Systems and methods for matching and scoring sameness

• US 9,749,358 B2
• Filed: 09/04/2016
• Issued: 08/29/2017
• Est. Priority Date: 09/05/2015
• Status: Active Grant

• Current Assignee: NuData Security Inc. (MasterCard Incorporated)
• Original Assignee: NuData Security Inc. (MasterCard Incorporated)
• Inventors: Bailey, Christopher Everett, Lukashuk, Randy, Richardson, Gary Wayne
• Primary Examiner(s): TRAN, ELLEN C
• Application Number:
  US15/256,617
• Publication Number:
  US 20170070527A1
• Time in Patent Office: 359 Days
• Field of Search: 726 25
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 7/08 Sorting, i.e. grouping record carriers in numerical or other ordered sequence according to the classification of at least some of the information they carry by merging two or more sets of carriers in ordered sequence G06F7/16
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/30 : Profiles
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Systems and methods for matching and scoring sameness. In some embodiments, a computer-implemented method is provided, comprising acts of: identifying an anchor value X from the first digital interaction; identifying a first plurality of past digital interactions from which the anchor value X was previously observed, wherein each past digital interaction of the first plurality of past digital interactions has associated therewith a respective sameness score; select a second plurality of past digital interactions from the first plurality of past digital interactions based at least in part on the respective sameness scores; generating a profile for the anchor value X based on the second plurality of past digital interactions; and determining a biometric score for the first digital interaction.

Claims

1. A computer-implemented method for analyzing a first web site or mobile device app interaction, the method comprising acts of:

identifying an anchor value X from the first web site or mobile device app interaction, wherein the anchor value X is of an anchor type selected from a group consisting of;

account identifier, email address, phone number, credit card number, device identifier, device characteristic, network address, and location;

identifying a first plurality of past digital interactions from which the anchor value X was observed, wherein each past digital interaction of the first plurality of past digital interactions has associated therewith a respective sameness score;

filtering the first plurality of past digital interactions based at least in part on the respective sameness scores, to thereby obtain a second plurality of past digital interactions, wherein the second plurality of past digital interactions comprise fewer digital interactions than the first plurality of past digital interactions;

generating a dynamic profile for the anchor value X based on the second plurality of past digital interactions, wherein;

the dynamic profile comprises historical information regarding each attribute of a plurality of attributes; and

the plurality of attributes are selected based on measurements taken from the second plurality of past digital interactions;

for at least one attribute A₁ of the plurality of attributes, determining a value V₁ based on one or more measurements taken from the first web site or mobile device app interaction, wherein the one or more measurements relate to a physical interaction between a user and a device;

determining a biometric score for the first web site or mobile device app interaction at least in part by comparing the value V₁ of the at least one attribute A₁ against the historical information regarding the at least one attribute A₁; and

displaying, via a backend user interface, a risk assessment report to an operator of a web site or mobile device app via which the first web site or mobile device app interaction is conducted, wherein the risk assessment report is based on the biometric score for the first web site or mobile device app interaction.

2. The computer-implemented method of claim 1, wherein:

the one or more measurements include a sequence of measurements taken from the first web site or mobile device app interaction; and

each measurement in the sequence of measurements has associated therewith a respective timestamp.

3. The computer-implemented method of claim 2, wherein:

each measurement in the sequence of measurements comprises a measurement selected from a group consisting of;

a keystroke, a mouse click, a pointer location, an accelerometer reading, a gyroscope reading, a light sensor reading, a pressure sensor reading, and a noise sensor reading.

4. The computer-implemented method of claim 1, wherein:

the historical information regarding the at least one attribute A₁ comprises a historical mean and a historical standard deviation; and

the historical mean and the historical standard deviation are determined based on historical values of the at least one attribute A₁, the historical values being obtained from measurements taken from the second plurality of past digital interactions.

