Avoiding user session misclassification using configuration and activity fingerprints

A non-transitory computer readable medium having stored thereon a sequence of instructions which, when stored in memory and executed by one or more processors causes the one or more processors to perform a set of acts for classifying a potentially unauthorized user as an authorized user, the set of acts comprising:

• receiving, at a first time, a first resource access request from a first computing device that is situated at a first location;
• receiving, at a second time, a second resource access request from a second computing device that is situated at a second location, wherein the second computing device is different from the first computing device;
• determining, based on comparisons between the first time, the second time, the first location and the second location, whether or not travel between the first location and the second location can be done by the potentially unauthorized user within a given time period;
• identifying a potentially unauthorized access when a determined time period of travel between the first location and the second location is outside the given time period;
• and
• determining that the potentially unauthorized access is deemed as an authorized access by using configuration and activity information that corresponds to the potentially unauthorized user.

A system for classifying a potentially unauthorized user as an authorized user, the system comprising:

• a storage medium having stored thereon a sequence of instructions;
• and
• one or more processors that execute the sequence of instructions to cause the one or more processors to perform a set of acts, the set of acts comprising, receiving, at a first time, a first resource access request from a first computing device that is situated at a first location;
• receiving, at a second time, a second resource access request from a second computing device that is situated at a second location, wherein the second computing device is different from the first computing device;
• determining, based on comparisons between the first time, the second time, the first location and the second location, whether or not travel between the first location and the second location can be done by the potentially unauthorized user within a given time period;
• identifying a potentially unauthorized access when a determined time period of travel between the first location and the second location is outside the given time period;
• and
• determining that the potentially unauthorized access is deemed as an authorized access by using configuration and activity information that corresponds to the potentially unauthorized user.