Methods and systems for detecting abnormal user activity

• US 10,581,889 B2
• Filed: 01/08/2018
• Issued: 03/03/2020
• Est. Priority Date: 04/05/2017
• Status: Active Grant

• Current Assignee: Direct Cursus Technology LLC
• Original Assignee: Yandex Europe AG (Yandex N.V.)
• Inventors: Kovega, Dmitriy Nikolaevich, Kovega, Ekaterina Aleksandrovna
• Primary Examiner(s): Ho, Dao Q
• Application Number:
  US15/864,127
• Publication Number:
  US 20180295146A1
• Time in Patent Office: 785 Days
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Systems and methods for detecting abnormal user activity comprising: tracking, by the server, during a first time period, user activity associated with an application service, determining, by the server, that the user activity associated with the application service exceeds a respective first predetermined threshold of user activity during the first time period, in response to determining that the user activity exceeds the first predetermined threshold, tracking, during a second time period user activity associated with the application service, the tracking comprising tracking a content of the user interactions with the application service, determining that the user activity exceeds a second predetermined threshold of user activity during the second time period and in response to determining that the user activity exceeds the second predetermined threshold, triggering a user challenge procedure on a client device.

Claims

1. A method for detecting abnormal user activity, the method executable on a server, the server being connected to a plurality of client devices via a communication network, each client device of the plurality of client devices being associated with a respective user, the method comprising:

tracking, by the server, during a first time period, user activity associated with a plurality of application services performed on a first client device, the user activity including user interactions with the plurality of application services, the tracking comprising receiving, at the server, an indication of a respective user interaction with a respective application service, and associating a score, a timestamp and a status with the indication of the user interaction,

wherein each application service of the plurality of application services is associated with a respective first predetermined threshold, and wherein the plurality of application services is associated with a single second predetermined threshold; and

each respective first predetermined threshold associated with each application service of the plurality of application services is a respective first average score, the respective first average score having been determined based on the scores associated with each past user interaction on the respective application service on each client device of the plurality of client devices by the respective user;

determining, by the server, that user activity associated with a first application service of the plurality of application services exceeds a respective first predetermined threshold of the user activity during the first time period,

the determining comprising adding each score associated with each user interaction of the user activity associated with the first application service during the first time period and comparing a total score to the respective first average score; and

the user activity exceeding the respective first predetermined threshold being indicative of a potentially abnormal user activity on the first application service associated with the first client device;

in response to determining that the user activity associated with the first application service exceeds the respective first predetermined threshold, tracking, during a second time period, by the server, user activity associated with the plurality of application services on the first client device, the tracking comprising tracking a content of the user interactions with the plurality of application services;

determining, by the server, that the user activity exceeds the single second predetermined threshold of user activity during the second time period, the single second predetermined threshold having been determined based on past user activity associated with the plurality of application services and performed on each client device of the plurality of client devices,

the user activity exceeding the single second predetermined threshold being indicative of an abnormal user activity associated with the first client device;

in response to determining that the user activity exceeds the second predetermined threshold, triggering, by the server, a user challenge procedure on the first client device, the user challenge procedure for authenticating the user of the first client device, the user challenge procedure being based on the user activity with the first application service during the first time period performed on the first client device.

2. The method of claim 1, further comprising:

responsive to the user challenge procedure response from the first client device matching the user activity during the first time period, allowing user activity with the plurality of application services, and responsive to the user challenge procedure response from the first client device not matching the user activity during the first time period, blocking access to the plurality of application services on the client device.

3. The method of claim 1, wherein the single second predetermined threshold is a second average score, the second average score having been determined based on the scores associated with each past user interaction of the past user activity on the plurality of application services.

4. The method of claim 3, wherein determining that the user activity exceeds the single second predetermined threshold during the second time period comprises adding each score associated with each user interaction of the user activity during the second time period and comparing a total score to the respective second average score.

5. The method of claim 4, wherein the first predetermined threshold and the single second predetermined threshold are further based on the timestamps of the user activity.

6. The method of claim 5, wherein the content of the user interaction comprises at least one of a text content, a geolocation parameter, a device identifier, a banned keyword, and a banned website link.

7. The method of claim 6, wherein the user challenge procedure comprises a question about a specific user interaction associated with an application service of the plurality of application services during the first time period.

8. A system for detecting abnormal user activity, the system being connected to a plurality of client devices via a communication network, each client device of the plurality of client devices being associated with a respective user, the system comprising:

a processor;

a non-transitory computer-readable medium comprising instructions, the processor;

upon executing the instructions, being configured to cause;

tracking, by the system, during a first time period, user activity associated with a a plurality of application services performed on a first client device, the user activity including user interactions with the plurality of application services, the tracking comprising receiving, at the server, an indication of a respective user interaction with a respective application service, and associating a score, a timestamp and a status with the indication of the user interaction,

wherein each application service of the plurality of application services is associated with a respective first predetermined threshold, and wherein the plurality of application services is associated with a single second predetermined threshold; and

each respective first predetermined threshold associated with each application service of the plurality of application services is a respective first average score, the respective first average score having been determined based on the scores associated with each past user interaction on the respective application service on each client device of the plurality of client devices by the respective user;

determining, by the system, that user activity associated with a first application service of the plurality of application services exceeds a respective first predetermined threshold of the user activity during the first time period,

the determining comprising adding each score associated with each user interaction of the user activity associated with the first application service during the first time period and comparing a total score to the respective first average score; and

the user activity exceeding the respective first predetermined threshold being indicative of a potentially abnormal user activity on the first application service associated with the first client device;

in response to determining that the user activity exceeds the respective first predetermined threshold, tracking, during a second time period, by the system, user activity associated with the plurality of application services on the first client device, the tracking comprising tracking a content of the user interactions with the plurality of application services;

determining, by the system, that the user activity exceeds the single second predetermined threshold of user activity during the second time period, the single second predetermined threshold having been determined based on past user activity associated with the plurality of application services and performed on each client device of the plurality of client devices,

the user activity exceeding the second predetermined threshold being indicative of an abnormal user activity associated with the first client device;

in response to determining that the user activity exceeds the second predetermined threshold, triggering, by the system, a user challenge procedure on the first client device, the user challenge procedure for authenticating the user of the first client device, the user challenge procedure being based on the user activity with the first application service during the first time period performed on the first client device.

9. The system of claim 8, further comprising:

responsive to the user challenge procedure response from the first client device matching the user activity during the first time period, allowing user activity with the plurality of application services, and responsive to the user challenge procedure response from the first client device not matching the user activity during the first time period, blocking access to the plurality of application services on the client device.

10. The system of claim 8, wherein the single second predetermined threshold is a second average score, the second average score having been determined based on the scores associated with each past user interaction of the past user activity on the plurality of application services.