Systems and methods for detecting and scoring anomalies

• US 9,749,356 B2
• Filed: 09/04/2016
• Issued: 08/29/2017
• Est. Priority Date: 09/05/2015
• Status: Active Grant

• Current Assignee: NuData Security Inc. (MasterCard Incorporated)
• Original Assignee: NuData Security Inc. (MasterCard Incorporated)
• Inventors: Bailey, Christopher Everett, Lukashuk, Randy, Richardson, Gary Wayne
• Primary Examiner(s): TRAN, ELLEN C
• Application Number:
  US15/256,600
• Publication Number:
  US 20170070522A1
• Time in Patent Office: 359 Days
• Field of Search: 726 25
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 7/08 Sorting, i.e. grouping record carriers in numerical or other ordered sequence according to the classification of at least some of the information they carry by merging two or more sets of carriers in ordered sequence G06F7/16
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/30 : Profiles
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Systems and methods for detecting and scoring anomalies. In some embodiments, a method is provided, comprising acts of: identifying a plurality of attributes from a profile; for each attribute of the plurality of attributes, determining whether the digital interaction matches the profile with respect to the attribute, comprising: identifying, from the profile, at least one bucket of possible values of the attribute, the at least one bucket being indicative of anomalous behavior; identifying, from the digital interaction, a value of the attribute; and determining whether the value identified from the digital interaction falls into the at least one bucket, wherein the digital interaction is determined to match the profile with respect to the attribute if it is determined that the value identified from the digital interaction falls into the at least one bucket; and determining a penalty score.

Claims

1. A computer-implemented method for analyzing a web site or mobile device app interaction, the method comprising acts of:

identifying a plurality of attributes from a web site or mobile device app profile;

for each attribute of the plurality of attributes, determining whether the web site or mobile device app interaction matches the profile with respect to the attribute, comprising;

identifying, from the profile, at least one bucket of possible values of the attribute, the at least one bucket being indicative of anomalous behavior;

identifying, from the web site or mobile device app interaction, a value of the attribute; and

determining whether the value identified from the web site or mobile device app interaction falls into the at least one bucket, wherein the web site or mobile device app interaction is determined to match the profile with respect to the attribute if it is determined that the value identified from the web site or mobile device app interaction falls into the at least one bucket, and wherein, for at least one attribute of the plurality of attributes;

the value identified from the web site or mobile device app interaction comprises a time measurement between a first user activity and a second user activity recorded from the web site or mobile device app interaction; and

the at least one bucket of possible values of the at least one attribute comprises a range of time measurements;

determining a penalty score based at least in part on a count of attributes with respect to which the web site or mobile device app interaction matches the profile; and

displaying, via a backend user interface, a risk assessment report to an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted, wherein the risk assessment report is based on the penalty score for the web site or mobile device app interaction.

2. The method of claim 1, wherein the at least one attribute comprises at least one first attribute, and wherein, for at least one second attribute:

the act of determining whether the value identified from the web site or mobile device app interaction falls into the at least one bucket comprises applying a hash-modding operation to the value identified from the web site or mobile device app interaction; and

the at least one bucket corresponds to a residue of the hash-modding operation.

3. The method of claim 2, wherein the act of identifying, from the web site or mobile device app interaction, a value of the at least one second attribute comprises:

recording, from the web site or mobile device app interaction, an observation with respect to the at least one second attribute; and

deriving the value of the at least one second attribute based on the observation recorded from the web site or mobile device app interaction.

4. The method of claim 3, wherein the act of deriving the value of the at least one second attribute based on the observation recorded from the web site or mobile device app interaction comprises:

discarding at least one first portion of the observation recorded from the web site or mobile device app interaction, while retaining at least one second portion of the observation recorded from the web site or mobile device app interaction, the at least one first portion being less relevant for a certain type of security risk than the at least one second portion.

5. The method of claim 1, wherein the penalty score is determined based at least in part on a ratio between the count of attributes with respect to which the web site or mobile device app interaction matches the profile, and a total count of the plurality of attributes identified from the profile.

