UNAUTHORIZED ACTIVITY DETECTION AND CLASSIFICATION

• US 20160283715A1
• Filed: 02/12/2016
• Published: 09/29/2016
• Est. Priority Date: 03/14/2013
• Status: Active Grant

• Current Assignee: SAS Institute Incorporated
• Original Assignee: SAS Institute Incorporated
• Inventors: Duke, Brian Lee, Dulany, Paul C., Shah, Kannan Shashank
• Granted Patent: US 9,594,907 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1064 Restricting content processing at operating system level
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06Q 20/308 using the Internet of Things
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing

Abstract

Systems and methods are provided for identifying and detecting unauthorized user activity and for decreasing the rate of false-positives. The disclosed systems and techniques may involve analysis of users'"'"' past activity data so that individual classifications and authorization decisions with respect to requested user activity are based on activity data associated with a user'"'"'s use of multiple services.

Claims

1. A system, comprising:

one or more processors;

one or more non-transitory computer-readable storage mediums including instructions configured to cause the one or more processors to perform operations including;

generating a filtering rule;

partitioning training data using the filtering rule, wherein the training data includes past data representing unauthorized activity;

analyzing a set of partitions, wherein analyzing includes providing the set of partitions to a model, wherein the model repeatedly generates a set of classifications, and wherein a classification is associated with a partition;

accessing known information associated with the training data;

identifying an accurate set of classifications using the known information, wherein the accurate set of classifications is associated with the analyzed set of partitions;

accessing first data that represents activity involving a first service provided to a user;

accessing second data that represents activity involving a second service provided to a user, wherein the activity involving the second service and the activity involving the first service both include authorized user activity, and wherein the activity associated with the second service further includes unauthorized activity;

filtering, on a computing device, a portion of the first data for use in classifying activity associated with the second service, wherein filtering the portion of the first data includes using the filtering rule and the accurate set of classifications;

determining a retained portion of the first data, wherein the retained portion of the first data is separate from the filtered portion of the first data; and

analyzing the second data and the retained portion of the first data, wherein analyzing includes classifying the activity associated with the second service, and wherein classifying distinguishes the unauthorized activity from the authorized activity associated with the second service.

2. The system of claim 1, wherein analyzing the second data and the retained portion of the first data further includes:

determining that the retained portion of the first data indicates that activity involving the first service occurred at a first location;

determining that the second data indicates that activity involving the second service occurred at a second location;

determining a distance between the first location and the second location; and

determining that the distance is greater than a distance threshold.

3. The system of claim 2, wherein analyzing the second data and the retained portion of the first data further includes:

determining an approximate amount of time between the activity at the first location and the activity at the second location, and wherein the activity at the second location is classified based on the amount of time.

4. The system of claim 1, wherein analyzing the second data and the retained portion of the first data further includes:

determining that the second data represents a first instance of abnormal activity involving the second service;

detecting an inconsistency between the first instance of abnormal activity and activity represented by the first data; and

determining, based on the detected inconsistency, that the first instance of abnormal activity is unauthorized activity.

5. The system of claim 4, wherein detecting the inconsistency includes determining that the user is unlikely to have initiated both the abnormal activity and the activity indicated by the first data.

6. The system of claim 1, wherein the operations further include:

determining that the second data represents an instance of abnormal activity involving the second service;

detecting activity that is represented by the first data and is consistent with the instance of abnormal activity; and

in response to detecting the activity that is consistent, classifying the abnormal activity involving the second service as authorized activity.

7. The system of claim 1, wherein the retained portion of the first data is a subset of the first data, and wherein the filtering rule is associated with a condition satisfied by data in the retained portion.

8. The system of claim 7, wherein the set of classifications are associated with multiple instances of activity involving the second service.

9. The system of claim 1, wherein the operations further include:

determining a filtering criteria based on past information about authorized or unauthorized activity involving the second service.

10. The system of claim 9, wherein determining the filtering criteria includes defining the filtering criteria to facilitate:

identifying a portion of the first data that is inconsistent with the second data;

or

identifying a portion of the first data that is consistent with the second data.

11. The system of claim 9, wherein the operations further include:

providing the first data to a detection mechanism prior to filtering the first data, wherein;

the detection mechanism is configured to detect unauthorized activity involving the first service without processing information about user activity involving the second service.

12. The system of claim 11, wherein the detection mechanism scores components of the first data, wherein scoring includes calculating a likelihood that the scored component corresponds to unauthorized activity, and wherein filtering the first data is further based on the detection mechanism scoring.

13. The system of claim 1, wherein the second data is a subset of a data superset, wherein the data superset comprises information representing activity involving the second service, and wherein accessing the second data includes:

filtering the data superset, wherein filtering the data superset is performed using second data filtering criteria, and includes determining to classify activity represented by the second data.

14. The system of claim 13, wherein the second data filtering criteria are for separating a subset of data from a data superset, wherein the subset is likely to be more informative for detecting unauthorized activity as compared to a portion of data that is in the data superset but which is not in the separated subset.

15. The system of claim 1, wherein the first data represents multiple instances of activity involving the first service, wherein the first data includes multiple first data components, and wherein each first data component represents a unique one of the multiple instances of activity involving the first service.