5. The computer-implemented method of claim 4, wherein the biometric score for the first web site or mobile device app interaction is determined at least in part by:

determining a difference between the historical mean and the value V₁ of the at least one attribute A₁; and

comparing the difference against the historical standard deviation.

6. The computer-implemented method of claim 1, wherein the plurality of attributes comprises a first plurality of attributes selected from a second plurality of attributes, and wherein the method further comprises acts of:

for each attribute of the second plurality of attributes, determine a respective quality metric based on values of the attribute, the values being obtained from measurements taken from the second plurality of past digital interactions; and

selecting the first plurality of attributes from the second plurality of attributes based at least in part on the respective quality metrics.

7. The computer-implemented method of claim 6, wherein:

for at least one attribute A₂ of the second plurality of attributes, the quality metric is determined at least in part by comparing, against a population distribution for the at least one attribute A₂, a mean and a standard deviation that are determined based on the values of the at least one attribute A₂ obtained from measurements taken from the second plurality of past digital interactions.

8. A system comprising at least one processor and at least one computer-readable storage medium having stored thereon instructions which, when executed, program the at least one processor to perform a method for analyzing a first web site or mobile device app interaction, the method comprising acts of:

identifying an anchor value X from the first web site or mobile device app interaction, wherein the anchor value X is of an anchor type selected from a group consisting of;

account identifier, email address, phone number, credit card number, device identifier, device characteristic, network address, and location;

identifying a first plurality of past digital interactions from which the anchor value X was observed, wherein each past digital interaction of the first plurality of past digital interactions has associated therewith a respective sameness score;

filtering the first plurality of past digital interactions based at least in part on the respective sameness scores, to thereby obtain a second plurality of past digital interactions, wherein the second plurality of past digital interactions comprise fewer digital interactions than the first plurality of past digital interactions;

generating a dynamic profile for the anchor value X based on the second plurality of past digital interactions, wherein;

the dynamic profile comprises historical information regarding each attribute of a plurality of attributes; and

the plurality of attributes are selected based on measurements taken from the second plurality of past digital interactions;

for at least one attribute A₁ of the plurality of attributes, determining a value V₁ based on one or more measurements taken from the first web site or mobile device app interaction, wherein the one or more measurements relate to a physical interaction between a user and a device;

determining a biometric score for the first web site or mobile device app interaction at least in part by comparing the value V₁ of the at least one attribute A₁ against the historical information regarding the at least one attribute A₁; and

displaying, via a backend user interface, a risk assessment report to an operator of a web site or mobile device app via which the first web site or mobile device app interaction is conducted, wherein the risk assessment report is based on the biometric score for the first web site or mobile device app interaction.

9. The system of claim 8, wherein:

the one or more measurements include a sequence of measurements taken from the first web site or mobile device app interaction; and

each measurement in the sequence of measurements has associated therewith a respective timestamp.

10. The system of claim 9, wherein:

each measurement in the sequence of measurements comprises a measurement selected from a group consisting of;

a keystroke, a mouse click, a pointer location, an accelerometer reading, a gyroscope reading, a light sensor reading, a pressure sensor reading, and a noise sensor reading.

11. The system of claim 8, wherein:

the historical information regarding the at least one attribute A₁ comprises a historical mean and a historical standard deviation; and

the historical mean and the historical standard deviation are determined based on historical values of the at least one attribute A₁, the historical values being obtained from measurements taken from the second plurality of past digital interactions.

12. The system of claim 11, wherein the biometric score for the first web site or mobile device app interaction is determined at least in part by:

determining a difference between the historical mean and the value V₁ of the at least one attribute A₁; and

comparing the difference against the historical standard deviation.

13. The system of claim 8, wherein the plurality of attributes comprises a first plurality of attributes selected from a second plurality of attributes, and wherein the method further comprises acts of:

for each attribute of the second plurality of attributes, determine a respective quality metric based on values of the attribute, the values being obtained from measurements taken from the second plurality of past digital interactions; and

selecting the first plurality of attributes from the second plurality of attributes based at least in part on the respective quality metrics.

