Methods and systems for detecting abnormal user activity

A system for detecting abnormal user activity, the system being connected to a plurality of client devices via a communication network, each client device of the plurality of client devices being associated with a respective user, the system comprising:

• a processor;
• a non-transitory computer-readable medium comprising instructions, the processor;
• upon executing the instructions, being configured to cause:
• tracking, by the system, during a first time period, user activity associated with a first application service performed on a first client device, the user activity including user interactions with the first application service;
• determining, by the system, that the user activity associated with the first application service exceeds a first predetermined threshold of user activity during the first time period, the first predetermined threshold having been determined based on past user activity associated with the first application service and performed on each client device of the plurality of client devices by the respective user,
• the user activity exceeding the first predetermined threshold being indicative of a potentially abnormal user activity on the first application service associated with the first client device;
• in response to determining that the user activity exceeds the first predetermined threshold, tracking, during a second time period, by the system, user activity associated with the first application service on the first client device, the tracking comprising tracking a content of the user interactions with the first application service;
• determining, by the system, that the user activity exceeds a second predetermined threshold of user activity during the second time period, the second predetermined threshold having been determined based on past user activity associated with the first application service and performed on each client device of the plurality of client devices,
• the user activity exceeding the second predetermined threshold being indicative of an abnormal user activity associated with the first client device;
• in response to determining that the user activity exceeds the second predetermined threshold, triggering, by the system, a user challenge procedure on the first client device, the user challenge procedure for authenticating the user of the first client device, the user challenge procedure being based on the user activity with the first application service during the first time period performed on the first client device.