Behavioral profiling method and system to authenticate a user

• US 9,185,095 B1
• Filed: 03/13/2013
• Issued: 11/10/2015
• Est. Priority Date: 03/20/2012
• Status: Active Grant

• Current Assignee: United Services Automobile Association
• Original Assignee: United Services Automobile Association
• Inventors: Moritz, Karen, Aultman, Stephen Seyler, Campbell, Joseph James Albert, Casillas, Debra, Neuse, Jonathan Edward, Alonzo, Sara Teresa, Buckingham, Thomas Bret, Fernandez, Gabriel Carlos, Mortensen, Maland Keith
• Primary Examiner(s): Le, Chau
• Assistant Examiner(s): Chaudhry, Muhammad
• Application Number:
  US13/801,784
• Time in Patent Office: 972 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/143 Termination or inactivation of sessions, e.g. event-controlled end of session
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Methods and systems for behavioral profiling are described. In some embodiments, a method includes observing behavioral characteristics of user interactions during a current session with the user through one of a plurality of channels. Variations between the behavioral characteristics of the user interactions observed during the current session and a behavioral profile previously developed based on prior usage patterns of the user through the plurality of channels are identified, in real-time or near real-time. For the user to proceed in the session, a challenge level is implemented based on the variations between the behavioral characteristics and the behavioral profile.

Claims

1. A method of user verification comprising:

observing, by a computer processor, behavioral characteristics of user interactions during a current session with a user through one of a plurality of channels;

identifying, in real-time or near real-time, variations between the behavioral characteristics of the user interactions observed during the current session and a behavioral profile previously developed based on prior usage patterns of the user through the plurality of channels, wherein the behavioral profile is based on clicktrail data and authentication logs;

implementing, by the computer processor, a challenge level to proceed in the current session, the challenge level based on the variations between the behavioral characteristics and the behavioral profile and on a risk level of requested activities of the current session; and

when the challenge level to proceed in the current session disallows the user to continue in the current session;

analyzing, by the computer processor, behavioral biometrics of the user,

comparing, by the computer processor, the behavioral biometrics of the user with one or more previous samples of the behavioral biometrics of the user, and

when the comparison of the behavioral biometrics of the user with the one or more previous samples of the behavioral biometrics of the user is within a tolerance, allowing, by the computer processor, the current session to proceed without requesting a user response or notifying the user of the challenge level.

2. The method of claim 1, further comprising receiving current device information, and wherein identifying the variations between the behavioral characteristics and the behavioral profile includes comparing the current device information with historical device information stored in the behavioral profile.

3. The method of claim 2, wherein the current device information includes at least one of the following:

device location, device identification, channel usage on a current device, language, network, or internet service provider.

4. The method of claim 1, wherein identifying the variations includes estimating a distance between the behavioral characteristics in the current session and the behavioral profile, wherein the behavioral profile was further developed based on website behaviors specific to a generation of the user.

5. The method of claim 1, the method further comprising:

developing the behavioral profile by identifying typical usage patterns of behavior of the user from historical usage data;

calculating a distance between the behavioral characteristics in the current session and the behavioral profile; and

validating the behavioral profile during the current session when the behavioral characteristics in the current session are within a predetermined distance from the typical usage patterns of behavior of the user.

6. The method of claim 1, wherein the behavioral profile includes the behavioral characteristics, and wherein the method further comprises representing at least a portion of the behavioral characteristics as metrics.

7. The method of claim 1, wherein the behavioral profile includes the behavioral characteristics, and wherein the behavioral characteristics include at least one of:

a duration between keyboard strokes, an intensity of keyboard presses, a user central processing unit time, a system central processing unit time, an amount of time between user logons, an amount of character IO during application execution, a maximum size of a request, a real user usage over time, a virtual size of text segment, a total number of times opened during the application execution, a number of major and minor page faults, a number of pages accessed, a measure of disk IO, an elapsed time in seconds of the current session, a number of signals received during the application execution, a name of a new user name changed during the current session, a number of unique internet protocol addresses used per month, an hour of day of the current session, a number of distinct pages accessed during the current session, whether an application executed was executed on a remote network host, a number of computers used each month, a name of the remote network host if the application was executed on the remote network host, a name of a local network host on which the application was executed, a number of different users with a same internet protocol address, a number of seconds since a last audit record for the application, or a number of times the user logs in per a predetermined time period.

