Risk assessment modeling

Patent metadata

Field	Value
Publication number	US-9779236-B2
Application number	US-201615188639-A
Country	US
Kind code	B2
Filing date	Jun 21, 2016
Priority date	May 21, 2014
Publication date	Oct 3, 2017
Grant date	Oct 3, 2017

Abstract

One or more techniques and/or systems are provided for risk assessment. Historical authentication data and/or compromised user account data may be evaluated to identify a set of authentication context properties associated with user authentication sessions and/or a set of malicious account context properties associated with compromised user accounts (e.g., properties indicative of whether a user recently visited a malicious site, created a fake social network profile, logged in from unknown locations, etc.). The set of authentication context properties and/or the set of malicious account context properties may be annotated to create an annotated context property training set that may be used to train a risk assessment machine learning model to generate a risk assessment model. The risk assessment model may be used to evaluate user context properties of a user account event to generate a risk analysis metric indicative of a likelihood the user account event is malicious or safe.

First claim

What is claimed is:

1. A computer system for risk assessment, comprising:
one or more processor; and
one or more storage devices having stored thereon computer-executable instructions, which are executable by the one or more processors to cause the computer system to:
evaluate historical authentication data to identify a set of authentication context properties associated with user authentication sessions;
evaluate compromised user account data to identify a set of malicious account context properties associated with at least one of compromised user accounts or compromised user authentication events;
annotate the set of authentication context properties and the set of malicious account context properties to create an annotated context properties training set;
train a plurality of risk assessment machine learning modules based upon the annotated context properties training set to generate a plurality of risk assessment models, wherein each risk assessment model is responsive to a predefined context property;
identify a current user account event of a current user;
evaluate a first current user context property of the current user using a first risk assessment model;
evaluate a second current user context property of the current user using a second risk assessment model;
aggregate results from the first and the second risk assessment models to generate a risk analysis metric;
moderate the current user account event based upon the risk analysis metric, wherein the current user account event is moderated by the computing system blocking the current user for a current session of the current user account event.

2. The computer system according to claim 1 , wherein the second current user context property is evaluated based on a first result obtained from the first risk assessment model.

3. The computing system of claim 2 , wherein the first result obtained from the first risk assessment model indicates that one or more user context properties are indicative of either a malicious user account event or a safe user account event.

4. The computing system of claim 1 , the annotated context properties training set is annotated in response to the computing system:
evaluating the set of malicious account context properties to identify a user account context property pattern indicative of at least one of a compromised user account or a compromised user authentication event; and
annotating the user account context property pattern as malicious to create a malicious user account context property pattern for inclusion within the annotated context property training set.

5. The computing system of claim 1 , wherein the computer-executable instructions are further executable by the one or more processors to cause the computer system to:
receive user feedback to the moderation of the current user account event; and
based on the user feedback, to modify one or more confidence weights associated with one or more decision structures to update one or more of the plurality of risk assessment models.

6. The computing system of claim 1 , wherein the current user account event is moderated by the computing system performing one or more:
providing restricted access to a destination; or
allowing the user to proceed unimpeded.

7. One or more hardware storage devices having stored thereon computer-executable instructions, which are executable by one or more processors of a computing system to cause the computer system to:
evaluate historical authentication data to identify a set of authentication context properties associated with user authentication sessions;
evaluate compromised user account data to identify a set of malicious account context properties associated with at least one of compromised user accounts or compromised user authentication events;
annotate the set of authentication context properties and the set of malicious account context properties to create an annotated context properties training set;
train a plurality of risk assessment machine learning modules based upon the annotated context properties training set to generate a plurality of risk assessment models, wherein each risk assessment model is responsive to a predefined context property;
identify a current user account event of a current user;
evaluate a first current user context property of the current user using a first risk assessment model;
evaluate a second current user context property of the current user using a second risk assessment model;
aggregate results from the first and the second risk assessment models to generate a risk analysis metric; and
moderate the current user account event based upon the risk analysis metric, wherein the current user account event is moderated by the computing system blocking the current user for a current session of the current user account event.

8. The one or more hardware storage device according to claim 7 , wherein the second current user context property is evaluated based on a first result obtained from the first risk assessment model.

9. The one or more hardware storage device of claim 8 , wherein the first result obtained from the first risk assessment model indicates that one or more user context properties are indicative of either a malicious user account event or a safe user account event.

10. The one or more hardware storage device of claim 7 , the annotated context properties training set is annotated in response to the computing system:
evaluating the set of malicious account context properties to identify a user account context property pattern indicative of at least one of a compromised user account or a compromised user authentication event; and
annotating the user account context property pattern as malicious to create a malicious user account context property pattern for inclusion within the annotated context property training set.

11. The one or more hardware storage device of claim 7 , wherein the computer-executable instructions are further executable by the one or more processors to cause the computer system to:
receive user feedback to the moderation of the current user account event; and
based on the user feedback, to modify one or more confidence weights associated with one or more decision structures to update one or more of the plurality of risk assessment models.

12. The one or more hardware storage device of claim 7 , wherein the current user account event is moderated by the computing system performing one or more:
blocking the current user until a user response is received; or
providing an authentication challenge to the current user.

13. A computer implemented method for risk assessment, comprising:
a computer system evaluating historical authentication data to identify a set of authentication context properties associated with user authentication sessions;
a computer system evaluating compromised user account data to identify a set of malicious account context properties associated with at least one of compromised user accounts or compromised user authentication events;
a computer system annotating the set of authentication context properties and the set of malicious account context properties to create an annotated context properties training set;
a computer system training a plurality of risk assessment machine learning modules based upon the annotated context properties training set to generate a plurality of risk assessment models, wherein each risk assessment model is responsive to a predefined context property;
a computer system identifying a current user account event of a current user;
a computer system evaluating a first current user context property of the current user using a fir

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Abrams Luke
• Steeves David J
• Sim Robert Alexander
• Wong Pui-Yin Winfred
• Katz Harry Simon
• Small Aaron
• Kaufman Dana Scott
• Kreuziger Adrian
• Nikiel Mark A
• Cristofor Laurentiu Bogdan
• Keizur Alexa Lynn
• Tibbetts Collin
• Hayden Charles

Classifications

• G06N99/00

  Subject matter not provided for in other groups of this subclass · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/316

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title