×

User behavior analyzer

  • US 10,193,772 B1
  • Filed: 12/19/2016
  • Issued: 01/29/2019
  • Est. Priority Date: 10/28/2011
  • Status: Active Grant
First Claim
Patent Images

1. An anomaly detection computing system, the system comprising:

  • an account data store configured to store at least one state machine graph, wherein individual state machine graphs are generated based, at least in part, on recorded sequences of electronic messages received from client computing devices during participation in an interactive video game application, the state machine graph defining a sequence of states and transitions between each state, wherein each state is representative of a type of electronic message;

    a server computing system including one or more processors and in electronic communication with a data store, the server computing system configured to execute the interactive video game application and communicatively couple with a plurality of client computing devices, the server computing system comprises computer readable instructions that when executed configure the server computing system to;

    receive a plurality of electronic messages from a plurality of client computing devices communicatively coupled to the server during runtime execution of the interactive video game application, wherein each electronic message of the plurality of electronic messages is a defined type of message communicated by a client computing device during participation in the interactive video game application;

    group the plurality of electronic messages into one or more sets of electronic messages;

    construct a first sequence of electronic messages for a first set of electronic messages of the one or more sets of electronic messages, wherein the first set of electronic messages are received from a first client computing device;

    compare the first sequence of electronic messages to a sequence of states of a state machine graph of the one or more state machine graphs, wherein each state machine graph is configured to model a different type of client behavior within the interactive video game application;

    generate an anomaly score based at least in part on the differences between characteristics of the first sequence and characteristics of the defined sequence of the state machine graph; and

    in response to determination that the anomaly score exceeds an anomaly detection threshold, generate an output designating the constructed sequence as abnormal relative to the defined client behavior.

View all claims
  • 2 Assignments
Timeline View
Assignment View
    ×
    ×