Systems, methods, and non-transitory computer-readable media can acquire historical data including a plurality of features associated with known legitimate activities and with known illegitimate activities. A machine learning technique can be applied to the historical data to gain information about the plurality of features associated with the known legitimate activities and with the known illegitimate activities. A decision tree can be generated based on at least a portion of the information about the plurality of features. A node in the decision tree that satisfies specified precision criteria can be identified. A rule can be created based on the node. One or more illegitimate activities can be identified based on the rule.