Monitoring user authenticity

Patent metadata

Field	Value
Publication number	US-9876825-B2
Application number	US-201615015892-A
Country	US
Kind code	B2
Filing date	Feb 4, 2016
Priority date	Feb 4, 2016
Publication date	Jan 23, 2018
Grant date	Jan 23, 2018

Abstract

Systems and methods for monitoring user authenticity according to user activities on an application server. A user-modeling process and a user-verification process are performed. In the user-modeling process, a user model is adapted session-by-session to user activities in which the user model includes a plurality of adaptive feature-specific user-behavior models. The user-verification process includes determining a plurality of feature-specific risk-score values, comparing the at least one of the adaptive feature-specific user-behavior models with a respective feature extracted from user activity in the user session on the application server, and determining a total risk-score value indicative of user authenticity by weighting and combining the plurality of feature-specific risk-score values. If the total risk-score value is greater than a given threshold, a corrective action is performed.

First claim

What is claimed is:

1. A server system for monitoring user authenticity during user activities in user sessions on at least one application server, the server system comprising:
one or more processors; and
at least one computer readable storage memory comprising program code that, when executed by the one or more processors, causes the one or more processors to:
perform a user-modeling process in which a user model is adapted session-by-session to user activities, wherein the user model includes a plurality of adaptive feature-specific user-behavior models that are associated with features indicative of user behavior; and
perform a user-verification process comprising:
determining a plurality of feature-specific risk-score values, wherein determining each feature-specific risk-score value comprises comparing at least one of the adaptive feature-specific user-behavior models with each respective feature extracted from one or more of the user activities during one of the user sessions on the at least one application server,
determining a total risk-score value indicative of user non-authenticity by:
a) weighting and combining the feature-specific risk-score values, wherein the feature-specific risk-score values are combined by a multi-criteria decision analysis technique, and
b) weighting and combining pre-combined risk-score values, wherein the pre-combined risk-score values are determined by combining a portion of the feature-specific risk-score values using multi-criteria decision analysis, and
in response to the total risk-score value exceeding a given threshold, performing a corrective action selected from the group consisting of (i) signing out the user, (ii) requesting a two-factor authentication from the user, (iii) locking the user, and (iv) initiating an alert function,
wherein the user model is adapted on a user-model server based on the user activities associated with different applications on the at least one application server, and the adaptive feature-specific user-behavior models are specific for the different applications.

2. The server system of claim 1 wherein the features are selected from the group consisting of client information, office information, and organization information.

3. The server system of claim 1 wherein the user model is replicated from the user-model server to the at least one application server, and the total risk-score value is determined on the at least one application server using the user model.

4. The server system of claim 1 wherein the features are selected from the group consisting of origins of the user activities, time stamps of the user activities, and durations of the user sessions in which the user activities are performed.

5. The server system of claim 1 wherein the features are time stamps of the user activities, a feature-specific behavior model is associated with the time stamps of the user activities and comprises a Gaussian-mixture model of the time stamps of the user activities, and the feature-specific risk-score value associated with the time stamps of the user activities is calculated based on a complement of probabilities from the Gaussian-mixture model.

6. The server system of claim 1 wherein the features are the durations of the user sessions, a feature-specific behavior model is associated with the durations of the user sessions, and the feature-specific behavior-model maps the durations of the user sessions to (i) a moving average, (ii) a median, (iii) a standard-deviation, or (iv) a quantile.

7. The server system of claim 1 wherein the features comprise a sequence of actions performed by the user, a feature-specific behavior model is associated with the actions and is a Markov chain model, and the feature-specific risk-score value associated with the sequence of actions performed by the user is calculated by determining a complement of the Markov-probability of the sequence extracted from the actions.

8. The server system of claim 1 wherein the feature-specific risk-score values are combined by weighting the score values according to their relative fraud probability.

9. The server system of claim 1 wherein the multi-criteria decision analysis technique is based on a weighted ordered-weighted-average, an ordered-weighted average, or a fuzzy integral of the feature-specific risk-score values.

10. The server system of claim 1 wherein the corrective action is performed in response to a certain feature pattern being detected and regardless of the total risk-score value.

11. A method of monitoring user authenticity during user activities in user sessions on at least one application server, the method comprising:
performing a user-modeling process in which a user model is adapted session-by-session to user activities, wherein the user model includes a plurality of adaptive feature-specific user-behavior models that are associated with features indicative of user behavior; and
perform, by one or more processors of the at least one application server, a user-verification process comprising:
determining a plurality of feature-specific risk-score values, wherein determining each feature-specific risk-score value comprises comparing at least one of the adaptive feature-specific user-behavior models with a respective feature extracted from one or more of the user activities in one of the user sessions on the at least one application server,
determining a total risk-score value indicative of user non-authenticity by:
a) weighting and combining the feature-specific risk-score values, wherein the feature-specific risk-score values are combined by a multi-criteria decision analysis technique, and
b) weighting and combining pre-combined risk-score values, wherein the pre-combined risk-score values are determined by combining a portion of the feature-specific risk-score values using multi-criteria decision analysis, and
in response to the total risk-score value exceeding a given threshold, performing a corrective action selected from the group consisting of (i) signing out the user, (ii) requesting a two-factor authentication from the user, (iii) locking the user, and (iv) initiating an alert function,
wherein the user model is adapted on a user-model server based on the user activities associated with different applications on the at least one application server, and the adaptive feature-specific user-behavior models are specific for the different applications.

12. The method of claim 11 wherein the features are selected from the group consisting of client information, office information, and organization information.

13. The method of claim 11 wherein the user model is replicated from the user-model server to the at least one application server, and the total risk-score value is determined on the at least one application server using the user model.

14. The method of claim 11 wherein the features are selected from the group consisting of origins of the user activities, time stamps of the user activities, and durations of the user sessions in which the user activities are performed.

15. The method of claim 11 wherein the features are time stamps of the user activities, a feature-specific behavior model is associated with the time stamps of the user activities and comprises a Gaussian-mixture model of the time stamps of the user activities, and the feature-specific risk-score value associated with the time stamps of the user activities is calculated based on a complement of probabilities from the Gaussian-mixture model.

16. The method of claim 11 wherein the features are the durations of the user sessions, a feature-specific b

Assignees

• Amadeus Sas

Inventors

• Amar Virginie
• Barlet Jeremie
• Campora Marc
• El Hayek Joseph
• Peicle Romain
• Thonnard Olivier
• Zouaoui Jihane

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L67/42

  Electricity · mapped topic

• H04L63/1433

  Vulnerability analysis · CPC title