Do you really need ML to spot this? It seems like looking for the same account logged in from multiple locations at the same time would give you 90% of the results with 1% of the work.
you are speaking in common sense.
i dont think you need an AI or an ML.
ihave a hunch this is just a scarecrow to chase off the least technical offenders.
sharing a password is easy to spot. mirroring the service is another matter entirely, legally as well as practically.
but if you use the analog hole and restream, then the passwd stays local, the restream can be made available to a remote guest accessing your LAN.