Systems and methods for detecting compromised automated teller machines

A compromise detection computer system for detecting a compromised automated teller machine (ATM), the computer system comprising:

• a memory;
• and
• an activity monitoring (AM) computing device including a processor, the AM computing device communicatively coupled to the ATM and configured to:
• store operating parameter rules in the memory, the operating parameter rules defining a normal activity range for the ATM based on historical activity data of the ATM and of at least one other ATM;
• continuously update the stored operating parameter rules based on recently received activity data of the ATM and of the at least one other ATM;
• receive user input data recorded at the ATM, the user input data including instructions input by respective users operating the ATM during a plurality of transactions;
• receive machine data recorded at the ATM, wherein the machine data is generated at the ATM in association with performance of one or more processes performed by the ATM and includes at least one of cash output data, cash inventory data, virus scan data, reboot data, available memory, critical system data, and presence of attached physical media;
• receive physical attributes of the ATM;
• convert the received user input data, the received machine data, and the received physical attributes into current activity data associated with the ATM;
• apply the current activity data to the stored operating parameter rules;
• identify at least one unexpected event that has occurred at the ATM that is outside of the normal activity range for the ATM;
• generate an activity score for the ATM based on the at least one unexpected event determine, based on the activity score, that the ATM is compromised;
• and
• when the activity score satisfies a response threshold criteria, cause the ATM to implement one or more processes at the ATM to remediate the compromise, wherein the one or more processes include at least one of a virus scan and a reboot of the ATM.

A non-transitory computer-readable storage media having computer-executable instructions embodied thereon for detecting a compromised automated teller machine (ATM) using an activity monitoring (AM) computing device, the AM computing device communicatively coupled to the ATM, wherein when executed by the AM computing device having at least one processor coupled to at least one memory device, the computer-executable instructions cause the processor to:

• store operating parameter rules in the at least one memory device, the operating parameter rules defining a normal activity range for the ATM based on historical activity data of the ATM and of at least one other ATM;
• continuously update the stored operating parameter rules based on recently received activity data of the ATM and of the at least one other ATM;
• receive user input data recorded at the ATM, the user input data including instructions input by respective users operating the ATM during a plurality of transactions;
• receive machine data from an ATM, wherein the machine data is generated at the ATM in association with performance of one or more processes performed by the ATM and includes at least one of cash output data, cash inventory data, virus scan data, reboot data, available memory, critical system data, and presence of attached physical media;
• receive physical attributes of the ATM;
• convert, the received user input data, the received machine data, and the received physical attributes into current activity data associated with the ATM;
• apply the current activity data to the stored operating parameter rules;
• identify at least one unexpected event that has occurred at the ATM that is outside of the normal activity range for the ATM;
• generate an activity score for the ATM based on the at least one unexpected event;
• determine, based on the activity score, that the ATM is compromised;
• and
• when the activity score satisfies a response threshold criteria, cause, by the AM computing device, the ATM to implement one or more processes at the ATM to remediate the compromise, wherein the one or more processes include at least one of a virus scan and a reboot of the ATM.