Detecting malicious activity using user-specific parameters

A method comprising:

• receiving user action data representing user actions for a plurality of users relative to a plurality of applications;
• generating, using first user action data representing first user actions of a first user of the plurality of users, a plurality of parameters specific to the first user for determining whether interactions of the first user represent malicious activity, wherein each parameter of the plurality of parameters comprises a corresponding parameter identifier and a corresponding parameter value;
• receiving, for the first user, a request for a pending interaction with a particular application of the plurality of applications;
• inputting, into a first user model, the pending interaction to cause the first user model to generate a plurality of parameter identifiers identifying a set of parameters within the plurality of parameters, wherein the set of parameters is more likely than another set of parameters within the plurality of parameters to identify the malicious activity, wherein the first user model is trained for the first user using the first user action data;
• and
• during pendency of the pending interaction;
• using
• determining, for the set of parameters, a corresponding set of interaction parameters, wherein the corresponding set of interaction parameters is extracted from the pending interaction that is received as part of the request;
• determining whether the corresponding set of interaction parameters matches the set of parameters;
• and
• based on determining that the corresponding set of interaction parameters matches the set of parameters, determining that the pending interaction is malicious.

One or more non-transitory, computer-readable media storing instructions that, when executed by one or more processors, cause operations comprising:

• receiving user action data representing user actions for a plurality of users relative to a plurality of applications;
• generating, using first user action data representing first user actions of a first user of the plurality of users, a plurality of parameters specific to the first user for determining whether interactions of the first user represent malicious activity, wherein each parameter of the plurality of parameters comprises a corresponding parameter identifier and a corresponding parameter value;
• receiving, for the first user, a request for a pending interaction with a particular application of the plurality of applications;
• inputting, into a first user model, the pending interaction to cause the first user model to generate a plurality of parameter identifiers identifying a set of parameters within the plurality of parameters, wherein the set of parameters is more likely than another set of parameters within the plurality of parameters to identify the malicious activity, wherein the first user model is trained for the first user using the first user action data;
• and
• during pendency of the pending interaction;
• determining, for the set of parameters, a corresponding set of interaction parameters, wherein the corresponding set of interaction parameters is extracted from the pending interaction that is received as part of the request;
• determining whether the corresponding set of interaction parameters matches the set of parameters;
• and
• based on determining that the corresponding set of interaction parameters matches the set of parameters, determining that the pending interaction is malicious.