Real-time, location-aware mobile device data breach prevention

• US 10,425,771 B2
• Filed: 11/29/2018
• Issued: 09/24/2019
• Est. Priority Date: 07/10/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Diamanti, Gary F., Hatanaka, Iwao, Kenna, Stephen J., Marzorati, Mauro
• Primary Examiner(s): Mizrahi, Diane D
• Application Number:
  US16/205,161
• Publication Number:
  US 20190166466A1
• Time in Patent Office: 299 Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 3/044 Recurrent networks, e.g. Hopfield networks
• CPC Class Codes: G06N 3/08 Learning methods
• CPC Class Codes: G06N 99/00 Subject matter not provided for in other groups of this subclass
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

A cognitive security service receives, as input to a recurrent neural network, a matrix of regular locations and usage for a user at multiple times as reported by one or more mobile devices for the user via a network. The cognitive security service applies the matrix in the recurrent neural network to predict one or more next device locations for a next step in time, each of the one or more next device locations weighted with a separate probability. The cognitive security service generates, through the recurrent neural network, an alert in response to one or more selected location and selected usage weighted with the highest probability deviating from a current location of the one or more mobile devices beyond a threshold specified by the user.

Claims

1. A method comprising:

receiving, by a computer system, as input to a recurrent neural network, a matrix of a plurality of regular locations and usage for a user at a plurality of times as reported by one or more mobile devices for the user via a network;

applying, by the computer system, the matrix in the recurrent neural network to predict one or more next device locations for a next step in time, each of the one or more next device locations weighted with a separate probability; and

generating, by the computer system, by the recurrent neural network, an alert in response to one or more selected location and selected usage weighted with the highest probability deviating from a current location of the one or more mobile devices beyond a threshold specified by the user.

2. The method according to claim 1, further comprising:

responsive to receiving the input, filtering, by the computer system, one or more relevant location features from the matrix for a first time step into a vector within the recurrent neural network;

analyzing, by the computer system, one or more device location features in the vector at the first time step within the recurrent neural network by applying a nonlinear activation function of one or more weights and balances for the first time step along with previously cached location output data from a previous time step, the previous time step at least one sequential time step prior to the first time step;

transforming, by the computer system, the analyzed device location features in the vector into a plurality of entries ordered according to the separate probability in the vector within the recurrent neural network; and

comparing, by the computer system, a selected entry in the vector, of the one or more selected locations and selected usage weighted with the highest probability at the first time step within the recurrent neural network, with the current location of the one or more mobile devices.

3. The method according to claim 2, further comprising:

filtering, by the computer system, one or more relevant location features from the matrix for a first time step into a vector in an input layer of the recurrent neural network;

analyzing, by the computer system, the one or more device location features in the vector at the first time step within a hidden layer of the recurrent neural network;

transforming, by the computer system, the analyzed device location features in the vector into the plurality of entries ordered according to separate probability in the vector within the hidden layer of the recurrent neural network; and

comparing, by the computer system, the selected entry in the vector of one or more selected locations and selected usage ordered with the highest probability at the first time step within an output layer of the recurrent neural network with the current location of the one or more mobile devices; and

generating, by the computer system, from the output layer of the recurrent neural network, the alert.

4. The method according to claim 1, further comprising:

ingesting, by the computer system, at the plurality of times, aggregated location and usage information reported by the one or more mobile devices for the user and from one or more additional security related data services specified by the user, the one or more additional user data input sources comprising one or more of an electronic mail service, an electronic calendar service, a social network service, a travel itinerary, one or more location based statistics, and a network whitelist of one or more known networks;

generating, by the computer system, a normalized time-based location matrix from the ingested plurality of locations and usage at the plurality of times; and

outputting, by the computer system, the normalized time-based location matrix to the recurrent neural network as the input to the recurrent neural network.

5. The method according to claim 1, further comprising:

responsive to the alert, triggering, by the computer system, via the network, one or more secondary levels of authentication at the one or more mobile devices, wherein the one or more secondary levels of authentication prevent data breaches on the one or more mobile devices through real-time, location aware data security.

6. The method according to claim 1, further comprising:

assessing, by the computer system, a risk level at each of the one or more particular locations based on aggregated risk data received for each of the particular locations via the network from a plurality of location related services that monitor risk related factors, the plurality of location related services comprising the one or more mobile devices and one or more publicly available services providing security related reports; and

selecting, by the computer system, the threshold specified by the user according to the risk level for the current location from among a plurality of thresholds each specified for a separate risk level from among a plurality of risk levels.

