System and method of detecting mass hacking activities during the interaction of users with banking services

A system for detecting hacking activities, the system comprising:

• a hardware processor configured to:
• identify one or more attributes of each interaction in a sequence of interactions between one or more users and bank services during a predetermined time period;
• categorize, by a cloud-computing service, the one or more users into a plurality of groups based on the identified attributes, wherein each of the plurality of groups includes users performing identical sequence of interactions with the bank services during the predetermined time period;
• calculate a degree of anomaly for each of the plurality of groups based on a total number of users associated with a corresponding sequence of interactions and a number of users associated with the corresponding sequence of interactions during the predetermined time period;
• compare the calculated degree of anomaly with a predetermined threshold;
• and
• detect hacking activity in response to determining that the calculated degree of anomaly exceeds the predetermined threshold,
• wherein the detecting of the hacking activity comprises comparing a value of an interaction parameter that is observed with a value of the interaction parameter that is predetermined, and
• wherein the interaction parameter comprises one or more of:
• a number of sessions established between a browser and a server providing the bank services during the predetermined time period, and a number of sessions established between the browser and the server exhibiting a predetermined sequence of interactions.

A non-transitory computer readable medium storing thereon computer executable instructions for detecting hacking activities, including instructions for:

• identifying one or more attributes of each interaction in a sequence of interactions between one or more users and bank services during a predetermined time period;
• categorizing, by a cloud-computing service, the one or more users into a plurality of groups based on the identified attributes, wherein each of the plurality of groups includes users performing identical sequence of interactions with the bank services during the predetermined time period;
• calculating a degree of anomaly for each of the plurality of groups based on a total number of users associated with a corresponding sequence of interactions and a number of users associated with the corresponding sequence of interactions during the predetermined time period;
• comparing the calculated degree of anomaly with a predetermined threshold;
• and
• detecting hacking activity in response to determining that the calculated degree of anomaly exceeds the predetermined threshold,
• wherein the detecting of the hacking activity comprises comparing a value of an interaction parameter that is observed with a value of the interaction parameter that is predetermined, and
• wherein the interaction parameter comprises one or more of:
• a number of sessions established between a browser and a server providing the bank services during the predetermined time period, and a number of sessions established between the browser and the server exhibiting a predetermined sequence of interactions.