System and method for protecting a user's devices based on types of anomaly

A system for protecting user's devices based on types of anomalies, comprising:

• at least one processor configured to:
• determine, by a feature determiner, one or more values of features of a user's activity performed using at least one of the user's devices;
• detect, by an anomaly detector, anomalies indicative of at least one threat to information security of the user's devices based on the one or more values of the features, wherein the detection is performed using a trained anomaly detection model for each detected anomaly, identify, by the anomaly detector, a type of anomaly and at least one device that is a source of the anomaly, wherein the type of anomaly is identified using an anomaly classifier and the one or more values of features, wherein the identification of the type of anomaly is performed using a trained anomaly classifier, wherein the trained anomaly detection model and the anomaly classifier are tested on data of a test sample and are validated using a validation sample, the testing and the validation being performed using a model trainer, the test and the validation samples further including values of features over a historical period of observation, and wherein the threat to information security due to the anomaly and the devices in which the anomaly appeared are known for at least a specified portion of the values of the features;
• and for each user's device, modify, by a device protector, one or more information security settings of a user's device based on the identified type of the anomaly.

A non-transitory computer readable medium storing thereon computer executable instructions for protecting user's devices based on types of anomalies, including instructions for:

• determining, by a feature determiner, one or more values of features of a user's activity performed using at least one of the user's devices;
• detecting, by an anomaly detector, anomalies indicative of at least one threat to information security of the user's devices based on the one or more values of the features, wherein the detection is performed using a trained anomaly detection model;
• for each detected anomaly, identifying, by the anomaly detector, a type of anomaly and at least one device that is a source of the anomaly, wherein the type of anomaly is identified using an anomaly classifier and the one or more values of features, wherein the identification of the type of anomaly is performed using a trained anomaly classifier, wherein the trained anomaly detection model and the anomaly classifier are tested on data of a test sample and are validated using a validation sample, the testing and the validation being performed using a model trainer, the test and the validation samples further including values of features over a historical period of observation, and wherein the threat to information security due to the anomaly and the devices in which the anomaly appeared are known for at least a specified portion of the values of the features;
• and for each user's device, modifying, by a device protector, one or more information security settings of a user's device based on the identified type of the anomaly.