7. The method according to claim 1, further comprising:

receiving, by the computer system, a request to setup a particular mobile device of the one or more mobile devices with security related data and one or more additional security requirements for the user;

setting, by the computer system, an identifier for the particular mobile device in an account for the user;

adding, by the computer system, the threshold, contact information, and one or more actions specified by the additional security requirements to the account for the user for the particular mobile device;

aggregating, by the computer system, the security related data with location and usage information reported by the one or more mobile devices via the network; and

responsive to detecting the alert, triggering, by the computer system, the one or more actions specified by the user for the particular mobile device, wherein the one or more actions comprises triggering one or more secondary levels of authentication at the particular mobile device.

8. The method according to claim 1, wherein generating, by the computer system, by the recurrent neural network, the alert in response to one or more selected location and selected usage weighted with the highest probability deviating from a current location of the one or more mobile devices beyond a threshold specified by the user further comprises:

triggering, by the computer system, via the network, one or more secondary levels of authentication at the one or more mobile devices by sending a trigger communication to the one or more mobile devices, wherein a separate security controller at each of the one or more mobile devices receives the trigger communication, locks access to one or more types of functionality, and triggers one or more types of secondary levels of authentication.

9. A computer system comprising one or more processors, one or more computer-readable memories, one or more computer-readable storage devices, and program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the stored program instructions comprising:

program instructions to receive, as input to a recurrent neural network, a matrix of a plurality of regular locations and usage for a user at a plurality of times as reported by one or more mobile devices for the user via a network;

program instructions to apply the matrix in the recurrent neural network to predict one or more next device locations for a next step in time, each of the one or more next device locations weighted with a separate probability; and

program instructions to generate, by the recurrent neural network, an alert in response to one or more selected location and selected usage weighted with the highest probability deviating from a current location of the one or more mobile devices beyond a threshold specified by the user.

10. The computer system according to claim 9, the stored program instructions further comprising:

program instructions, responsive to receiving the input, to filter one or more relevant location features from the matrix for a first time step into a vector within the recurrent neural network;

program instructions to analyze one or more device location features in the vector at the first time step within the recurrent neural network by applying a nonlinear activation function of one or more weights and balances for the first time step along with previously cached location output data from a previous time step, the previous time step at least one sequential time step prior to the first time step;

program instructions to transform the analyzed device location features in the vector into a plurality of entries ordered according to the separate probability in the vector within the recurrent neural network; and

program instructions to compare a selected entry in the vector, of the one or more selected locations and selected usage weighted with the highest probability at the first time step within the recurrent neural network, with the current location of the one or more mobile devices.

11. The computer system according to claim 10, the stored program instructions further comprising:

program instructions to filter one or more relevant location features from the matrix for a first time step into a vector in an input layer of the recurrent neural network;

program instructions to analyze the one or more device location features in the vector at the first time step within a hidden layer of the recurrent neural network;

program instructions to transform the analyzed device location features in the vector into the plurality of entries ordered according to separate probability in the vector within the hidden layer of the recurrent neural network; and

program instructions to compare the selected entry in the vector of one or more selected locations and selected usage ordered with the highest probability at the first time step within an output layer of the recurrent neural network with the current location of the one or more mobile devices; and

program instructions to generate, from the output layer of the recurrent neural network, the alert.

12. The computer system according to claim 9, the stored program instructions further comprising:

program instructions to ingest, at the plurality of times, aggregated location and usage information reported by the one or more mobile devices for the user and from one or more additional security related data services specified by the user, the one or more additional user data input sources comprising one or more of an electronic mail service, an electronic calendar service, a social network service, a travel itinerary, one or more location based statistics, and a network whitelist of one or more known networks;

program instructions to generate a normalized time-based location matrix from the ingested plurality of locations and usage at the plurality of times; and

program instructions to output the normalized time-based location matrix to the recurrent neural network as the input to the recurrent neural network.

13. The computer system according to claim 9, the stored program instructions further comprising:

program instructions, responsive to the alert, to trigger, via the network, one or more secondary levels of authentication at the one or more mobile devices, wherein the one or more secondary levels of authentication prevent data breaches on the one or more mobile devices through real-time, location aware data security.

