SYSTEMS AND METHODS FOR DETECTING AND SCORING ANOMALIES

• US 20170070523A1
• Filed: 09/04/2016
• Published: 03/09/2017
• Est. Priority Date: 09/05/2015
• Status: Active Grant

• Current Assignee: NuData Security Inc. (MasterCard Incorporated)
• Original Assignee: NuData Security Inc. (MasterCard Incorporated)
• Inventors: Bailey, Christopher Everett, Lukashuk, Randy, Richardson, Gary Wayne
• Granted Patent: US 9,648,034 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 7/08 Sorting, i.e. grouping record carriers in numerical or other ordered sequence according to the classification of at least some of the information they carry by merging two or more sets of carriers in ordered sequence G06F7/16
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/30 : Profiles
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Systems and methods for detecting and scoring anomalies. In some embodiments, a method is provided, comprising acts of: determining whether the digital interaction is suspicious; in response to determining that the digital interaction is suspicious, deploying a security probe of a first type to collect first data from the digital interaction; analyzing first data collected from the digital interaction by the security probe of the first type to determine if the digital interaction continues to appear suspicious; and if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction continues to appear suspicious, deploying a security probe of a second type to collect second data from the digital interaction.

Claims

1. A computer-implemented method for analyzing a digital interaction, the method comprising acts of:

determining whether the digital interaction is suspicious;

in response to determining that the digital interaction is suspicious, deploying a security probe of a first type to collect first data from the digital interaction;

analyzing first data collected from the digital interaction by the security probe of the first type to determine if the digital interaction continues to appear suspicious;

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction continues to appear suspicious, deploying a security probe of a second type to collect second data from the digital interaction; and

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction no longer appears suspicious, deploying a security probe of a third type to collect third data from the digital interaction.

2. The method of claim 1, wherein the act of determining whether the digital interaction is suspicious comprises an act of:

matching the digital interaction to a profile comprising at least one anomalous attribute.

3. The method of claim 2, wherein the act of matching the digital interaction to the profile comprises acts of:

determining, from the digital interaction, a value of the at least one anomalous attribute;

determining, based on information stored in the profile, whether the value of the at least one anomalous attribute exhibits an anomaly; and

in response to determining that the value of the at least one anomalous attribute exhibits an anomaly, calculating a penalty score for the digital interaction.

4. The method of claim 3, wherein the digital interaction is determined to be suspicious if the penalty score exceeds a selected threshold.

5. The method of claim 1, wherein the security probe of a first type comprises at least one JavaScript statement to be executed by a computing device carrying out the digital interaction, and wherein the act of analyzing first data collected from the digital interaction by the security probe of the first type comprises:

analyzing an execution result received from the computing device to determine if the execution result is consistent with a user agent type reported in the digital interaction.

6. The method of claim 5, wherein:

the at least one JavaScript statement comprises at least one first JavaScript statement;

the security probe of a second type comprises at least one second JavaScript statement to be executed by the computing device carrying out the digital interaction; and

the method further comprises an act of analyzing second data collected from the digital interaction by the security probe of the second type to determine if a JavaScript engine is running on the computer device.

7. The method of claim 5, wherein the security probe of a third type comprises at least one instruction to manipulate a GUI field, and the method further comprises acts of:

receiving third data collected from the digital interaction by the security probe of the third type, the third data comprising at least one pointer event; and

determining whether the at least one pointer event is consistent with the at least one instruction to manipulate a GUI field.

8. The method of claim 1, further comprising acts of:

using a sensor to monitor at least one attribute of a plurality of digital interactions;

determining, based on an output of the sensor, whether the at least one attribute is anomalous; and

in response to determining that the at least one attribute is anomalous;

determining, from the digital interaction, a value of the at least one attribute; and

determining, based on the output of the sensor, whether the value of the at least one attribute determined from the digital interaction exhibits an anomaly, wherein the digital interaction is determined to be suspicious if it is determined that the value of the at least one attribute determined from the digital interaction exhibits an anomaly.

9. The method of claim 8, wherein determining whether the value of the at least one attribute determined from the digital interaction exhibits an anomaly comprises determining whether the value of the at least one attribute determined from the digital interaction exceeds a selected threshold.

10. The method of claim 9, wherein the selected threshold is determined based on the output of the sensor.

11. A system comprising at least one processor and at least one computer-readable storage medium having stored thereon instructions which, when executed, program the at least one processor to perform a method for analyzing a digital interaction, the method comprising acts of:

determining whether the digital interaction is suspicious;

in response to determining that the digital interaction is suspicious, deploying a security probe of a first type to collect first data from the digital interaction;

analyzing first data collected from the digital interaction by the security probe of the first type to determine if the digital interaction continues to appear suspicious;

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction continues to appear suspicious, deploying a security probe of a second type to collect second data from the digital interaction; and

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction no longer appears suspicious, deploying a security probe of a third type to collect third data from the digital interaction.

12. The system of claim 11, wherein the act of determining whether the digital interaction is suspicious comprises an act of:

matching the digital interaction to a profile comprising at least one anomalous attribute.

13. The system of claim 12, wherein the act of matching the digital interaction to the profile comprises acts of:

determining, from the digital interaction, a value of the at least one anomalous attribute;

determining, based on information stored in the profile, whether the value of the at least one anomalous attribute exhibits an anomaly; and

in response to determining that the value of the at least one anomalous attribute exhibits an anomaly, calculating a penalty score for the digital interaction.

