System and method for detecting fraudulent online transactions

Patent metadata

Field	Value
Publication number	US-2016247158-A1
Application number	US-201514721872-A
Country	US
Kind code	A1
Filing date	May 26, 2015
Priority date	Feb 20, 2015
Publication date	Aug 25, 2016
Grant date	—

Abstract

Disclosed is a system and method for detecting fraudulent transactions. An example method includes receiving data relating to an electronic transaction, including at least one of user actions data and malware actions data; analyzing, the data to determine whether the electronic transaction is a possible fraudulent transaction based on a predetermined algorithm stored in an electronic memory; determining whether the possible fraudulent transaction is a legitimate electronic transaction, and adjusting the operating parameters of the predetermined algorithm if the hardware processor determines that the possible fraudulent transaction is a legitimate electronic transaction.

First claim

1 . A method for detecting fraudulent transactions, the method comprising:
receiving, by a communication interface, data relating to an electronic transaction, including at least one of user actions data and malware actions data; analyzing, by a hardware processor, the data to determine whether the electronic transaction is a possible fraudulent transaction based on a predetermined algorithm stored in an electronic memory; determining, by the hardware processor, whether the possible fraudulent transaction is a legitimate electronic transaction; and adjusting, by the hardware processor, operating parameters of the predetermined algorithm when the hardware processor determines that the possible fraudulent transaction is a legitimate electronic transaction.

2 . The method of claim 1 , wherein the data relating to an electronic transaction is a number of events performed by a computer executing the requesting electronic transaction during a predetermined time period.

3 . The method of claim 2 , wherein the events performed by the computer include at least one of a number of activations of keys on a keyboard, a number of activations of buttons of a computer mouse, a trajectory of movement of the mouse or a track ball, downloading of webpages, a frequency of selecting links on the webpages, a timing of keystrokes, and a presence and correction of errors during keystrokes.

4 . The method of claim 2 , wherein the predetermined time period is at least one of the operating parameters of the predetermined algorithm.

5 . The method of claim 4 , wherein adjusting the operating parameters comprises
calculating an average frame value by dividing an average duration of time of the electronic transaction performed by the computer by the number of events performed by the computer; calculating a minimum frame value by dividing a minimum duration of time of the electronic transaction performed by the computer by a number of events performed by the computer; calculating respective reciprocals of the average frame value and the minimum frame value; and updating the predetermined time period as an average value of respective calculated reciprocals.

6 . The method of claim 4 , wherein adjusting the operating parameters comprises:
dividing time of the electronic transaction performed by the computer into a plurality of frames of equal duration; counting the number of events in each of the plurality of frames; calculating an average value and a dispersion of the number of events in each of the plurality of frames; calculating a cost function according to the following formula:

C
n



(
Δ
)

=

2

k

-
v

(

n



Δ

)

2

,

wherein k is the average value, ν is the dispersion, Δ is the duration of each of the plurality of frames, and n is a number of adjustments to the predetermined algorithm; and
updating the predetermined time period to minimize the calculated cost function.

7 . The method of claim 4 , wherein adjusting the operating parameters comprises:
setting a time of the electronic transaction performed by the computer as a single frame; counting the number of events in the single frame; if the number of events is greater than 0, dividing the single frame into two equal frames; continuously dividing each of the two equal frames into two additional equal frames, respectively, until one of the additional equal frames has zero number of events; and updating the predetermined time period based on a frame size of the one additional equal frames that has zero number of events.

8 . A system for detecting fraudulent transactions, the system comprising:
a communication interface configured to data relating to an electronic transaction, including at least one of user actions data and malware actions data; and a hardware processor configured to:
analyze the data to determine whether the electronic transaction is a possible fraudulent transaction based on a predetermined algorithm stored in an electronic memory,
determine whether the possible fraudulent transaction is a legitimate electronic transaction, and
adjust operating parameters of the predetermined algorithm if the hardware processor determines that the possible fraudulent transaction is a legitimate electronic transaction.

9 . The system of claim 8 , wherein the data relating to an electronic transaction is a number of events performed by a computer executing the requesting electronic transaction during a predetermined time period.

10 . The system of claim 9 , wherein the events performed by the computer can include at least one of a number of activations of keys on a keyboard, a number of activations of buttons of a computer mouse, a trajectory of movement of the mouse or a track ball, downloading of webpages, a frequency of selecting links on the webpages, a timing of keystrokes, and a presence and correction of errors during keystrokes.

11 . The system of claim 9 , wherein the predetermined time period is at least one of the operating parameters of the predetermined algorithm.

12 . The system of claim 11 , wherein the hardware processor is configured to adjust the operating parameters by:
calculating an average frame value by dividing an average duration of time of the electronic transaction performed by the computer by the number of events performed by the computer; calculating a minimum frame value by dividing a minimum duration of time of the electronic transaction performed by the computer by a number of events performed by the computer; calculating respective reciprocals of the average frame value and the minimum frame value; and updating the predetermined time period as an average value of respective calculated reciprocals.

13 . The system of claim 11 , wherein the hardware processor is configured to adjust the operating parameters by:
dividing time of the electronic transaction performed by the computer into a plurality of frames of equal duration; counting the number of events in each of the plurality of frames; calculating an average value and a dispersion of the number of events in each of the plurality of frames; calculating a cost function according to the following formula:

C
n



(
Δ
)

=

2

k

Assignees

• Kaspersky Lab Zao

Inventors

• Kolotinsky Evgeny B

Classifications

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06Q20/42

  Confirmation, e.g. check or permission by the legal debtor of payment · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title