Detecting fraudulent activity from compromised devices

Patent metadata

Field	Value
Publication number	US-9565205-B1
Application number	US-201514667268-A
Country	US
Kind code	B1
Filing date	Mar 24, 2015
Priority date	Mar 24, 2015
Publication date	Feb 7, 2017
Grant date	Feb 7, 2017

Abstract

A technique for detecting fraudulent activity in a compromised device involves downloading a software application from a processor that controls access to a resource to an electronic device requesting access to the resource. The software application includes instructions that gather selected information from the electronic device such as mouse coordinates and active windows at a selected time and transmitting the information to the processor for analysis. The analysis includes determining whether more than a single input operation is occurring simultaneously. Simultaneous input operations are an improbable combination of processes for a single electronic device, and suggest a potential fraudulent activity. The technique may include sending a message to a security location for further analysis of the potential fraudulent activity, or the user may be contacted while the transaction attempt is delayed, or the attempted transaction operation may be terminated until enhanced security procedures are implemented.

First claim

What is claimed is:

1. A computer program product having a non-transitory computer readable medium which stores a set of instructions for detecting a fraudulent attempt to access a resource, the set of instructions causing a processor device to perform a method comprising:
receiving a request from a person using an electronic device for an interaction session between the electronic device and the processor device;
receiving information collected from the electronic device according to instructions of a software application running on the electronic device;
performing an analysis of the information collected from the electronic device to determine if the electronic device is simultaneously processing more than a single input/output activity; and
sending a message to an authorized location when the analysis indicates that an improbable set of processes are occurring in the electronic device;
wherein sending the message is in response to the analysis indicating that the electronic device provides two or more simultaneous different mouse coordinates.

2. The computer program product of claim 1 , wherein the improbable set of processes occurring in the electronic device further includes at least one of multiple input/output actions occurring simultaneously in a single electronic device, two or more simultaneously active windows, and two or more simultaneous keyboard entries.

3. The computer program product of claim 2 , wherein the information received from the electronic device includes an identification number of the electronic device, mouse coordinates and a local time at the electronic device when the mouse coordinates were collected.

4. The computer program product of claim 2 , wherein the improbable set of processes further includes simultaneous transmissions of signals occurring over a communication connection between the processor device and the electronic device.

5. The computer program product of claim 4 wherein the method further comprises transmitting, by the processor device, the software application to the electronic device, the software application including instructions causing the electronic device to (i) collect information from the electronic device at selected times, and (ii) transmit the information to the processor device.

6. The computer program product of claim 4 wherein the processor device comprises a computer performing financial transactions;
wherein the computer is constructed and arranged to perform an adaptive authentication process to authorize the person to access the resource; and
wherein the message to the authorized location includes an option to delay the transaction pending additional authentication information.

7. The computer program product of claim 1 wherein the message directs the authorized location to disable access to the resource in response to a detected multiple active window situation.

8. An electronic apparatus, comprising:
a network interface;
memory; and
processing circuitry coupled to the network interface and the memory, the memory storing instructions which, when carried out by the processing circuitry, cause the processing circuitry to:
receive a request from an electronic device for an interaction session between the electronic device and the processing circuitry;
receive information from the electronic device;
perform an analysis of the information from the electronic device to determine if the electronic device is simultaneously processing more than a single input/output activity; and
send a message to an authorized location when the analysis indicates that an improbable set of processes are occurring in the electronic device;

wherein the processing circuitry sends the message in response to the analysis indicating that the electronic device provides two or more simultaneous different mouse coordinates.

9. The electronic apparatus of claim 8 , wherein further the instructions cause the processing circuitry to transmit a software application via the communication connection to the electronic device, the software application including instructions to cause the electronic device to (i) collect information from the electronic device at selected times, and (ii) transmit the information to the processing circuitry.

10. The electronic apparatus of claim 8 , wherein the improbable set of processes occurring in the electronic device further includes at least one of multiple input/output actions occurring simultaneously in the electronic device, two or more simultaneously active windows, and two or more simultaneous keyboard entries.

11. The electronic apparatus of claim 10 , wherein the information received from the electronic device includes an identification number of the electronic device, mouse coordinates and a local time at the electronic device when the mouse coordinates were collected.

12. The electronic apparatus of claim 11 wherein the processing circuitry comprises a computer performing financial transactions;
wherein the processing circuitry is constructed and arranged to perform an adaptive authentication process to authorize the person to access the resource; and
wherein the message to the authorized location includes an option to delay the transaction pending additional authentication information.

13. The electronic apparatus of claim 10 , wherein the improbable set of processes includes simultaneous transmissions of signals occurring over the communication connection between the processing circuitry and the electronic device.

14. The electronic apparatus of claim 8 wherein the message directs the authorized location to disable access to the resource in response to a detected multiple active window situation.

15. A method of detecting a fraudulent attempt to access a resource, comprising:
receiving, at a processor device that controls access to the resource, a request from a client using an electronic device for an interaction session between the electronic device and the resource;
receiving, at the processor device, information collected from the electronic device according to the instructions of a software application running of the electronic device;
performing, by the processor device, an analysis of the transmitted information to determine if the electronic device is simultaneously performing more than a single input/output activity between the processor device and the electronic device; and
sending, by the processor device, a message to an authorized location when the analysis indicates that the client electronic device maybe processing a fraudulent transaction;
wherein sending the message is in response to the analysis indicating that the electronic device provides two or more simultaneous different mouse coordinates.

16. The method of claim 15 wherein receiving, at the processor device, the information collected from the electronic device further includes transmitting, by the processor device, a software application to the electronic device, the software application including instructions that cause the electronic device to (i) collect information from the electronic device at selected times and (ii) transmit the information to the processor device.

17. The method of claim 15 wherein the analysis indicates that there are at least two windows simultaneously active in the electronic device;
wherein sending the message includes notifying the client using the electronic device that electronic device includes more than one active window.

18. The method of claim 15 wherein the information collected from the electronic device is received by the processor device

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Fleyder Uri
• Kerner Rotem
• Rabinovich Zeev
• Salinas Rotem
• Ben-Porat Lior
• Frank Daniel

Classifications

• G06F2221/2115

  Third party · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F11/3466

  Performance evaluation by tracing or monitoring · CPC title

• G06F11/3438

  monitoring of user actions (tracking the activity of the user H04L67/535) · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title