienced service outages from DDoS during live events, validating the threat. For Netflix, a DDoS during a live event is not just a technical failure — it steals a moment that users cannot get back.

▶ Watch: Content piracy, account takeover, and DDoS in practice (12:01)

Four Challenges That Made Live Events Different

Gupta identifies four structural challenges that distinguished live event fraud mitigation from Netflix's existing streaming fraud work:

No established baseline. Standard anomaly detection assumes a known-normal state and flags deviations. Live events have inherently erratic traffic — early spikes, surge moments, and massive variation between events by scale, duration, and audience demographics. Distinguishing a legitimate traffic surge from a DDoS attack required building new analytical frameworks from scratch.

Conflicting priorities. Product teams demanded minimal false positives — don't block legitimate users. Security teams demanded aggressive blocking to protect service availability. These goals pull directly against each other. Netflix resolved the tension by making user experience the explicit top priority, which forced the fraud team to optimize for precision (true positives) rather than recall.

Unexpected traffic volume. Traffic forecasting for major live events proved difficult — the NFL Christmas Day estimates were notably off. Fraud mitigation services that are sized for normal streaming traffic can become the bottleneck under live event scale, particularly when an attack amplifies an already massive traffic spike.

New attack tactics. Generative AI has lowered the barrier to launching sophisticated attacks. The team had to prepare for attack patterns they had never seen, not just optimized versions of known threats.

▶ Watch: The four challenges unique to live event fraud (08:00)

How Netflix Prepared: Distribution Analysis, Proactive Testing, and Custom Configs

Yue Wang takes the second half of the talk, focusing on the specific techniques Netflix used before, during, and after live events.

Distribution analysis was the primary tool for solving the baseline problem. Rather than looking for absolute traffic thresholds, Netflix compared behavioral distributions between known fraudulent traffic and legitimate users. This approach surfaced anomalies in how traffic behaved — not just how much of it there was. One concrete example: CGNAT (Carrier-Grade NAT) IPs, where many users share a single public IP address, increase naturally during live events as audiences watch from public venues like Starbucks or sports bars. A naive IP-rate-limiting rule would flag these users as attackers. Distribution analysis helped Netflix characterize CGNAT behavior and build configurations that protected these users instead.

Proactive testing built confidence in the system before it faced real attacks. Netflix ran controlled tests that deliberately stressed fraud mitigation services, failed, adapted, and iterated. This process validated service capacity, exposed gaps in detection logic, and gave the on-call team experience with real incident workflows before the actual events.

Customized live configurations were purpose-built for each event type. Fraud controls behave differently during a live event than during ordinary streaming, and differently again for a boxing match versus an NFL game versus a comedy special. This adaptive configuration layer — separate fraud control parameters for live vs. non-live contexts — was a core architectural decision.

▶ Watch: Distribution analysis, CGNAT handling, and proactive testing (16:01)

The Live Day Operations Model

Wang describes the on-call experience for a major live event (including admitting she spent the Paul-Tyson fight not in a cinematic mission control room but in her apartment watching dashboards). Two activities defined the live day: monitoring and response.

Netflix built dedicated dashboards for real-time anomaly detection during events, with a clear on-call process for escalation. For novel attack patterns — a DDoS variant never observed before — the team maintained emergency threshold controls capable of "stopping the bleeding" quickly without requiring a full engineering response cycle. The response levers were pre-built and accessible to on-call staff, minimizing human response time for scenarios where seconds matter.

The Feedback Loop: Post-Event Analysis

The third phase of Netflix's framework is the post-event feedback loop. After each event, the team:

1. Conducted post-event analysis to review what went well and what did not
2. Cross-validated assumptions made before and during the event — particularly around CGNAT analysis
3. Documented new attack patterns and techniques observed during the event
4. Reviewed the on-call monitoring process itself
5. Incorporated findings back into fraud prevention configurations, false positive/negative tuning, and future event preparation

The feedback loop transforms each live event into training data for the next one. Over time, assumptions can be validated or discarded, and the system's baselines — originally absent entirely — become increasingly accurate.

▶ Watch: Post-event feedback loop and improving for future events (22:01)

Notable Quotes

"Live events are designed to engage users in unique time-sensitive experiences. If you have a scaled attack during a live event, that can disrupt this user experience and steal that moment of joy." — Aditi Gupta at 06:00

"To me, it's not a fight between Paul and Tyson. It's kind of like a fight between Netflix versus the bad actors." — Yue Wang at 18:01

"Even if there are unknowns, there are still similarities with what you already have. Focus on understanding what was similar and what was different — and sometimes the similarities can take you a long way, even if you get hit by something unknown." — Aditi Gupta at 32:02

Key Takeaways

• Live events have no baseline — build one before you need it. Standard anomaly detection requires a known-normal state. For new event types, invest in pre-event analysis and proactive testing to construct that baseline before you're defending a live production system.
• Distribution analysis distinguishes fraud from legitimate traffic spikes. Absolute thresholds fail for live events; comparing behavioral distributions between fraud and legitimate traffic surfaces anomalies that volume-only metrics miss.
• Adaptive fraud controls matter more than static rules. Fraud during a live event looks different from fraud during ordinary streaming. Separate, event-specific configurations allow more precise control without over-blocking legitimate users.
• Pre-build your response levers. Manual intervention under attack at scale is too slow. Emergency threshold controls and simplified response mechanisms need to be ready before the event begins, not built during the incident.
• The feedback loop converts each event into a better defense for the next. Post-event analysis, assumption validation, and configuration updates compound over time — the team that was operating blind on the first live event can eventually operate with genuine foresight.