DETECTING A COMPROMISED ONLINE USER ACCOUNT

• US 20120297484A1
• Filed: 05/18/2011
• Published: 11/22/2012
• Est. Priority Date: 05/18/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Srivastava, Kumar S.
• Granted Patent: US 9,117,074 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

One or more techniques and/or systems are disclosed for detecting and/or mitigating a potentially compromised online user account. One or more baselines can be established for a user'"'"'s online account to determine a normal usage pattern for the account by the user (e.g., frequency of incoming/outgoing emails, text messages, etc.). The online user account can be periodically or continually monitored for use of the same resources used to determine the baseline(s). If a deviation from the baseline is detected, the deviation may be compared against a threshold to determine whether the deviation indicates that the account may be compromised. When an indication of a potentially compromised account is detected, the user can be notified of the indication, so that one or more actions can be taken to mitigate the potentially compromised account.

Claims

1. A method for mitigating a compromised online user account, comprising:

establishing a baseline for the online user account;

detecting a deviation from the baseline indicative of a potentially compromised online user account; and

notifying a user of the online user account of the indication of the potentially compromised online user account.

2. The method of claim 1, comprising notifying contacts of the online user account of the indication of the potentially compromised online user account.

3. The method of claim 2, notifying contacts comprising sending a notification to respective contacts utilizing a mode of communication that is identified as having a desired communication trust level.

4. The method of claim 1, comprising notifying the user to take corrective action.

5. The method of claim 1, comprising notifying contacts of the online user account to take corrective action in response to the indication of the potentially compromised online user account.

6. The method of claim 1, detecting a deviation comprising monitoring the online user account for activity related to one or more activity segments associated with the baseline.

7. The method of claim 1, establishing the baseline comprising establishing a baseline value for one or more activity segments of the online user account.

8. The method of claim 1, establishing the baseline comprising determining a historical use of the online user account by the user for a desired period of time.

9. The method of claim 1, establishing the baseline comprising identifying activity in one or more activity segments for the online user account, the one or more activity segments comprising communication-related activity between the user and one or more contacts of the online user account.

10. The method of claim 9, identifying activity in one or more activity segments comprising identifying one or more of the following related to the communication-related activity:

frequency of communications;

duration of communications;

mode of communications;

direction of communications; and

type of contact associated with the communications.

11. The method of claim 1, detecting a deviation comprising comparing activity from one or more activity segments of the online user account with a desired deviation threshold from the baseline.

12. The method of claim 1, detecting a deviation comprising comparing an activity segment value from a desired period of activity for the online user account with a desired threshold value comprising a deviation from the baseline.

13. The method of claim 1, detecting a deviation comprising inputting one or more activity segment values from a desired period of activity for the online user account into a classifier trained using the baseline to output a probability of a compromised online user account.

14. The method of claim 1, notifying the user comprising sending a notification to the user utilizing a mode of communication that is identified as having a desired probability of being non-compromised.

19. The system of claim 1, the potentially compromised online user account comprising a social network account that is being utilized by an unauthorized user.

15. A system for mitigating a compromised online user account, comprising:

a computer-based processor configured to process data for the system;

a baseline establishing component, operably coupled with the processor, and configured to establish a baseline for the online user account;

a deviation detection component, operably coupled with the processor, and configured to detect a deviation from the baseline indicative of a potentially compromised online user account; and

a user notification component, operably coupled with the processor, and configured to notify a user of the online user account of the indication of the potentially compromised online user account.

16. The system of claim 15, comprising a classification component configured to perform one or more of:

determine a baseline value using input from one or more activity segments from historical activity for the online user account;

determine a monitored value for the online user account using input from one or more activity segments from a desired period of time for activity from the online user account; and

determine a compromised account probability based upon the baseline value and the monitored value.

17. The system of claim 15, the deviation detection component configured to compare the baseline with monitored activity for the online user account for a desired period of time to determine if a deviation of the monitored activity from the baseline meets a desired potentially compromised account threshold.

18. The system of claim 15, the baseline comprising a statistical value representing one or more of:

frequency of communications between the user and one or more contacts of the online user account;

duration of communications between the user and one or more contacts of the online user account;

mode of communications between the user and one or more contacts of the online user account;

direction of communications between the user and one or more contacts of the online user account; and

a type of contact associated with a communication with the user.

20. A method for mitigating a compromised online user account, comprising:

establishing a baseline value for historical activity in one or more communication related activity segments of the online user account;

monitoring the online user account for activity related to the one or more activity segments associated with the baseline;

detecting a deviation from the baseline indicative of a potentially compromised online user account, comprising comparing activity from the one or more activity segments with a desired deviation threshold from the baseline;

notifying a user of the online user account of;

the indication of the potentially compromised online user account; and

to take corrective action to correct the potentially compromised online user account; and

notifying one or more contacts from the online user account of the indication of the potentially compromised online user account, comprising sending a notification to at least one of the one or more contacts utilizing a mode of communication that is identified as having a desired communication trust level.