Data describing broadband internet usage is collected from a user equipment device associated with each respective user account. The data are then input into a machine learning model that is trained on broadband internet usage data of a plurality of user accounts in a single geographic area. An n-dimensional metric for each user account is then obtained as output from the machine learning model. Using the n-dimensional metric, at least one candidate user account suspected of being engaged in broadband internet access sharing is identified, and a list of candidate user accounts is generated.