16. The system of claim 15, wherein filtering the first data includes:

identifying first data components that represent;

an instance of activity associated with an amount transacted that is in excess of a predetermined threshold amount;

an instance of activity which is abnormal activity for the user;

an instance of activity determined to have occurred more than a threshold distance from a residence of the user;

or

an instance of activity determined to have occurred more than a threshold distance from a location at which a previous instance of activity occurred; and

wherein the retained portion of first data includes the identified first data components.

17. The system of claim 16, wherein filtering the first data is done without consideration of the second data.

18. The system of claim 16, wherein filtering the first data includes using a machine-learning algorithm to filter the first data, and wherein using the machine-learning algorithm includes training with past data representing unauthorized activity involving the first service or the second service.

19. A computer-implemented method for detecting an unauthorized activity, the method comprising:

generating a filtering rule;

partitioning training data using the filtering rule, wherein the training data includes past data representing unauthorized activity;

analyzing a set of partitions, wherein analyzing includes providing the set of partitions to a model, wherein the model repeatedly generates a set of classifications, and wherein a classification is associated with a partition;

accessing known information associated with the training data;

identifying an accurate set of classifications using the known information, wherein the accurate set of classifications is associated with the analyzed set of partitions;

accessing first data that represents activity involving a first service provided to a user;

accessing second data that represents activity involving a second service provided to a user, wherein the activity involving the second service and the activity involving the first service both include authorized user activity, and wherein the activity associated with the second service further includes unauthorized activity;

filtering, on a computing device, a portion of the first data for use in classifying activity associated with the second service, wherein filtering the portion of the first data includes using the filtering rule and the accurate set of classifications;

determining a retained portion of the first data, wherein the retained portion of the first data is separate from the filtered portion of the first data; and

analyzing the second data and the retained portion of the first data, wherein analyzing includes classifying the activity associated with the second service, and wherein classifying distinguishes the unauthorized activity from the authorized activity associated with the second service.

20. The method of claim 19, wherein the retained portion of the first data is a subset of the first data, and wherein the filtering rule is associated with a condition satisfied by data in the retained portion.

21. The method of claim 19, wherein the operations further include:

determining a filtering criteria based on past information about authorized or unauthorized activity involving the second service.

22. The method of claim 21, wherein the operations further include:

providing the first data to a detection mechanism prior to filtering the first data, wherein;

the detection mechanism is configured to detect unauthorized activity involving the first service without processing information about user activity involving the second service.

23. The method of claim 19, wherein the first data represents multiple instances of activity involving the first service, wherein the first data includes multiple first data components, and wherein each first data component represents a unique one of the multiple instances of activity involving the first service.

24. The method of claim 23, wherein filtering the first data includes:

identifying first data components that represent;

an instance of activity associated with an amount transacted that is in excess of a predetermined threshold amount;

an instance of activity which is abnormal activity for the user;

an instance of activity determined to have occurred more than a threshold distance from a residence of the user;

or

an instance of activity determined to have occurred more than a threshold distance from a location at which a previous instance of activity occurred; and

wherein the retained portion of first data includes the identified first data components.

25. A computer-program product, tangibly embodied in a machine-readable non-transitory storage medium, including instructions configured to cause a data processing apparatus to perform operations including:

generating a filtering rule;

partitioning training data using the filtering rule, wherein the training data includes past data representing unauthorized activity;

analyzing a set of partitions, wherein analyzing includes providing the set of partitions to a model, wherein the model repeatedly generates a set of classifications, and wherein a classification is associated with a partition;

accessing known information associated with the training data;

identifying an accurate set of classifications using the known information, wherein the accurate set of classifications is associated with the analyzed set of partitions;

accessing first data that represents activity involving a first service provided to a user;

accessing second data that represents activity involving a second service provided to a user, wherein the activity involving the second service and the activity involving the first service both include authorized user activity, and wherein the activity associated with the second service further includes unauthorized activity;

filtering, on a computing device, a portion of the first data for use in classifying activity associated with the second service, wherein filtering the portion of the first data includes using the filtering rule and the accurate set of classifications;

determining a retained portion of the first data, wherein the retained portion of the first data is separate from the filtered portion of the first data; and

analyzing the second data and the retained portion of the first data, wherein analyzing includes classifying the activity associated with the second service, and wherein classifying distinguishes the unauthorized activity from the authorized activity associated with the second service.

26. The computer-program product of claim 25, wherein the retained portion of the first data is a subset of the first data, and wherein the filtering rule is associated with a condition satisfied by data in the retained portion.

27. The computer-program product of claim 25, wherein the operations further include:

determining a filtering criteria based on past information about authorized or unauthorized activity involving the second service.

28. The computer-program product of claim 27, wherein the operations further include:

providing the first data to a detection mechanism prior to filtering the first data, wherein;

the detection mechanism is configured to detect unauthorized activity involving the first service without processing information about user activity involving the second service.

29. The computer-program product of claim 25, wherein the first data represents multiple instances of activity involving the first service, wherein the first data includes multiple first data components, and wherein each first data component represents a unique one of the multiple instances of activity involving the first service.

30. The computer-program product of claim 29, wherein filtering the first data includes:

identifying first data components that represent;

an instance of activity associated with an amount transacted that is in excess of a predetermined threshold amount;

an instance of activity which is abnormal activity for the user;

an instance of activity determined to have occurred more than a threshold distance from a residence of the user;

or

an instance of activity determined to have occurred more than a threshold distance from a location at which a previous instance of activity occurred; and

wherein the retained portion of first data includes the identified first data components.