Systems and methods for assessing security risk

• US 9,633,190 B2
• Filed: 03/18/2014
• Issued: 04/25/2017
• Est. Priority Date: 04/01/2008
• Status: Active Grant

• Current Assignee: NuData Security Inc. (MasterCard Incorporated)
• Original Assignee: NuData Security Inc. (MasterCard Incorporated)
• Inventors: Bailey, Christopher Everett
• Primary Examiner(s): Gaffin, Jeffrey A
• Assistant Examiner(s): Torres, Ayesha Huertas
• Application Number:
  US14/218,824
• Publication Number:
  US 20140317750A1
• Time in Patent Office: 1,134 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 30/0277 Online advertisement
• CPC Class Codes: G06T 13/80 2D [Two Dimensional] animation, e.g. using sprites
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Systems and methods for providing identification tests. In some embodiments, a system and a method are provided for generating and serving to a user an animated challenge graphic comprising a challenge character set whose appearance may change over time. In some embodiments, marketing content may be incorporated into a challenge message for use in an identification test. The marketing content may be accompanied by randomly selected content to increase a level of security of the identification test, hi some embodiments, a challenge message for use in an identification test may be provided based on information regarding a transaction for which the identification test is administered. For example, the transaction information may include a user identifier such as an IP address. In some embodiments, identification test results may be tracked and analyzed to identify a pattern of behavior associated with a user identifier. A score indicative of a level of trustworthiness may be computed for the user identifier.

Claims

1. A system for assessing security risk, the system comprising at least one processor programmed to:

maintain a plurality of records, wherein;

each record is associated with a respective network address in a plurality of network addresses; and

each record comprises information regarding user behaviors observed from a plurality of previous electronic transactions that have been tagged with the network address associated with the record;

receive log information regarding a present electronic transaction;

use the log information to determine at least one network address from which the present electronic transaction is requested; and

analyze the log information regarding the present electronic transaction in combination with history information associated with the at least one network address, wherein the history information is based on the record associated with the at least one network address and is indicative of at least one user behavior observed from the plurality of previous electronic transactions that have been tagged with the at least one network address; and

while the present electronic transaction is still on-going, provide an updated risk assessment for the at least one network address based on a result of analyzing the log information regarding the present electronic transaction in combination with the history information associated with the at least one network address.

2. The system of claim 1, wherein the at least one processor is further programmed to:

in providing the updated risk assessment, take into account current user information indicative of at least one user behavior observed in connection with the present electronic transaction.

3. The system of claim 1, wherein the at least one processor is further programmed to:

determine, based on the updated risk assessment, whether the present electronic transaction is likely to be associated with an attack at a first publisher; and

upon detecting an attack at the first publisher, notify a second publisher of the attack.

4. The system of claim 1, wherein the at least one processor is further programmed to:

analyze network traffic associated with the present electronic transaction to determine data forwarding information indicative of whether data is forwarded by a proxy server; and

in providing the updated risk assessment, take into account the data forwarding information.

5. The system of claim 1, wherein the at least one processor is further programmed to:

determine a geographical location associated with the present electronic transaction;

in providing the updated risk assessment, take into account the geographical location.

6. The system of claim 1, wherein the at least one processor is further programmed to:

determine a time of day, week, or month associated with the present electronic transaction;

in providing the updated risk assessment, take into account the time of day, week, or month.

7. The system of claim 1, wherein the at least one processor is further programmed to:

determine a hosting provider associated with the present electronic transaction;

in providing the updated risk assessment, take into account the hosting provider.

8. The system of claim 1, wherein the at least one processor is further programmed to:

determine a network owner associated with the present electronic transaction;

in providing the updated risk assessment, take into account the network owner.

9. The system of claim 1, wherein, in analyzing the log information regarding the present electronic transaction in combination with history information associated with the at least one network address, the at least one processor is programmed to apply a first weighting to the log information regarding the present electronic transaction, and a second weighting to the history information associated with the at least one network address, the second weighting being different from the first weighting.

10. The system of claim 1, wherein the log information regarding the present electronic transaction comprises an indication of an amount of time taken by a user to perform an action in connection with the present electronic transaction.

11. A method for assessing security risk, the method comprising acts of:

maintaining a plurality of records, wherein;

each record is associated with a respective network address in a plurality of network addresses; and

each record comprises information regarding user behaviors observed from a plurality of previous electronic transactions that have been tagged with the network address associated with the record;

receiving log information regarding a present electronic transaction;

using the log information to determine at least one network address from which the present electronic transaction is requested; and

analyzing the log information regarding the present electronic transaction in combination with history information associated with the at least one network address, wherein the history information is based on the record associated with the at least one network address and is indicative of at least one user behavior observed from the plurality of previous electronic transactions that have been tagged with the at least one network address; and

while the present electronic transaction is still on-going, providing an updated risk assessment for the at least one network address based on a result of analyzing the log information regarding the present electronic transaction in combination with the history information associated with the at least one network address.

12. The method of claim 11, wherein current user information indicative of at least one user behavior observed in connection with the present electronic transaction is taken into account in the act of providing the updated risk assessment.

13. The method of claim 11, further comprising acts of:

determining, based on the updated risk assessment, whether the present electronic transaction is likely to be associated with an attack at a first publisher; and

upon detecting an attack at the first publisher, notifying a second publisher of the attack.

14. The method of claim 11, further comprising an act of:

analyzing network traffic associated with the present electronic transaction to determine data forwarding information indicative of whether data is forwarded by a proxy server, wherein the data forwarding information is taken into account in the act of providing the updated risk assessment.

15. The method of claim 11, further comprising an act of:

determining a geographical location associated with the present electronic transaction, wherein the geographical location is taken into account in the act of providing the updated risk assessment.

16. The method of claim 11, further comprising an act of:

determining a time of day, week, or month associated with the present electronic transaction, wherein the day, week, or month is taken into account in the act of providing the updated risk assessment.

17. The method of claim 11, further comprising an act of:

determining a hosting provider associated with the present electronic transaction, wherein the hosting provider is taken into account in the act of providing the updated risk assessment.

18. The method of claim 11, further comprising an act of:

determining a network owner associated with the present electronic transaction, wherein the network owner is taken into account in the act of providing the updated risk assessment.

19. The method of claim 11, wherein the act of analyzing the log information regarding the present electronic transaction in combination with history information associated with the at least one network address comprises:

applying a first weighting to the log information regarding the present electronic transaction, and a second weighting to the history information associated with the at least one network address, the second weighting being different from the first weighting.

20. The method of claim 11, wherein the log information regarding the present electronic transaction comprises an indication of an amount of time taken by a user to perform an action in connection with the present electronic transaction.

21. At least one non-transitory computer-readable medium encoded with a plurality of instructions that, when executed by at least one processor, perform a method for assessing security risk, the method comprising acts of:

maintaining a plurality of records, wherein;

each record is associated with a respective network address in a plurality of network addresses; and

each record comprises information regarding user behaviors observed from a plurality of previous electronic transactions that have been tagged with the network address associated with the record;

receiving log information regarding a present electronic transaction;

using the log information to determine at least one network address from which the present electronic transaction is requested; and

analyzing the log information regarding the present electronic transaction in combination with history information associated with the at least one network address, wherein the history information is based on the record associated with the at least one network address and is indicative of at least one user behavior observed from the plurality of previous electronic transactions that have been tagged with the at least one network address; and

while the present electronic transaction is still on-going, providing an updated risk assessment for the at least one network address based on a result of analyzing the log information regarding the present electronic transaction in combination with the history information associated with the at least one network address.