Systems and methods for detecting and scoring anomalies
First Claim
1. A computer-implemented method for analyzing a web site or mobile device app interaction, the method comprising acts of:
- identifying a plurality of attributes from a web site or mobile device app profile;
for each attribute of the plurality of attributes, determining whether the web site or mobile device app interaction matches the profile with respect to the attribute, comprising;
identifying, from the profile, at least one bucket of possible values of the attribute, the at least one bucket being indicative of anomalous behavior;
identifying, from the web site or mobile device app interaction, a value of the attribute; and
determining whether the value identified from the web site or mobile device app interaction falls into the at least one bucket, wherein the web site or mobile device app interaction is determined to match the profile with respect to the attribute if it is determined that the value identified from the web site or mobile device app interaction falls into the at least one bucket, and wherein, for at least one attribute of the plurality of attributes;
the value identified from the web site or mobile device app interaction comprises a time measurement between a first user activity and a second user activity recorded from the web site or mobile device app interaction; and
the at least one bucket of possible values of the at least one attribute comprises a range of time measurements;
determining a penalty score based at least in part on a count of attributes with respect to which the web site or mobile device app interaction matches the profile; and
displaying, via a backend user interface, a risk assessment report to an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted, wherein the risk assessment report is based on the penalty score for the web site or mobile device app interaction.
2 Assignments
0 Petitions
Accused Products
Abstract
Systems and methods for detecting and scoring anomalies. In some embodiments, a method is provided, comprising acts of: identifying a plurality of attributes from a profile; for each attribute of the plurality of attributes, determining whether the digital interaction matches the profile with respect to the attribute, comprising: identifying, from the profile, at least one bucket of possible values of the attribute, the at least one bucket being indicative of anomalous behavior; identifying, from the digital interaction, a value of the attribute; and determining whether the value identified from the digital interaction falls into the at least one bucket, wherein the digital interaction is determined to match the profile with respect to the attribute if it is determined that the value identified from the digital interaction falls into the at least one bucket; and determining a penalty score.
84 Citations
18 Claims
-
1. A computer-implemented method for analyzing a web site or mobile device app interaction, the method comprising acts of:
-
identifying a plurality of attributes from a web site or mobile device app profile; for each attribute of the plurality of attributes, determining whether the web site or mobile device app interaction matches the profile with respect to the attribute, comprising; identifying, from the profile, at least one bucket of possible values of the attribute, the at least one bucket being indicative of anomalous behavior; identifying, from the web site or mobile device app interaction, a value of the attribute; and determining whether the value identified from the web site or mobile device app interaction falls into the at least one bucket, wherein the web site or mobile device app interaction is determined to match the profile with respect to the attribute if it is determined that the value identified from the web site or mobile device app interaction falls into the at least one bucket, and wherein, for at least one attribute of the plurality of attributes; the value identified from the web site or mobile device app interaction comprises a time measurement between a first user activity and a second user activity recorded from the web site or mobile device app interaction; and the at least one bucket of possible values of the at least one attribute comprises a range of time measurements; determining a penalty score based at least in part on a count of attributes with respect to which the web site or mobile device app interaction matches the profile; and displaying, via a backend user interface, a risk assessment report to an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted, wherein the risk assessment report is based on the penalty score for the web site or mobile device app interaction. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A system comprising at least one processor and at least one computer-readable storage medium having stored thereon instructions which, when executed, program the at least one processor to perform a method for analyzing a web site or mobile device app interaction, the method comprising acts of:
-
identifying a plurality of attributes from a web site or mobile device app profile; for each attribute of the plurality of attributes, determining whether the web site or mobile device app interaction matches the profile with respect to the attribute, comprising; identifying, from the profile, at least one bucket of possible values of the attribute, the at least one bucket being indicative of anomalous behavior; identifying, from the web site or mobile device app interaction, a value of the attribute; and determining whether the value identified from the web site or mobile device app interaction falls into the at least one bucket, wherein the web site or mobile device app interaction is determined to match the profile with respect to the attribute if it is determined that the value identified from the web site or mobile device app interaction falls into the at least one bucket, and wherein, for at least one attribute of the plurality of attributes; the value identified from the web site or mobile device app interaction comprises a time measurement between a first user activity and a second user activity recorded from the web site or mobile device app interaction; and the at least one bucket of possible values of the at least one attribute comprises a range of time measurements; determining a penalty score based at least in part on a count of attributes with respect to which the web site or mobile device app interaction matches the profile; and displaying, via a backend user interface, a risk assessment report to an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted, wherein the risk assessment report is based on the penalty score for the web site or mobile device app interaction. - View Dependent Claims (8, 9, 10, 11, 12)
-
-
13. At least one non-transitory computer-readable storage medium having stored thereon instructions which, when executed, program at least one processor to perform a method for analyzing a web site or mobile device app interaction, the method comprising acts of:
-
identifying a plurality of attributes from a web site or mobile device app profile; for each attribute of the plurality of attributes, determining whether the web site or mobile device app interaction matches the profile with respect to the attribute, comprising; identifying, from the profile, at least one bucket of possible values of the attribute, the at least one bucket being indicative of anomalous behavior; identifying, from the web site or mobile device app interaction, a value of the attribute; and determining whether the value identified from the web site or mobile device app interaction falls into the at least one bucket, wherein the web site or mobile device app interaction is determined to match the profile with respect to the attribute if it is determined that the value identified from the web site or mobile device app interaction falls into the at least one bucket, and wherein, for at least one attribute of the plurality of attributes; the value identified from the web site or mobile device app interaction comprises a time measurement between a first user activity and a second user activity recorded from the web site or mobile device app interaction; and the at least one bucket of possible values of the at least one attribute comprises a range of time measurements; determining a penalty score based at least in part on a count of attributes with respect to which the web site or mobile device app interaction matches the profile; and displaying, via a backend user interface, a risk assessment report to an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted, wherein the risk assessment report is based on the penalty score for the web site or mobile device app interaction. - View Dependent Claims (14, 15, 16, 17, 18)
-
Specification