US 9,959,399 B2Granted

Automatic intelligent local device fraud detection

AssigneeCitrix Systems, Inc.

InventorJiawen Su

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods, systems, computer-readable media, and apparatuses may provide a mobile device with the ability to locally detect fraudulent activity by an unauthorized user. A mobile device may include a fraud detection module that may build a historical usage pattern of a user of the mobile device. The fraud detection module may monitor usage of the mobile device for multiple parameters and record events pertaining to the parameters. Periodically or in response to each event, the fraud detection module may compute a current usage pattern using each of the current parameter values. The fraud detection module may compare the current usage pattern with the historical usage pattern and may use the comparison result to compute a confidence score. The fraud detection module may then compare the confidence score with a preset confidence score to determine whether fraudulent activity is occurring at the mobile device.

Claims19

Dependent claims

An apparatus comprising:

a communication transceiver;
a hardware processor;
and
a computer readable medium storing instructions that, when executed by the hardware processor, cause the apparatus to:
store a plurality of usage parameters associated with the apparatus, wherein the plurality of usage parameters includes an app usage parameter, a location parameter, and an in-app use parameter;
store a first signature including a first set of parameter values for the plurality of usage parameters based on a first set of user inputs;
generate a second signature including a second set of parameter values for the plurality of usage parameters based on a second set of user inputs;
compare the second signature with the first signature to determine a signature difference value representative of a difference between the first signature and the second signature;
compute an average signature difference value over a plurality of past signature difference values associated with usage of the apparatus;
generate a confidence score for the second signature based at least on a ratio of the signature difference value to the average signature difference value;
if the confidence score is greater than a preset maximum score threshold,
identify the second set of user inputs as being fraudulent;
and
in response to determining that the communication transceiver is in an inactive state, activate the communication transceiver without alerting a user of the apparatus and establish a communication link with a remote server;
and
if the confidence score is less than or equal to the preset maximum score threshold, identify the second set of user inputs as being not fraudulent and update the average signature difference value based on the signature difference value.

13 more elements

An apparatus comprising:

a communication transceiver;
a hardware processor;
and
a computer readable medium storing instructions that, when executed by the hardware processor, cause the apparatus to:
generate a first signature representative of a historical usage pattern of the apparatus by an authorized user based on a first set of parameter values;
receive, via one or more input interfaces, one or more inputs from a user;
generate a second set of parameters values based at least in part on the one or more inputs of the user;
generate a second signature representative of a usage pattern of the apparatus by the user based on the second set of parameter values, wherein a plurality of parameters is associated with the first set of parameter values and the second set of parameter values;
determine a signature difference value representative of a difference between the first signature and the second signature;
compute an average signature difference value over a plurality of past signature difference values associated with usage of the apparatus;
generate a confidence score for the second signature based at least on a ratio of the signature difference value to the average signature difference value;
if the confidence score is greater than a preset maximum score threshold,
identify the user as being an unauthorized user;
and
in response to determining that the communication transceiver is in an inactive state, activate the communication transceiver without alerting the user of the apparatus and establish a communication link with a remote server;
and
if the confidence score is less than or equal to the preset maximum score threshold, identify the user as the authorized user and update the average signature difference value based on the signature difference value.

14 more elements

An apparatus comprising:

a communication transceiver;
a hardware processor;
and
a computer readable medium storing instructions that, when executed by the hardware processor, cause the apparatus to:
receive, via one or more input interfaces, one or more user inputs from a user;
determine a set of parameter values for each usage parameter of a plurality of usage parameters associated with the apparatus based on the one or more user inputs;
generate a vector for each usage parameter based on the corresponding set of parameters values;
append the vectors to form an overall vector representative of the one or more user inputs;
generate a signature difference value based at least on a comparison of the overall vector with a historical vector associated with usage of the apparatus by an authorized user;
compute an average signature difference value over a plurality of past signature difference values associated with usage of the apparatus;
generate a confidence score based on a ratio of the signature difference value and the average signature difference value;
if the confidence score is greater than a preset maximum score threshold,
determine that the user is an unauthorized user;
and
in response to determining that the communication transceiver is in an inactive state, activate the communication transceiver without alerting the user of the apparatus and establish a communication link with a remote server;
and
if the confidence score is less than or equal to the preset maximum score threshold, determine that the user is the authorized user.

14 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/598,420Filed 16 Jan 2015
Published: US 2016/0210450 A121 Jul 2016
Granted: 1 May 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

G06F 21/316
User authentication: by observing the pattern of computer usage, e.g. typical user behaviour
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/88
Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer:…
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources