Systems and methods for matching and scoring sameness

• US 9,749,357 B2
• Filed: 09/04/2016
• Issued: 08/29/2017
• Est. Priority Date: 09/05/2015
• Status: Active Grant

• Current Assignee: NuData Security Inc. (MasterCard Incorporated)
• Original Assignee: NuData Security Inc. (MasterCard Incorporated)
• Inventors: Bailey, Christopher Everett, Lukashuk, Randy, Richardson, Gary Wayne
• Primary Examiner(s): TRAN, ELLEN C
• Application Number:
  US15/256,613
• Publication Number:
  US 20170070525A1
• Time in Patent Office: 359 Days
• Field of Search: 726 25
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 7/08 Sorting, i.e. grouping record carriers in numerical or other ordered sequence according to the classification of at least some of the information they carry by merging two or more sets of carriers in ordered sequence G06F7/16
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/30 : Profiles
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Systems and methods for matching and scoring sameness. In some embodiments, a computer-implemented method is provided, comprising acts of: detecting a plurality of digital interactions at different points in time; for each digital interaction of the plurality of digital interactions: identifying from the digital interaction an anchor value X of an anchor type T; and updating a profile of the anchor value X.

Claims

1. A computer-implemented method for providing a profile of an anchor value, comprising acts of:

detecting a plurality of digital interactions at different points in time, the plurality of digital interactions comprising web site and/or mobile device app interactions;

for each digital interaction of the plurality of digital interactions;

identifying from the digital interaction an anchor value X of an anchor type T, wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier; and

updating a profile of the anchor value X, wherein;

the profile of the anchor value X comprises a plurality of counters C[i,j] (i=0, . . . , M−

1;

j=0, . . . , N_i−

1);

for each i=0, . . . , M−

1 and j=0, . . . , N_i−

1, the counter C[i,j] indicates a number of times an event E is observed during a time interval I_i,j; and

updating the profile of the anchor value X comprises;

analyzing the digital interaction to determine if the event E is observed in connection with the digital interaction; and

in response to determining that the event E is observed in connection with the digital interaction, incrementing the counter C[i,0] for each i=0, . . . , M−

1;

identifying the anchor value X from an on-going web site or mobile device app interaction;

using the profile of the anchor value X to generate a score indicative of a level of risk associated with the on-going web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the on-going web site or mobile device app interaction is conducted.

2. The computer-implemented method of claim 1, wherein:

the time intervals I_0,j (j=0, . . . , N₀−

1) are five-minute intervals and N₀=12;

the time intervals I_1,j (j=0, . . . , N₁−

1) are one-hour intervals and N₁=24; and

the time intervals I_2,j (j=0, . . . , N₂−

1) are one-day intervals and N₂=14.

3. The computer-implemented method of claim 1, wherein:

for each i=0, . . . , M−

1, the time intervals I_i,j (j=0, . . . , N_i−

1) have a same length L_i.

4. The computer-implemented method of claim 3, wherein:

for each i=0, . . . , M−

2, L_i+1=N_i*L_i.

5. The computer-implemented method of claim 3, further comprising an act of:

for each i=0, . . . , M−

1, shifting the counters C[i,j] (j=0, . . . , N_i−

1) periodically, wherein;

a period for shifting the counters C[i,j] (j=0, . . . , N_i−

1) is L_i, and

shifting the counters C[i,j] (j=0, . . . , N_i−

1) comprises;

for each j=0, . . . , N_i−

2, setting the counter C[i,j+1] to a value of the counter C[i,j]; and

setting the counter C[i,0] to 0.

6. The computer-implemented method of claim 1, wherein:

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and an anchor value Y are observed from the digital interaction.

7. The computer-implemented method of claim 1, wherein:

a plurality of anchor values of a same anchor type are divided into a plurality of buckets of anchor values; and

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and any anchor value from a bucket B of anchor values are observed from the digital interaction.

8. The computer-implemented method of claim 7, wherein:

the plurality of anchor values are divided into the plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values.

9. The computer-implemented method of claim 7, wherein:

the plurality of anchor values comprise a plurality of network addresses;

the plurality of buckets of anchor values comprise a plurality of buckets of network addresses; and

the plurality of network addresses are divided into the plurality of buckets of network addresses at least in part by applying a hash-modding operation on the plurality of network addresses.

10. A system comprising at least one processor and at least one computer-readable storage medium having stored thereon instructions which, when executed, program the at least one processor to perform a method for providing a profile of an anchor value, the method comprising acts of:

detecting a plurality of digital interactions at different points in time, the plurality of digital interactions comprising web site and/or mobile device app interactions;

for each digital interaction of the plurality of digital interactions;

identifying from the digital interaction an anchor value X of an anchor type T, wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier; and

updating a profile of the anchor value X, wherein;

the profile of the anchor value X comprises a plurality of counters C[i,j] (i=0, . . . , M−

1;

j=0, . . . , N_i−

1);

for each i=0, . . . , M−

1 and j=0, . . . , N_i−

1, the counter C[i,j] indicates a number of times an event E is observed during a time interval I_i,j; and

updating the profile of the anchor value X comprises;

analyzing the digital interaction to determine if the event E is observed in connection with the digital interaction; and

in response to determining that the event E is observed in connection with the digital interaction, incrementing the counter C[i,0] for each i=0, . . . , M−

1;

identifying the anchor value X from an on-going web site or mobile device app interaction;

using the profile of the anchor value X to generate a score indicative of a level of risk associated with the on-going web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the on-going web site or mobile device app interaction is conducted.