14. The computer system according to claim 9, the stored program instructions further comprising:

program instructions to assess a risk level at each of the one or more particular locations based on aggregated risk data received for each of the particular locations via the network from a plurality of location related services that monitor risk related factors, the plurality of location related services comprising the one or more mobile devices and one or more publicly available services providing security related reports; and

program instructions to select the threshold specified by the user according to the risk level for the current location from among a plurality of thresholds each specified for a separate risk level from among a plurality of risk levels.

15. The computer system according to claim 9, the stored program instructions further comprising:

program instructions to receive a request to setup a particular mobile device of the one or more mobile devices with security related data and one or more additional security requirements for the user;

program instructions to set an identifier for the particular mobile device in an account for the user;

program instructions to add the threshold, contact information, and one or more actions specified by the additional security requirements to the account for the user for the particular mobile device;

program instructions to aggregate the security related data with location and usage information reported by the one or more mobile devices via the network; and

program instructions to, responsive to detecting the alert, trigger the one or more actions specified by the user for the particular mobile device, wherein the one or more actions comprises triggering one or more secondary levels of authentication at the particular mobile device.

16. The computer system according to claim 9, the stored program instructions further comprising:

program instructions to trigger, via the network, one or more secondary levels of authentication at the one or more mobile devices by sending a trigger communication to the one or more mobile devices, wherein a separate security controller at each of the one or more mobile devices receives the trigger communication, locks access to one or more types of functionality, and triggers one or more types of secondary levels of authentication.

17. A computer program product comprises a computer readable storage medium having program instructions embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program instructions executable by a computer to cause the computer to:

receive, by a computer, as input to a recurrent neural network, a matrix of a plurality of regular locations and usage for a user at a plurality of times as reported by one or more mobile devices for the user via a network;

apply, by the computer, the matrix in the recurrent neural network to predict one or more next device locations for a next step in time, each of the one or more next device locations weighted with a separate probability; and

generate, by the computer, by the recurrent neural network, an alert in response to one or more selected location and selected usage weighted with the highest probability deviating from a current location of the one or more mobile devices beyond a threshold specified by the user.

18. The computer program product according to claim 17, further comprising the program instructions executable by a computer to cause the computer to:

responsive to receiving the input, filter, by the computer, one or more relevant location features from the matrix for a first time step into a vector within the recurrent neural network;

analyze, by the computer, one or more device location features in the vector at the first time step within the recurrent neural network by applying a nonlinear activation function of one or more weights and balances for the first time step along with previously cached location output data from a previous time step, the previous time step at least one sequential time step prior to the first time step;

transform, by the computer, the analyzed device location features in the vector into a plurality of entries ordered according to the separate probability in the vector within the recurrent neural network; and

compare, by the computer, a selected entry in the vector, of the one or more selected locations and selected usage weighted with the highest probability at the first time step within the recurrent neural network, with the current location of the one or more mobile devices.

19. The computer program product according to claim 18, further comprising the program instructions executable by a computer to cause the computer to:

filter, by the computer, one or more relevant location features from the matrix for a first time step into a vector in an input layer of the recurrent neural network;

analyze, by the computer, the one or more device location features in the vector at the first time step within a hidden layer of the recurrent neural network;

transform, by the computer, the analyzed device location features in the vector into the plurality of entries ordered according to separate probability in the vector within the hidden layer of the recurrent neural network; and

compare, by the computer, the selected entry in the vector of one or more selected locations and selected usage ordered with the highest probability at the first time step within an output layer of the recurrent neural network with the current location of the one or more mobile devices; and

generate, by the computer, from the output layer of the recurrent neural network, the alert.

20. The computer program product according to claim 17, further comprising the program instructions executable by a computer to cause the computer to:

ingest, by the computer, at the plurality of times, aggregated location and usage information reported by the one or more mobile devices for the user and from one or more additional security related data services specified by the user, the one or more additional user data input sources comprising one or more of an electronic mail service, an electronic calendar service, a social network service, a travel itinerary, one or more location based statistics, and a network whitelist of one or more known networks;

generate, by the computer, a normalized time-based location matrix from the ingested plurality of locations and usage at the plurality of times; and

output, by the computer, the normalized time-based location matrix to the recurrent neural network as the input to the recurrent neural network.