SYSTEMS AND METHODS FOR DETECTING AND SCORING ANOMALIES

• US 20170070521A1
• Filed: 09/04/2016
• Published: 03/09/2017
• Est. Priority Date: 09/05/2015
• Status: Abandoned Application

• Current Assignee: NuData Security Inc. (MasterCard Incorporated)
• Original Assignee: NuData Security Inc. (MasterCard Incorporated)
• Inventors: Bailey, Christopher Everett, Lukashuk, Randy, Richardson, Gary Wayne
• Application Number:
  US15/256,597
• Publication Number:
  US 20170070521A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 7/08 Sorting, i.e. grouping record carriers in numerical or other ordered sequence according to the classification of at least some of the information they carry by merging two or more sets of carriers in ordered sequence G06F7/16
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/30 : Profiles
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Systems and methods for detecting and scoring anomalies. In some embodiments, a method is provided, comprising acts of: (A) identifying a plurality of values of an attribute, each value of the plurality of values corresponding respectively to a digital interaction of the plurality of digital interactions; (B) dividing the plurality of values into a plurality of buckets; (C) for at least one bucket of the plurality of buckets, determining a count of values from the plurality of values that fall within the at least one bucket; (D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and (E) determining whether the attribute is anomalous based at least in part on a result of the act (D).

Claims

1. A computer-implemented method for analyzing a plurality of digital interactions, the method comprising acts of:

(A) identifying a plurality of values of an attribute, each value of the plurality of values corresponding respectively to a digital interaction of the plurality of digital interactions;

(B) dividing the plurality of values into a plurality of buckets;

(C) for at least one bucket of the plurality of buckets, determining a count of values from the plurality of values that fall within the at least one bucket;

(D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and

(E) determining whether the attribute is anomalous based at least in part on a result of the act (D).

2. The method of claim 1, wherein:

each value of the plurality of values comprises a time measurement between a first point and a second point in the corresponding digital interaction; and

each bucket of the plurality of buckets comprises a range of time measurements.

3. The method of claim 1, wherein:

the act (B) of dividing the plurality of values into a plurality of buckets comprises applying a hash-modding operation to each value of the plurality of values; and

each bucket of the plurality of buckets corresponds to a residue of the hash-modding operation.

4. The method of claim 3, further comprising acts of:

(F) recording a plurality of observations with respect to the attribute, each observation of the plurality of observations being recorded from a corresponding digital interaction of the plurality of digital interactions; and

(G) deriving each value of the plurality of values based on the observation recorded from the corresponding digital interaction.

5. The method of claim 1, wherein the historical information regarding the attribute comprises an expected count for the at least one bucket, and wherein the act (D) comprises:

comparing the count of values from the plurality of values that fall within the at least one bucket against the expected count for the at least one bucket.

6. The method of claim 5, wherein the act (E) comprises:

determining if the count of values from the plurality of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least a selected threshold amount, wherein the attribute is determined to be anomalous in response to determining that the count of values from the plurality of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least the selected threshold amount.

7. The method of claim 5, wherein:

the plurality of digital interactions comprises a plurality of first digital interactions observed from a first time period;

the plurality of values comprises a plurality of first values of the attribute;

dividing a plurality of second values of the attribute into the plurality of buckets, each value of the plurality of second values corresponding respectively to a digital interaction of a plurality of second digital interactions;

the expected count for the at least one bucket comprises a count of values from the plurality of second values that fall within the at least one bucket;

the plurality of second digital interactions were observed from a second time period, the second time period having a same length as the first time period; and

the first time period occurs after the second time period.

8. The method of claim 5, wherein the plurality of buckets comprises a plurality of first buckets, and wherein the method further comprises acts of:

determining if the count of values from the plurality of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least a selected threshold amount; and

in response to determining that the count of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least the selected threshold amount, dividing the plurality of values into a plurality of second buckets, wherein there are more second buckets than first buckets.

9. The method of claim 1, wherein the historical information regarding the attribute comprises an expected ratio for the at least one bucket, and wherein the act (D) comprises:

determining a ratio between the count of values from the plurality of values that fall within the at least one bucket, and a total count of values from the plurality of values; and

comparing the ratio against the expected ratio for the at least one bucket.

10. The method of claim 1, further comprising acts of:

selecting a plurality of attributes, the plurality of attributes comprising the attribute, wherein acts (A)-(E) are performed for each attribute of the plurality of attributes; and

storing, in a profile, information regarding one or more attributes that are determined to be anomalous.

11. A system comprising at least one processor and at least one computer-readable storage medium having stored thereon instructions which, when executed, program the at least one processor to perform a method for analyzing a plurality of digital interactions, the method comprising acts of:

(A) identifying a plurality of values of an attribute, each value of the plurality of values corresponding respectively to a digital interaction of the plurality of digital interactions;

(B) dividing the plurality of values into a plurality of buckets;

(C) for at least one bucket of the plurality of buckets, determining a count of values from the plurality of values that fall within the at least one bucket;

(D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and

(E) determining whether the attribute is anomalous based at least in part on a result of the act (D).

12. The system of claim 11, wherein:

each value of the plurality of values comprises a time measurement between a first point and a second point in the corresponding digital interaction; and

each bucket of the plurality of buckets comprises a range of time measurements.

13. The system of claim 11, wherein:

the act (B) of dividing the plurality of values into a plurality of buckets comprises applying a hash-modding operation to each value of the plurality of values; and

each bucket of the plurality of buckets corresponds to a residue of the hash-modding operation.

14. The system of claim 13, wherein the method further comprises acts of:

(F) recording a plurality of observations with respect to the attribute, each observation of the plurality of observations being recorded from a corresponding digital interaction of the plurality of digital interactions; and

(G) deriving each value of the plurality of values based on the observation recorded from the corresponding digital interaction.

