Determine suspicious user events using grouped activities

Patent metadata

Field	Value
Publication number	US-11297075-B2
Application number	US-201916503247-A
Country	US
Kind code	B2
Filing date	Jul 3, 2019
Priority date	Jul 3, 2019
Publication date	Apr 5, 2022
Grant date	Apr 5, 2022

Abstract

According to examples, an apparatus may include a processor and a computer readable medium on which is stored machine readable instructions that may cause the processor to assign the activities in user activity data into a plurality of groups based on common user identifiers corresponding to the pairs of activities. The instructions may also cause the processor to determine a correlation between a user event and the plurality of groups, determine whether the user event is suspicious based on the determined correlation, and based on a determination that the user event is suspicious, output an indication that the user event is suspicious.

First claim

What is claimed is:

1. An apparatus comprising:
a processor; and
a computer readable medium on which is stored machine readable instructions that are to cause the processor to:
access user activity data that identifies activities and user identifiers corresponding to the activities;
identify a first pair of activities that corresponds to a first set of common user identifiers in the user activity data;
identify a second pair of activities that corresponds to a second set of common user identifiers in the user activity data;
determine how many user identifiers correspond to the first pair of activities;
determine how many user identifiers correspond to the second pair of activities;
assign the activities into a plurality of groups based on how many user identifiers correspond to each of the first and second pairs of activities;
determine a correlation between a user event and the plurality of groups;
determine whether the user event is suspicious based on the determined correlation; and
based on a determination that the user event is suspicious, output an indication that the user event is suspicious.

2. The apparatus of claim 1 , wherein the instructions are further to cause the processor to:
assign each of the activities as a node in a graph;
assign edges between respective pairs of nodes, wherein a property of each of the edges corresponds to a determined number of user identifiers for the respective pair of nodes to which the edge connects; and
assign the activities into a plurality of groups based on the properties of the edges between the respective pairs of nodes.

3. The apparatus of claim 2 , wherein the instructions are further to cause the processor to:
apply a distinguishing characteristic to the nodes according to the groups in which the nodes are assigned.

4. The apparatus of claim 1 , wherein to determine the correlation between the user event and the plurality of groups, the instructions are further to cause the processor to:
identify a user identifier of the user event;
determine prior user activities corresponding to the identified user identifier; and
based on the determined prior user activities, determine to which of the plurality of groups the identified user identifier belongs.

5. The apparatus of claim 4 , wherein, to determine whether the user event is suspicious, the instructions are further to cause the processor to:
determine that the user event does not fall within a group to which the user identifier belongs; and
based on a determination that the user event does not fall within a group to which the user identifier belongs, determine that the user event is suspicious.

6. The apparatus of claim 4 , wherein the instructions are further to cause the processor to:
based on a determination the user event is suspicious, output the determined prior user activities corresponding to the identified user identifier.

7. The apparatus of claim 4 , wherein, to determine whether the user event is suspicious, the instructions are further to cause the processor to:
determine that the user event falls inside of a group to which the user identifier belongs; and
based on a determination that the user event falls within a group to which the user identifier belongs, determine that the user event is not suspicious.

8. The apparatus of claim 1 , wherein the instructions are further to cause the processor to:
based on a determination that the user event is suspicious, output an instruction to limit or deny access by a user identifier associated with the user event to an application.

9. A method comprising:
accessing, by a processor, user activity data pertaining to an application, the user activity data including activities and user identifiers corresponding to the activities;
identifying, by the processor, a first pair of activities that corresponds to a first set of common user identifiers in the user activity data;
identifying, by the processor, a second pair of activities that corresponds to a second set of common user identifiers in the user activity data;
determining, by the processor, how many user identifiers correspond to the first pair of activities;
determining, by the processor, how many user identifiers correspond to the second pair of activities;
assembling, by the processor, each of the activities into one of a plurality of groups based on how many user identifiers correspond to each of the first and second pairs of activities;
identify a user event;
determining, by the processor, to which of the plurality of groups a user identifier of the user event belongs;
based on the determined group to which the user identifier of the user event belongs, determining, by the processor whether the user event is abnormal; and
based on a determination that the user event is abnormal, outputting, by the processor, an indication that the user event is abnormal.

10. The method of claim 9 , further comprising:
determining prior user activities corresponding to the user identifier of the user event; and
based on the determined prior user activities, determining to which of the plurality of groups the user identifier of the user event belongs.

11. The method of claim 10 , further comprising:
determining that the user event does not fall within a group to which the user identifier of the user event is determined to belong; and
based on a determination that the user event does not fall within a group to which the user identifier belongs, determining that the user event is abnormal.

12. The method of claim 11 , further comprising:
based on a determination that the user event is abnormal, outputting the determined user activities corresponding to the user identifier of the user event.

13. The method of claim 10 , further comprising:
determining that the user event does not match any of the determined prior user activities corresponding to the user identifier of the user event and falls within a group to which the user identifier of the user event is determined to belong; and
based on the determination that the user event does not match any of the determined prior user activities corresponding to the user identifier of the user event and falls within a group to which the user identifier of the user event is determined to belong, determining that the user event is normal.

14. The method of claim 9 , further comprising:
assigning each of the activities in the plurality of activities as a respective node in a graph;
assigning edges between respective pairs of nodes, wherein a property of each of the edges corresponds to a determined number of user identifiers for the respective pair of nodes to which the edge connects; and
wherein assembling each of the activities further comprises assembling each of the activities into one of the plurality of groups based on the properties of the edges between the respective pairs of nodes.

15. The method of claim 14 , further comprising:
applying a distinguishing characteristic to the nodes according to the groups in which the nodes are assembled.

16. A computer readable medium on which is stored machine readable instructions that when executed by a processor, cause the processor to:
identify a first pair of activities that corresponds to a first set of common users;
identify a second pair of activities that corresponds to a second set of common users;
determine how many users correspond to the first pair of activities;
determine how many users correspond to the second pair of activities;
assign the activities into a plurality of groups based on how many users correspond to each of the first

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Keren Shai
• Most Yonatan

Classifications

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/102

  Entity profiles · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title