11. The system of claim 10, wherein:

the time intervals I_0,j (j=0, . . . , N₀−

1) are five-minute intervals and N₀=12;

the time intervals I_1,j (j=0, . . . , N₁−

1) are one-hour intervals and N₁=24; and

the time intervals I_2,j (j=0, . . . , N₂−

1) are one-day intervals and N₂=14.

12. The system of claim 10, wherein:

for each i=0, . . . , M−

1, the time intervals I_i,j (j=0, . . . , N_i−

1) have a same length L_i.

13. The system of claim 12, wherein:

for each i=0, . . . , M−

2, L_i+1=N_i*L_i.

14. The system of claim 12, wherein the method further comprises an act of:

for each i=0, . . . , M−

1, shifting the counters C[i,j] (j=0, . . . , N_i−

1) periodically, wherein;

a period for shifting the counters C[i,j] (j=0, . . . , N_i−

1) is L_i, and

shifting the counters C[i,j] (j=0, . . . , N_i−

1) comprises;

for each j=0, . . . , N_i−

2, setting the counter C[i,j+1] to a value of the counter C[i,j]; and

setting the counter C[i,0] to 0.

15. The system of claim 10, wherein:

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and an anchor value Y are observed from the digital interaction.

16. The system of claim 10, wherein:

a plurality of anchor values of a same anchor type are divided into a plurality of buckets of anchor values; and

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and any anchor value from a bucket B of anchor values are observed from the digital interaction.

17. The system of claim 16, wherein:

the plurality of anchor values are divided into the plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values.

18. The system of claim 16, wherein:

the plurality of anchor values comprise a plurality of network addresses;

the plurality of buckets of anchor values comprise a plurality of buckets of network addresses; and

the plurality of network addresses are divided into the plurality of buckets of network addresses at least in part by applying a hash-modding operation on the plurality of network addresses.

19. At least one non-transitory computer-readable storage medium having stored thereon instructions which, when executed, program at least one processor to perform a method for providing a profile of an anchor value, the method comprising acts of:

detecting a plurality of digital interactions at different points in time, the plurality of digital interactions comprising web site and/or mobile device app interactions;

for each digital interaction of the plurality of digital interactions;

identifying from the digital interaction an anchor value X of an anchor type T, wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier; and

updating a profile of the anchor value X, wherein;

the profile of the anchor value X comprises a plurality of counters C[i,j] (i=0, . . . , M−

1;

j=0, . . . , N_i−

1);

for each i=0, . . . , M−

1 and j=0, . . . , N_i−

1, the counter C[i,j] indicates a number of times an event E is observed during a time interval I_i,j; and

updating the profile of the anchor value X comprises;

analyzing the digital interaction to determine if the event E is observed in connection with the digital interaction; and

in response to determining that the event E is observed in connection with the digital interaction, incrementing the counter C[i,0] for each i=0, . . . , M−

1;

identifying the anchor value X from an on-going web site or mobile device app interaction;

using the profile of the anchor value X to generate a score indicative of a level of risk associated with the on-going web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the on-going web site or mobile device app interaction is conducted.

20. The at least one non-transitory computer-readable storage medium of claim 19, wherein:

the time intervals I_0,j (j=0, . . . , N₀−

1) are five-minute intervals and N₀=12;

the time intervals I_1,j (j=0, . . . , N₁−

1) are one-hour intervals and N₁=24; and

the time intervals I_2,j (j=0, . . . , N₂−

1) are one-day intervals and N₂=14.

21. The at least one non-transitory computer-readable storage medium of claim 19, wherein:

for each i=0, . . . , M−

1, the time intervals (j=0, . . . , N_i−

1) have a same length L_i.

22. The at least one non-transitory computer-readable storage medium of claim 21, wherein:

for each i=0, . . . , M−

2, L_i+1=N_i*L_i.

23. The at least one non-transitory computer-readable storage medium of claim 21, wherein the method further comprises an act of:

for each i=0, . . . , M−

1, shifting the counters C[i,j] (j=0, . . . , N_i−

1) periodically, wherein;

a period for shifting the counters C[i,j] (j=0, . . . , N_i−

1) is L_i, and

shifting the counters C[i,j] (j=0, . . . , N_i−

1) comprises;

for each j=0, . . . , N_i−

2, setting the counter C[i,j+1] to a value of the counter C[i,j]; and

setting the counter C[i,0] to 0.

24. The at least one non-transitory computer-readable storage medium of claim 19, wherein:

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and an anchor value Y are observed from the digital interaction.

25. The at least one non-transitory computer-readable storage medium of claim 19, wherein:

a plurality of anchor values of a same anchor type are divided into a plurality of buckets of anchor values; and

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and any anchor value from a bucket B of anchor values are observed from the digital interaction.

26. The at least one non-transitory computer-readable storage medium of claim 25, wherein:

the plurality of anchor values are divided into the plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values.

27. The at least one non-transitory computer-readable storage medium of claim 25, wherein:

the plurality of anchor values comprise a plurality of network addresses;

the plurality of buckets of anchor values comprise a plurality of buckets of network addresses; and

the plurality of network addresses are divided into the plurality of buckets of network addresses at least in part by applying a hash-modding operation on the plurality of network addresses.