8. The method of claim 1, the method further comprising:

adapting the behavioral profile based on the behavioral characteristics of the user interactions observed during the current session.

9. The method of claim 8, wherein the behavioral profile is initially created using demographic data of users similar to the user.

10. The method of claim 9, the method further comprising:

removing or deemphasizing at least a portion of the demographic data from the behavioral profile as the behavioral profile of the user is adapted with the behavioral characteristics of the user interactions observed during the current session.

11. The method of claim 1, the method further comprising:

receiving a response to the challenge level;

determining whether the response to the challenge level authenticates the user; and

adapting the behavioral profile based on the behavioral characteristics that triggered the challenge level.

12. The method of claim 11, wherein the challenge level includes at least one of:

allowing the user to proceed with the current session, collecting identifying information, noting suspicious activity, or disallowing the user to proceed with the current session.

13. The method of claim 1, wherein the variations are indicative of a second user, and wherein the method further comprises:

determining that the second user is authorized by the user; and

developing a behavioral profile for the second user.

14. The method of claim 1, wherein the behavioral profile is further based on previous warnings indicating suspicious activity.

15. The method of claim 1, wherein the plurality of channels comprises an internet portal, face-to-face contact, a mobile application, and an instant messaging system.

16. The method of claim 1, wherein the behavioral profile is developed using at least one of the following:

Bayesian network, statistical-based anomaly detection techniques, one or more Markov models, knowledge-based techniques, neural networks, clustering and outlier detection, demographic analysis, genetic algorithms, or fuzzy logic techniques.

17. A computer-implemented method of fraud prediction comprising:

passively identifying a user interacting through a channel during a current session;

retrieving, from a database, a predictive behavioral profile associated with the user, wherein the predictive behavioral profile receives current user interactions with the channel and estimates a distance from prior usage patterns of the user, and wherein the predictive behavioral profile is based on clicktrail data and authentication logs;

identifying, by a computer processor, in real-time or near real-time, variations between current usage patterns of the user and the predictive behavioral profile;

calculating similarity or distance measures between the current session of the user and the predictive behavioral profile;

translating a set of the calculated similarity or distance measures into a single confidence measure;

implementing a challenge level to proceed in the current session, wherein the challenge level is based on a risk level of requested activities of the current session; and

when the challenge level to proceed in the current session disallows the user to continue in the current session;

analyzing, by the computer processor, behavioral biometrics of the user,

comparing, by the computer processor, the behavioral biometrics of the user with one or more previous samples of the behavioral biometrics of the user, and

when the comparison of the behavioral biometrics of the user with the one or more previous samples of the behavioral biometrics of the user is within a tolerance, allowing, by the computer processor, the current session to proceed without requesting a user response or notifying the user of the challenge level.

18. The computer-implemented method of claim 17, further comprising developing the predictive behavioral profile using at least one of the following:

Bayesian network, statistical-based anomaly detection techniques, one or more Markov models, knowledge-based techniques, neural networks, clustering and outlier detection, demographic analysis, genetic algorithms, or fuzzy logic techniques.

19. A system for authenticating a user, the system comprising:

a memory; and

a processor in communication with the memory, the processor configured to execute software modules, the software modules comprising;

a channel communication module configured to engage in one or more sessions with a user via a plurality of channels;

an information gathering module configured to;

monitor user behavior during the one or more sessions; and

collect demographic data relating to the user;

a behavioral profile generation module configured to;

develop a user behavioral profile based on the user behavior, the user behavioral profile including patterns of behavior that are typical of the user, wherein the user behavioral profile is based on clicktrail data and authentication logs;

the channel communication module further configured to observe the user behavior during a session;

a variation determining module configured to determine, in near real-time, variations between the user behavior observed during the session and the user behavioral profile; and

a challenge module configured to;

implement a challenge level to proceed with the session based on the variations, wherein the challenge level is based on a risk level of requested activities of the session;

adapt the user behavioral profile with the user behavior from the session; and

when the challenge level to proceed in the session disallows the user to continue in the session;

analyzing behavioral biometrics of the user,

comparing the behavioral biometrics of the user with one or more previous samples of the behavioral biometrics of the user, and

when the comparison of the behavioral biometrics of the user with the one or more previous samples of the behavioral biometrics of the user is within a tolerance, allowing the session to proceed without requesting a user response or notifying the user of the challenge level.

20. The system of claim 19, wherein the user behavioral profile is further based on website behaviors specific to a generation of the user.