Systems and methods for remote detection of computer device attributes

Patent metadata

Field	Value
Publication number	US-2020380522-A1
Application number	US-201916428339-A
Country	US
Kind code	A1
Filing date	May 31, 2019
Priority date	May 31, 2019
Publication date	Dec 3, 2020
Grant date	—

Abstract

Methods and systems are presented for assessing a veracity of device attributes obtained from a computer device based on estimating a number of processing cycles used by the computer device to perform a particular function. In response to receiving a transaction request from the computer device, software programming instructions are transmitted to the computer device for obtaining device attributes of the computer device. The software programming instructions may also include code that estimate a number of processing cycles used by the computer to perform a particular function. The particular function may be associated with obtaining at least one of the device attributes of the computer device. The estimated number of processing cycles may be compared against a benchmark profile. A risk associated with the transaction request is determined based on the comparing.

First claim

What is claimed is:

1 . A system, comprising:
a non-transitory memory; and one or more hardware processors coupled with the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
receiving a transaction request from an application running on a user device;
transmitting, to the user device, code that causes the application running on the user device to perform a function as part of processing the transaction request;
estimating a number of processor cycles used by the user device for performing the function;
comparing the estimated number of processor cycles used by the user device against a processor cycle benchmark associated with performing the function; and
determining a risk associated with the transaction request based on the comparing.

2 . The system of claim 1 , wherein the code is embedded within a webpage transmitted to the user device.

3 . The system of claim 2 , wherein the code comprises an application programming interface call associated with a web browser and a timer configured to determine a time duration for the user device to execute the function call.

4 . The system of claim 1 , wherein the code transmitted to the user device causes the user device to iteratively execute the function for a number of times.

5 . The system of claim 4 , wherein the operations further comprise determining the number of times for the user device to iteratively execute the function based on at least one of a type of transaction associated with the transaction request, an amount associated with the transaction request, a location of the user device, or a user profile associated with a user of the user device.

6 . The system of claim 1 , wherein the operations further comprise authorizing the transaction request based on the determined risk.

7 . The system of claim 1 , wherein the operations further comprise:
determining that the estimated number of processor cycles deviates from the processor cycle benchmark by a predetermined threshold; and increasing a risk level associated with the transaction request based on the determining that the estimated number of processor cycles deviates from the processor cycle benchmark by a predetermined threshold.

8 . The system of claim 7 , wherein the processor cycle benchmark is a first processor cycle benchmark, and wherein the operations further comprise:
determining an application type of the application used by the user device to perform the function; and selecting, from a plurality of processor cycle benchmarks corresponding to a plurality of application types, the first processor cycle benchmark for determining the risk of the transaction request based on the application type of the application.

9 . A method comprising:
receiving a transaction request from an application running on a user device; transmitting, to the user device, code comprising an application programming interface (API) call associated with the application that causes the application to perform a function as part of processing the transaction request; estimating a time duration used by the application of the user device for executing the function; comparing the estimated time duration against a benchmark associated with executing the function; and determining a risk associated with the transaction request based on the comparing.

10 . The method of claim 9 , wherein the code causes the application to iteratively perform the function a number of times, and wherein the method further comprises determining the number of times for the user device to iteratively execute the function based on at least one of a type of transaction associated with the transaction request, an amount associated with the transaction request, a location of the user device, or a user profile associated with a user of the user device.

11 . The method of claim 9 , further comprising:
determining that an extension to a user interface application is installed on the user device based on an extent that the estimated time deviates from the benchmark time; and in response to determining that the extension to the user interface application is installed on the user device, increasing the risk associated with the transaction request.

12 . The method of claim 9 , wherein the function is associated with obtaining a set of device attributes of the user device, and wherein the method further comprises determining a veracity of the set of device attributes based on the estimated time.

13 . The method of claim 12 , further comprising generating a device fingerprint of the user device based on the set of device attributes.

14 . The method of claim 9 , wherein the function is associated with obtaining a device attribute of the user device, and wherein the device attributes comprise at least one of an Internet Protocol address of the user device, a location of the user device, a screen resolution of a display of the user device, an identifier of the user device, or an operating system running on the user device.

15 . A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
receiving a transaction request from a user device; transmitting, to the user device, code that causes the user device to perform a function as part of processing the transaction request; estimating a number of processor cycles used by the user device for performing a function; comparing the estimated number of processor cycles used by the user device against a processor cycle benchmark associated with performing the function; and determining a risk associated with the transaction request based on the estimated number of processor cycles.

16 . The non-transitory machine-readable medium of claim 15 , wherein the processor cycle benchmark is associated with a malicious extension installable on the user device, and wherein the operations further comprise:
determining that the malicious extension was installed on the user device based on the comparing; and increasing a risk level associated with the transaction request based on the determining that the malicious extension was installed on the user device.

17 . The non-transitory machine-readable medium of claim 15 , wherein the operations further comprise:
determining that a malware is installed on the user device based on the comparing; and transmitting, to the user device, a notification indicating that the malware is installed on the user device.

18 . The non-transitory machine-readable medium of claim 15 , wherein the transaction request comprises at least one of a login request, a payment request, a content access request, or a fund transfer request.

19 . The non-transitory machine-readable medium of claim 15 , wherein the function is associated with obtaining information regarding at least one of a version of an application used by the user device for transmitting the transaction request, a screen resolution of the user device, or an operating system used by the user device.

20 . The non-transitory machine-readable medium of claim 15 , wherein the code comprises an application programming interface (API) call associated with a web browser and a timer configured to determine a time duration for the user device to execute the API call.

Assignees

• Paypal Inc

Inventors

• Perkal Yotam
• Shafet Yuri

Classifications

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• G06F21/44

  Program or device authentication · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title