Systems and methods for matching and scoring sameness

• US 9,680,868 B2
• Filed: 09/04/2016
• Issued: 06/13/2017
• Est. Priority Date: 09/05/2015
• Status: Active Grant

• Current Assignee: NuData Security Inc. (MasterCard Incorporated)
• Original Assignee: NuData Security Inc. (MasterCard Incorporated)
• Inventors: Bailey, Christopher Everett, Lukashuk, Randy, Richardson, Gary Wayne
• Primary Examiner(s): TRAN, ELLEN C
• Application Number:
  US15/256,616
• Publication Number:
  US 20170070526A1
• Time in Patent Office: 282 Days
• Field of Search: 726 25
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 7/08 Sorting, i.e. grouping record carriers in numerical or other ordered sequence according to the classification of at least some of the information they carry by merging two or more sets of carriers in ordered sequence G06F7/16
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/30 : Profiles
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Systems and methods for matching and scoring sameness. In some embodiments, a computer-implemented method is provided, comprising acts of: identifying an anchor value X from the digital interaction; identifying, in a record of the digital interaction, a data structure associated with an anchor type T of the anchor value, wherein a plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values; identifying a bucket B of the plurality of buckets of anchor values, wherein the anchor value X falls into the bucket B; and operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the digital interaction.

Claims

1. A computer-implemented method for analyzing a web site or mobile device app interaction, the method comprising acts of:

identifying an anchor value X from the web site or mobile device app interaction;

identifying, in a record of the web site or mobile device app interaction, a data structure associated with an anchor type T of the anchor value X, wherein a plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values, and wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier;

identifying a bucket B of the plurality of buckets of anchor values, wherein the anchor value X falls into the bucket B;

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction;

looking up the anchor value X in the data structure associated with the anchor type T to determine if the anchor value X has been stored in the data structure associated with the anchor type T;

in response to determining that the anchor value X has not been stored in the data structure associated with the anchor type T, storing the anchor value X in the data structure associated with the anchor type T;

using the data structure associated with the anchor type T to generate a score indicative of a level of risk associated with the web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted.

2. The computer-implemented method of claim 1, wherein:

the plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values of the anchor type T.

3. The computer-implemented method of claim 2, wherein:

the hash-modding operation divides the plurality of anchor values of the anchor type T into M buckets;

the data structure associated with the anchor type T comprises an M-bit value, wherein each bit of the M-bit value corresponds to a respective bucket of the M buckets; and

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction comprises setting a bit of the M-bit value to 1, the bit corresponding to the bucket B.

4. The computer-implemented method of claim 1, wherein:

the data structure associated with the anchor type T is configured to store N distinct anchor values of the anchor type T.

5. The computer-implemented method of claim 4, further comprising an act of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T, wherein;

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that fewer than N distinct anchor values have been stored in the data structure associated with the anchor type T.

6. The computer-implemented method of claim 4, wherein:

if N distinct anchor values have been stored in the data structure associated with the anchor type T, the anchor value X replaces an oldest anchor value in the data structure associated with the anchor type T.

7. The computer-implemented method of claim 4, further comprising acts of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T; and

determining if the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T, wherein;

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that N distinct anchor values have been stored in the data structure associated with the anchor type T, but the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T; and

the anchor value X replaces a lowest utility anchor value in the data structure associated with the anchor type T.

8. The computer-implemented method of claim 1, wherein:

the record of the web site or mobile device app interaction comprises a plurality of data structures associated, respectively, with a plurality of anchor types; and

for each anchor type of the plurality of anchor types, the data structure associated with that anchor type stores a plurality of distinct anchor values of that anchor type.

9. A system comprising at least one processor and at least one computer-readable storage medium having stored thereon instructions which, when executed, program the at least one processor to perform a method for analyzing a web site or mobile device app interaction, the method comprising acts of:

identifying an anchor value X from the web site or mobile device app interaction;

identifying, in a record of the web site or mobile device app interaction, a data structure associated with an anchor type T of the anchor value X, wherein a plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values, and wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier;

identifying a bucket B of the plurality of buckets of anchor values, wherein the anchor value X falls into the bucket B;

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction;

looking up the anchor value X in the data structure associated with the anchor type T to determine if the anchor value X has been stored in the data structure associated with the anchor type T;

in response to determining that the anchor value X has not been stored in the data structure associated with the anchor type T, storing the anchor value X in the data structure associated with the anchor type T;

using the data structure associated with the anchor type T to generate a score indicative of a level of risk associated with the web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted.

