System and method for computing device intrusion detection via machine learning for interaction data analysis

A computer program product for computing device intrusion detection via machine learning for interaction data analysis, the computer program product comprising a non-transitory computer-readable medium comprising code causing an apparatus to:

• receive interaction event data from a first endpoint device, the interaction event data comprising data from a plurality of keystrokes and a plurality of touch events;
• associate the interaction event data with the first endpoint device as a first schema within a database, wherein the first endpoint device is designated as an authorized endpoint device, and wherein the database comprises a plurality of schema, each respective schema of the plurality of schema comprising at least one corresponding authorized endpoint device;
• train a machine learning model using the plurality of schema and the at least one corresponding authorized endpoint device to form a trained machine learning model;
• receive an interaction event data stream and a corresponding endpoint device identifier;
• determine, by inputting the interaction event data stream and the corresponding endpoint device identifier to the trained machine learning model, an identified endpoint device and a presence of at least one anomaly, wherein the at least one anomaly comprises a schema mismatch;
• and
• transmit a notification signal comprising schema mismatch details to the identified endpoint device.

A method for computing device intrusion detection via machine learning for interaction data analysis, the method comprising:

• receiving interaction event data from a first endpoint device, the interaction event data comprising data from a plurality of keystrokes and a plurality of touch events;
• associating the interaction event data with the first endpoint device as a first schema within a database, wherein the first endpoint device is designated as an authorized endpoint device, and wherein the database comprises a plurality of schema, each respective schema of the plurality of schema comprising at least one corresponding authorized endpoint device;
• training a machine learning model using the plurality of schema and the at least one corresponding authorized endpoint device to form a trained machine learning model;
• receiving an interaction event data stream and a corresponding endpoint device identifier;
• determining, by inputting the interaction event data stream and the corresponding endpoint device identifier to the trained machine learning model, an identified endpoint device and a presence of at least one anomaly, wherein the at least one anomaly comprises a schema mismatch;
• and
• transmitting a notification signal comprising schema mismatch details to the identified endpoint device.