6. The method of claim 1, wherein the web site or mobile device app interaction is a first web site or mobile device app interaction, and wherein the method further comprises:

identifying a plurality of values of an attribute with respect to which the first web site or mobile device app interaction matches the profile, each value of the plurality of values corresponding respectively to a second web site or mobile device app interaction of a plurality of second web site or mobile device app interactions;

dividing the plurality of values into a plurality of buckets, the plurality of buckets comprising the at least one bucket into which the value of the attribute identified from the first web site or mobile device app interaction falls;

determining a count of values from the plurality of values that fall within the at least one bucket; and

determining an extent to which the count of values from the plurality of values that fall within the at least one bucket deviates from an expected count for the at least one bucket, wherein the penalty score is determined based at least in part on the extent to which the count of values from the plurality of values that fall within the at least one bucket deviates from the expected count for the at least one bucket.

7. A system comprising at least one processor and at least one computer-readable storage medium having stored thereon instructions which, when executed, program the at least one processor to perform a method for analyzing a web site or mobile device app interaction, the method comprising acts of:

identifying a plurality of attributes from a web site or mobile device app profile;

for each attribute of the plurality of attributes, determining whether the web site or mobile device app interaction matches the profile with respect to the attribute, comprising;

identifying, from the profile, at least one bucket of possible values of the attribute, the at least one bucket being indicative of anomalous behavior;

identifying, from the web site or mobile device app interaction, a value of the attribute; and

determining whether the value identified from the web site or mobile device app interaction falls into the at least one bucket, wherein the web site or mobile device app interaction is determined to match the profile with respect to the attribute if it is determined that the value identified from the web site or mobile device app interaction falls into the at least one bucket, and wherein, for at least one attribute of the plurality of attributes;

the value identified from the web site or mobile device app interaction comprises a time measurement between a first user activity and a second user activity recorded from the web site or mobile device app interaction; and

the at least one bucket of possible values of the at least one attribute comprises a range of time measurements;

determining a penalty score based at least in part on a count of attributes with respect to which the web site or mobile device app interaction matches the profile; and

displaying, via a backend user interface, a risk assessment report to an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted, wherein the risk assessment report is based on the penalty score for the web site or mobile device app interaction.

8. The system of claim 7, wherein the at least one attribute comprises at least one first attribute, and wherein, for at least one second attribute:

the act of determining whether the value identified from the web site or mobile device app interaction falls into the at least one bucket comprises applying a hash-modding operation to the value identified from the web site or mobile device app interaction; and

the at least one bucket corresponds to a residue of the hash-modding operation.

9. The system of claim 8, wherein the act of identifying, from the web site or mobile device app interaction, a value of the at least one second attribute comprises:

recording, from the web site or mobile device app interaction, an observation with respect to the at least one second attribute; and

deriving the value of the at least one second attribute based on the observation recorded from the web site or mobile device app interaction.

10. The system of claim 9, wherein the act of deriving the value of the at least one second attribute based on the observation recorded from the web site or mobile device app interaction comprises:

discarding at least one first portion of the observation recorded from the web site or mobile device app interaction, while retaining at least one second portion of the observation recorded from the web site or mobile device app interaction, the at least one first portion being less relevant for a certain type of security risk than the at least one second portion.

11. The system of claim 7, wherein the penalty score is determined based at least in part on a ratio between the count of attributes with respect to which the web site or mobile device app interaction matches the profile, and a total count of the plurality of attributes identified from the profile.

12. The system of claim 7, wherein the web site or mobile device app interaction is a first web site or mobile device app interaction, and wherein the method further comprises:

identifying a plurality of values of an attribute with respect to which the first web site or mobile device app interaction matches the profile, each value of the plurality of values corresponding respectively to a second web site or mobile device app interaction of a plurality of second web site or mobile device app interactions;

dividing the plurality of values into a plurality of buckets, the plurality of buckets comprising the at least one bucket into which the value of the attribute identified from the first web site or mobile device app interaction falls;

determining a count of values from the plurality of values that fall within the at least one bucket; and

determining an extent to which the count of values from the plurality of values that fall within the at least one bucket deviates from an expected count for the at least one bucket, wherein the penalty score is determined based at least in part on the extent to which the count of values from the plurality of values that fall within the at least one bucket deviates from the expected count for the at least one bucket.