10. The system of claim 9, wherein:

the plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values of the anchor type T.

11. The system of claim 10, wherein:

the hash-modding operation divides the plurality of anchor values of the anchor type T into M buckets;

the data structure associated with the anchor type T comprises an M-bit value, wherein each bit of the M-bit value corresponds to a respective bucket of the M buckets; and

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction comprises setting a bit of the M-bit value to 1, the bit corresponding to the bucket B.

12. The system of claim 9, wherein:

the data structure associated with the anchor type T is configured to store N distinct anchor values of the anchor type T.

13. The system of claim 12, wherein the method further comprises an act of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T, wherein;

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that fewer than N distinct anchor values have been stored in the data structure associated with the anchor type T.

14. The system of claim 12, wherein:

if N distinct anchor values have been stored in the data structure associated with the anchor type T, the anchor value X replaces an oldest anchor value in the data structure associated with the anchor type T.

15. The system of claim 12, wherein the method further comprises acts of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T; and

determining if the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T, wherein;

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that N distinct anchor values have been stored in the data structure associated with the anchor type T, but the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T; and

the anchor value X replaces a lowest utility anchor value in the data structure associated with the anchor type T.

16. The system of claim 9, wherein:

the record of the web site or mobile device app interaction comprises a plurality of data structures associated, respectively, with a plurality of anchor types; and

for each anchor type of the plurality of anchor types, the data structure associated with that anchor type stores a plurality of distinct anchor values of that anchor type.

17. At least one non-transitory computer-readable storage medium having stored thereon instructions which, when executed, program at least one processor to perform a method for analyzing a web site or mobile device app interaction, the method comprising acts of:

identifying an anchor value X from the web site or mobile device app interaction;

identifying, in a record of the web site or mobile device app interaction, a data structure associated with an anchor type T of the anchor value X, wherein a plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values, and wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier;

identifying a bucket B of the plurality of buckets of anchor values, wherein the anchor value X falls into the bucket B;

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction;

looking up the anchor value X in the data structure associated with the anchor type T to determine if the anchor value X has been stored in the data structure associated with the anchor type T;

in response to determining that the anchor value X has not been stored in the data structure associated with the anchor type T, storing the anchor value X in the data structure associated with the anchor type T;

using the data structure associated with the anchor type T to generate a score indicative of a level of risk associated with the web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted.

18. The at least one non-transitory computer-readable storage medium of claim 17, wherein:

the plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values of the anchor type T.

19. The at least one non-transitory computer-readable storage medium of claim 18, wherein:

the hash-modding operation divides the plurality of anchor values of the anchor type T into M buckets;

the data structure associated with the anchor type T comprises an M-bit value, wherein each bit of the M-bit value corresponds to a respective bucket of the M buckets; and

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction comprises setting a bit of the M-bit value to 1, the bit corresponding to the bucket B.

20. The at least one non-transitory computer-readable storage medium of claim 17, wherein:

the data structure associated with the anchor type T is configured to store N distinct anchor values of the anchor type T.

21. The at least one non-transitory computer-readable storage medium of claim 20, wherein the method further comprises an act of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T, wherein;

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that fewer than N distinct anchor values have been stored in the data structure associated with the anchor type T.

22. The at least one non-transitory computer-readable storage medium of claim 20, wherein:

if N distinct anchor values have been stored in the data structure associated with the anchor type T, the anchor value X replaces an oldest anchor value in the data structure associated with the anchor type T.

23. The at least one non-transitory computer-readable storage medium of claim 20, wherein the method further comprises acts of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T; and

determining if the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T, wherein;

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that N distinct anchor values have been stored in the data structure associated with the anchor type T, but the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T; and

the anchor value X replaces a lowest utility anchor value in the data structure associated with the anchor type T.

24. The at least one non-transitory computer-readable storage medium of claim 17, wherein:

the record of the web site or mobile device app interaction comprises a plurality of data structures associated, respectively, with a plurality of anchor types; and

for each anchor type of the plurality of anchor types, the data structure associated with that anchor type stores a plurality of distinct anchor values of that anchor type.