14. The system of claim 13, wherein the digital interaction is determined to be suspicious if the penalty score exceeds a selected threshold.

15. The system of claim 11, wherein the security probe of a first type comprises at least one JavaScript statement to be executed by a computing device carrying out the digital interaction, and wherein the act of analyzing first data collected from the digital interaction by the security probe of the first type comprises:

analyzing an execution result received from the computing device to determine if the execution result is consistent with a user agent type reported in the digital interaction.

16. The system of claim 15, wherein:

the at least one JavaScript statement comprises at least one first JavaScript statement;

the security probe of a second type comprises at least one second JavaScript statement to be executed by the computing device carrying out the digital interaction; and

the method further comprises an act of analyzing second data collected from the digital interaction by the security probe of the second type to determine if a JavaScript engine is running on the computer device.

17. The system of claim 15, wherein the security probe of a third type comprises at least one instruction to manipulate a GUI field, and wherein the method further comprises acts of:

receiving third data collected from the digital interaction by the security probe of the third type, the third data comprising at least one pointer event; and

determining whether the at least one pointer event is consistent with the at least one instruction to manipulate a GUI field.

18. The system of claim 11, wherein the method further comprises acts of:

using a sensor to monitor at least one attribute of a plurality of digital interactions;

determining, based on an output of the sensor, whether the at least one attribute is anomalous; and

in response to determining that the at least one attribute is anomalous;

determining, from the digital interaction, a value of the at least one attribute; and

determining, based on the output of the sensor, whether the value of the at least one attribute determined from the digital interaction exhibits an anomaly, wherein the digital interaction is determined to be suspicious if it is determined that the value of the at least one attribute determined from the digital interaction exhibits an anomaly.

19. The system of claim 18, wherein determining whether the value of the at least one attribute determined from the digital interaction exhibits an anomaly comprises determining whether the value of the at least one attribute determined from the digital interaction exceeds a selected threshold.

20. The system of claim 19, wherein the selected threshold is determined based on the output of the sensor.

21. At least one computer-readable storage medium having stored thereon instructions which, when executed, program at least one processor to perform a method for analyzing a digital interaction, the method comprising acts of:

determining whether the digital interaction is suspicious;

in response to determining that the digital interaction is suspicious, deploying a security probe of a first type to collect first data from the digital interaction;

analyzing first data collected from the digital interaction by the security probe of the first type to determine if the digital interaction continues to appear suspicious;

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction continues to appear suspicious, deploying a security probe of a second type to collect second data from the digital interaction; and

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction no longer appears suspicious, deploying a security probe of a third type to collect third data from the digital interaction.

22. The at least one computer-readable storage medium of claim 21, wherein the act of determining whether the digital interaction is suspicious comprises an act of:

matching the digital interaction to a profile comprising at least one anomalous attribute.

23. The at least one computer-readable storage medium of claim 22, wherein the act of matching the digital interaction to the profile comprises acts of:

determining, from the digital interaction, a value of the at least one anomalous attribute;

determining, based on information stored in the profile, whether the value of the at least one anomalous attribute exhibits an anomaly; and

in response to determining that the value of the at least one anomalous attribute exhibits an anomaly, calculating a penalty score for the digital interaction.

24. The at least one computer-readable storage medium of claim 23, wherein the digital interaction is determined to be suspicious if the penalty score exceeds a selected threshold.

25. The at least one computer-readable storage medium of claim 21, wherein the security probe of a first type comprises at least one JavaScript statement to be executed by a computing device carrying out the digital interaction, and wherein the act of analyzing first data collected from the digital interaction by the security probe of the first type comprises:

analyzing an execution result received from the computing device to determine if the execution result is consistent with a user agent type reported in the digital interaction.

26. The at least one computer-readable storage medium of claim 25, wherein:

the at least one JavaScript statement comprises at least one first JavaScript statement;

the security probe of a second type comprises at least one second JavaScript statement to be executed by the computing device carrying out the digital interaction; and

the method further comprises an act of analyzing second data collected from the digital interaction by the security probe of the second type to determine if a JavaScript engine is running on the computer device.

27. The at least one computer-readable storage medium of claim 25, wherein the security probe of a third type comprises at least one instruction to manipulate a GUI field, and wherein the method further comprises acts of:

receiving third data collected from the digital interaction by the security probe of the third type, the third data comprising at least one pointer event; and

determining whether the at least one pointer event is consistent with the at least one instruction to manipulate a GUI field.

28. The at least one computer-readable storage medium of claim 21, wherein the method further comprises acts of:

using a sensor to monitor at least one attribute of a plurality of digital interactions;

determining, based on an output of the sensor, whether the at least one attribute is anomalous; and

in response to determining that the at least one attribute is anomalous;

determining, from the digital interaction, a value of the at least one attribute; and

determining, based on the output of the sensor, whether the value of the at least one attribute determined from the digital interaction exhibits an anomaly, wherein the digital interaction is determined to be suspicious if it is determined that the value of the at least one attribute determined from the digital interaction exhibits an anomaly.

29. The at least one computer-readable storage medium of claim 28, wherein determining whether the value of the at least one attribute determined from the digital interaction exhibits an anomaly comprises determining whether the value of the at least one attribute determined from the digital interaction exceeds a selected threshold.

30. The at least one computer-readable storage medium of claim 29, wherein the selected threshold is determined based on the output of the sensor.