14. The system of claim 13, wherein:

for at least one attribute A₂ of the second plurality of attributes, the quality metric is determined at least in part by comparing, against a population distribution for the at least one attribute A₂, a mean and a standard deviation that are determined based on the values of the at least one attribute A₂ obtained from measurements taken from the second plurality of past digital interactions.

15. At least one non-transitory computer-readable medium having stored thereon instructions which, when executed, program at least one processor to perform a method for analyzing a first web site or mobile device app interaction, the method comprising acts of:

identifying an anchor value X from the first web site or mobile device app interaction, wherein the anchor value X is of an anchor type selected from a group consisting of;

account identifier, email address, phone number, credit card number, device identifier, device characteristic, network address, and location;

identifying a first plurality of past digital interactions from which the anchor value X was observed, wherein each past digital interaction of the first plurality of past digital interactions has associated therewith a respective sameness score;

filtering the first plurality of past digital interactions based at least in part on the respective sameness scores, to thereby obtain a second plurality of past digital interactions, wherein the second plurality of past digital interactions comprise fewer digital interactions than the first plurality of past digital interactions;

generating a dynamic profile for the anchor value X based on the second plurality of past digital interactions, wherein;

the dynamic profile comprises historical information regarding each attribute of a plurality of attributes; and

the plurality of attributes are selected based on measurements taken from the second plurality of past digital interactions;

for at least one attribute A₁ of the plurality of attributes, determining a value V₁ based on one or more measurements taken from the first web site or mobile device app interaction, wherein the one or more measurements relate to a physical interaction between a user and a device;

determining a biometric score for the first web site or mobile device app interaction at least in part by comparing the value V₁ of the at least one attribute A₁ against the historical information regarding the at least one attribute A₁; and

displaying, via a backend user interface, a risk assessment report to an operator of a web site or mobile device app via which the first web site or mobile device app interaction is conducted, wherein the risk assessment report is based on the biometric score for the first web site or mobile device app interaction.

16. The at least one non-transitory computer-readable medium of claim 15, wherein:

the one or more measurements include a sequence of measurements taken from the first web site or mobile device app interaction; and

each measurement in the sequence of measurements has associated therewith a respective timestamp.

17. The at least one non-transitory computer-readable medium of claim 16, wherein:

each measurement in the sequence of measurements comprises a measurement selected from a group consisting of;

a keystroke, a mouse click, a pointer location, an accelerometer reading, a gyroscope reading, a light sensor reading, a pressure sensor reading, and a noise sensor reading.

18. The at least one non-transitory computer-readable medium of claim 15, wherein:

the historical information regarding the at least one attribute A₁ comprises a historical mean and a historical standard deviation; and

the historical mean and the historical standard deviation are determined based on historical values of the at least one attribute A₁, the historical values being obtained from measurements taken from the second plurality of past digital interactions.

19. The at least one non-transitory computer-readable medium of claim 18, wherein the biometric score for the first web site or mobile device app interaction is determined at least in part by:

determining a difference between the historical mean and the value V₁ of the at least one attribute A₁; and

comparing the difference against the historical standard deviation.

20. The at least one non-transitory computer-readable medium of claim 15, wherein the plurality of attributes comprises a first plurality of attributes selected from a second plurality of attributes, and wherein the method further comprises acts of:

for each attribute of the second plurality of attributes, determine a respective quality metric based on values of the attribute, the values being obtained from measurements taken from the second plurality of past digital interactions; and

selecting the first plurality of attributes from the second plurality of attributes based at least in part on the respective quality metrics.

21. The at least one non-transitory computer-readable medium of claim 20, wherein:

for at least one attribute A₂ of the second plurality of attributes, the quality metric is determined at least in part by comparing, against a population distribution for the at least one attribute A₂, a mean and a standard deviation that are determined based on the values of the at least one attribute A₂ obtained from measurements taken from the second plurality of past digital interactions.