System and method for network security based on a user's computer network activity data

A method for network security based on identifying anomalous computer network activity in real-time in an online networked environment based on real-time computer network data associated with the user's activity, comprising:

• operating two distinct environments, including a real-time scoring environment and a supervised, inductive machine learning environment;
• in the supervised, inductive machine learning environment, generating classification objects for the user, wherein each classification object represents a behavior of a computer network associated with that user, and generating the classification objects for the particular user comprises:
• partitioning computer network activity data for that user into a test partition and a train partition, the computer network activity data including data on actions of the user collected when that user was interacting with the online computer application over the computer network;
• mapping computer network activity data from the train partition to a plurality of modeled action spaces to produce a plurality of elements, each of the plurality of elements representing a particular user action;
• generating classification objects associated with the user, wherein the classification objects represent behavioral patterns of computer network activity associated with that user extracted from the plurality of elements;
• testing the generated classification objects associated with the user utilizing computer network activity data for the user from the test partition, wherein the testing produces an array of classification objects associated only with that user based on the performance of the generated classification objects on the computer network activity data associated with the user from the test partition;
• and
• storing the array of classification objects associated with the user in association with that user in the database;
• in the real-time scoring environment, authenticating the user using the classification objections for that user based on real-time computer network data collected as the user is interacting with the online computer application over the computer network, by:
• collecting real-time computer network activity data as the user is interacting with the online computer application, including real-time computer network data associated with the particular action taken by the user;
• producing a real-time element representing the real-time computer network data associated with the particular user action taken by the user while the user is interacting with the online computer application over the computer network;
• selecting a classification object from the array of classification objects associated with that user based on real-time computer network data associated with the particular action taken by the user;
• applying the selected classification object to the real-time element representing the real-time computer network data associated with the particular user action to produce a value reflective of whether the particular user action is anomalous computer network behavior, wherein the classification object is selected from the array of distinct classification objects associated with that user based on real-time computer network data associated with the particular action taken by the user;
• and
• determining whether to authenticate an intended use of the computer network by the user based at least in part on the value produced by the application of the selected classification object reflective of whether the real-time computer network data associated with the particular user action is anomalous computer network behavior.

A non-transitory computer readable medium comprising instructions executable for performing network security based on identifying anomalous computer network activity in real-time in an online networked environment based on real-time computer network data associated with the user's activity, by:

• operating two distinct environments, including a real-time scoring environment and a supervised, inductive machine learning environment;
• in the supervised, inductive machine learning environment, generating classification objects for the user, wherein each classification object represents a behavior of a computer network associated with that user, and generating the classification objects for the particular user comprises:
• partitioning computer network activity data for that user into a test partition and a train partition, the computer network activity data including data on actions of the user collected when that user was interacting with the online computer application over the computer network;
• mapping computer network activity data from the train partition to a plurality of modeled action spaces to produce a plurality of elements, each of the plurality of elements representing a particular user action;
• generating classification objects associated with the user, wherein the classification objects represent behavioral patterns of computer network activity associated with that user extracted from the plurality of elements;
• testing the generated classification objects associated with the user utilizing computer network activity data for the user from the test partition, wherein the testing produces an array of classification objects associated only with that user based on the performance of the generated classification objects on the computer network activity data associated with the user from the test partition;
• and
• storing the array of classification objects associated with the user in association with that user in the database;
• in the real-time scoring environment, authenticating the user using the classification objections for that user based on real-time computer network data collected as the user is interacting with the online computer application over the computer network, by:
• collecting real-time computer network activity data as the user is interacting with the online computer application, including real-time computer network data associated with the particular action taken by the user;
• producing a real-time element representing the real-time computer network data associated with the particular user action taken by the user while the user is interacting with the online computer application over the computer network;
• selecting a classification object from the array of classification objects associated with that user based on real-time computer network data associated with the particular action taken by the user;
• applying the selected classification object to the real-time element representing the real-time computer network data associated with the particular user action to produce a value reflective of whether the particular user action is anomalous computer network behavior, wherein the classification object is selected from the array of distinct classification objects associated with that user based on real-time computer network data associated with the particular action taken by the user;
• and
• determining whether to authenticate an intended use of the computer network by the user based at least in part on the value produced by the application of the selected classification object reflective of whether the real-time computer network data associated with the particular user action is anomalous computer network behavior.