15. The system of claim 11, wherein the historical information regarding the attribute comprises an expected count for the at least one bucket, and wherein the act (D) comprises:

comparing the count of values from the plurality of values that fall within the at least one bucket against the expected count for the at least one bucket.

16. The system of claim 15, wherein the act (E) comprises:

determining if the count of values from the plurality of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least a selected threshold amount, wherein the attribute is determined to be anomalous in response to determining that the count of values from the plurality of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least the selected threshold amount.

17. The system of claim 15, wherein:

the plurality of digital interactions comprises a plurality of first digital interactions observed from a first time period;

the plurality of values comprises a plurality of first values of the attribute;

dividing a plurality of second values of the attribute into the plurality of buckets, each value of the plurality of second values corresponding respectively to a digital interaction of a plurality of second digital interactions;

the expected count for the at least one bucket comprises a count of values from the plurality of second values that fall within the at least one bucket;

the plurality of second digital interactions were observed from a second time period, the second time period having a same length as the first time period; and

the first time period occurs after the second time period.

18. The system of claim 15, wherein the plurality of buckets comprises a plurality of first buckets, and wherein the method further comprises acts of:

determining if the count of values from the plurality of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least a selected threshold amount; and

in response to determining that the count of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least the selected threshold amount, dividing the plurality of values into a plurality of second buckets, wherein there are more second buckets than first buckets.

19. The system of claim 11, wherein the historical information regarding the attribute comprises an expected ratio for the at least one bucket, and wherein the act (D) comprises:

determining a ratio between the count of values from the plurality of values that fall within the at least one bucket, and a total count of values from the plurality of values; and

comparing the ratio against the expected ratio for the at least one bucket.

20. The system of claim 11, wherein the method further comprises acts of:

selecting a plurality of attributes, the plurality of attributes comprising the attribute, wherein acts (A)-(E) are performed for each attribute of the plurality of attributes; and

storing, in a profile, information regarding one or more attributes that are determined to be anomalous.

21. At least one computer-readable storage medium having stored thereon instructions which, when executed, program at least one processor to perform a method for analyzing a plurality of digital interactions, the method comprising acts of:

(A) identifying a plurality of values of an attribute, each value of the plurality of values corresponding respectively to a digital interaction of the plurality of digital interactions;

(B) dividing the plurality of values into a plurality of buckets;

(C) for at least one bucket of the plurality of buckets, determining a count of values from the plurality of values that fall within the at least one bucket;

(D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and

(E) determining whether the attribute is anomalous based at least in part on a result of the act (D).

22. The at least one computer-readable storage medium of claim 21, wherein:

each value of the plurality of values comprises a time measurement between a first point and a second point in the corresponding digital interaction; and

each bucket of the plurality of buckets comprises a range of time measurements.

23. The at least one computer-readable storage medium of claim 21, wherein:

the act (B) of dividing the plurality of values into a plurality of buckets comprises applying a hash-modding operation to each value of the plurality of values; and

each bucket of the plurality of buckets corresponds to a residue of the hash-modding operation.

24. The at least one computer-readable storage medium of claim 23, wherein the method further comprises acts of:

(F) recording a plurality of observations with respect to the attribute, each observation of the plurality of observations being recorded from a corresponding digital interaction of the plurality of digital interactions; and

(G) deriving each value of the plurality of values based on the observation recorded from the corresponding digital interaction.

25. The at least one computer-readable storage medium of claim 21, wherein the historical information regarding the attribute comprises an expected count for the at least one bucket, and wherein the act (D) comprises:

comparing the count of values from the plurality of values that fall within the at least one bucket against the expected count for the at least one bucket.

26. The at least one computer-readable storage medium of claim 25, wherein the act (E) comprises:

determining if the count of values from the plurality of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least a selected threshold amount, wherein the attribute is determined to be anomalous in response to determining that the count of values from the plurality of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least the selected threshold amount.

27. The at least one computer-readable storage medium of claim 25, wherein:

the plurality of digital interactions comprises a plurality of first digital interactions observed from a first time period;

the plurality of values comprises a plurality of first values of the attribute;

dividing a plurality of second values of the attribute into the plurality of buckets, each value of the plurality of second values corresponding respectively to a digital interaction of a plurality of second digital interactions;

the expected count for the at least one bucket comprises a count of values from the plurality of second values that fall within the at least one bucket;

the plurality of second digital interactions were observed from a second time period, the second time period having a same length as the first time period; and

the first time period occurs after the second time period.

28. The at least one computer-readable storage medium of claim 25, wherein the plurality of buckets comprises a plurality of first buckets, and wherein the method further comprises acts of:

determining if the count of values from the plurality of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least a selected threshold amount; and

in response to determining that the count of values that fall within the at least one bucket exceeds the expected count for the at least one bucket by at least the selected threshold amount, dividing the plurality of values into a plurality of second buckets, wherein there are more second buckets than first buckets.

29. The at least one computer-readable storage medium of claim 21, wherein the historical information regarding the attribute comprises an expected ratio for the at least one bucket, and wherein the act (D) comprises:

determining a ratio between the count of values from the plurality of values that fall within the at least one bucket, and a total count of values from the plurality of values; and

comparing the ratio against the expected ratio for the at least one bucket.

30. The at least one computer-readable storage medium of claim 21, wherein the method further comprises acts of:

selecting a plurality of attributes, the plurality of attributes comprising the attribute, wherein acts (A)-(E) are performed for each attribute of the plurality of attributes; and

storing, in a profile, information regarding one or more attributes that are determined to be anomalous.