13. At least one non-transitory computer-readable storage medium having stored thereon instructions which, when executed, program at least one processor to perform a method for analyzing a web site or mobile device app interaction, the method comprising acts of:

identifying a plurality of attributes from a web site or mobile device app profile;

for each attribute of the plurality of attributes, determining whether the web site or mobile device app interaction matches the profile with respect to the attribute, comprising;

identifying, from the profile, at least one bucket of possible values of the attribute, the at least one bucket being indicative of anomalous behavior;

identifying, from the web site or mobile device app interaction, a value of the attribute; and

determining whether the value identified from the web site or mobile device app interaction falls into the at least one bucket, wherein the web site or mobile device app interaction is determined to match the profile with respect to the attribute if it is determined that the value identified from the web site or mobile device app interaction falls into the at least one bucket, and wherein, for at least one attribute of the plurality of attributes;

the value identified from the web site or mobile device app interaction comprises a time measurement between a first user activity and a second user activity recorded from the web site or mobile device app interaction; and

the at least one bucket of possible values of the at least one attribute comprises a range of time measurements;

determining a penalty score based at least in part on a count of attributes with respect to which the web site or mobile device app interaction matches the profile; and

displaying, via a backend user interface, a risk assessment report to an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted, wherein the risk assessment report is based on the penalty score for the web site or mobile device app interaction.

14. The at least one non-transitory computer-readable storage medium of claim 13, wherein the at least one attribute comprises at least one first attribute, and wherein, for at least one second attribute:

the act of determining whether the value identified from the web site or mobile device app interaction falls into the at least one bucket comprises applying a hash-modding operation to the value identified from the web site or mobile device app interaction; and

the at least one bucket corresponds to a residue of the hash-modding operation.

15. The at least one non-transitory computer-readable storage medium of claim 14, wherein the act of identifying, from the web site or mobile device app interaction, a value of the at least one second attribute comprises:

recording, from the web site or mobile device app interaction, an observation with respect to the at least one second attribute; and

deriving the value of the at least one second attribute based on the observation recorded from the web site or mobile device app interaction.

16. The at least one non-transitory computer-readable storage medium of claim 15, wherein the act of deriving the value of the at least one second attribute based on the observation recorded from the web site or mobile device app interaction comprises:

discarding at least one first portion of the observation recorded from the web site or mobile device app interaction, while retaining at least one second portion of the observation recorded from the web site or mobile device app interaction, the at least one first portion being less relevant for a certain type of security risk than the at least one second portion.

17. The at least one non-transitory computer-readable storage medium of claim 13, wherein the penalty score is determined based at least in part on a ratio between the count of attributes with respect to which the web site or mobile device app interaction matches the profile, and a total count of the plurality of attributes identified from the profile.

18. The at least one non-transitory computer-readable storage medium of claim 13, wherein the web site or mobile device app interaction is a first web site or mobile device app interaction, and wherein the method further comprises:

identifying a plurality of values of an attribute with respect to which the first web site or mobile device app interaction matches the profile, each value of the plurality of values corresponding respectively to a second web site or mobile device app interaction of a plurality of second web site or mobile device app interactions;

dividing the plurality of values into a plurality of buckets, the plurality of buckets comprising the at least one bucket into which the value of the attribute identified from the first web site or mobile device app interaction falls;

determining a count of values from the plurality of values that fall within the at least one bucket; and

determining an extent to which the count of values from the plurality of values that fall within the at least one bucket deviates from an expected count for the at least one bucket, wherein the penalty score is determined based at least in part on the extent to which the count of values from the plurality of values that fall within the at least one bucket deviates from the expected count for the at least one bucket.