Systems and methods for automated device activity analysis

A computer-implemented method providing automated user device activity analysis, the computer-implemented method comprising:

• identifying a data anomaly associated with a specific user device and specific resource account;
• retrieving historical interaction data from one or more entity or third party systems;
• based on the historical interaction data, identifying one or more interactions involving the specific user device;
• determining if the one or more interactions involving the specific user device is malfeasant activity, further comprising:
• generating baseline transaction and device pattern data based on device identifiers, communication channels, resource actions, resource transaction amounts, transaction volume, and transaction frequency;
• weighting the device identifiers, the communication channels, the resource actions, the resource transaction amounts, the transaction volume, and the transaction frequency according to a frequency of each datapoint;
• comparing additional transaction data and additional user device data from the one or more interactions involving the specific user device to the baseline transaction and the device pattern data;
• identifying the malfeasant activity based on the additional transaction data and the additional user device data not matching the baseline transaction and the device pattern data;
• and
• identifying one or more resource accounts affected by the malfeasant activity, wherein identifying the one or more resource accounts affected by the malfeasant activity further comprises analyzing the historical interaction data to determine one or more access attempts to disparate resource accounts from the specific user device.

A computer program product providing automated user device activity analysis, the computer program product comprising at least one non-transitory computer-readable medium having computer-readable program code portions embodied therein, the computer-readable program code portions comprising:

• an executable portion configured for identifying a data anomaly associated with a specific user device and specific resource account;
• an executable portion configured for retrieving historical interaction data from one or more entity or third party systems;
• an executable portion configured for, based on the historical interaction data, identifying one or more interactions involving the specific user device;
• an executable portion configured for determining if the one or more interactions involving the specific user device is malfeasant activity, further comprising:
• generating baseline transaction and device pattern data based on device identifiers, communication channels, resource actions, resource transaction amounts, transaction volume, and transaction frequency;
• weighting the device identifiers, the communication channels, the resource actions, the resource transaction amounts, the transaction volume, and the transaction frequency according to a frequency of each datapoint;
• comparing additional transaction data and additional user device data from the one or more interactions involving the specific user device to the baseline transaction and the device pattern data;
• identifying the malfeasant activity based on the additional transaction data and the additional user device data not matching the baseline transaction and the device pattern data;
• and
• an executable portion configured for identifying one or more resource accounts affected by the malfeasant activity, wherein identifying the one or more resource accounts affected by the malfeasant activity further comprises analyzing the historical interaction data to determine one or more access attempts to disparate resource accounts from the specific user device.