System and method for distinguishing human swipe input sequence behavior and using a confidence value on a score to detect fraudsters
Recording, analyzing and categorizing of user interface input via touchpad, touch screens or any device that can synthesize gestures from touch and pressure into input events. Such as, but not limited to, smart phones, touch pads and tablets. Humans may generate the input. The analysis of data may include statistical profiling of individual users as well as groups of users, the profiles can be stored in, but not limited to data containers such as files, secure storage, smart cards, databases, off device, in the cloud etc. A profile may be built from user/users behavior categorized into quantified types of behavior and/or gestures. The profile might be stored anonymized. The analysis may take place in real time or as post processing. Profiles can be compared against each other by all the types of quantified behaviors or by a select few.
1. A method for calculating confidence in classification of user behavior, the method comprising:
generating a behavioral profile for an authorized user based on at least one data sample obtained from said authorized user;
following generation of said behavioral profile, obtaining a behavioral data sample from a user;
comparing said behavioral data sample to said behavioral profile for said authorized user;
based on said comparing, classifying said behavioral data sample as belonging to said authorized user or as belonging to another user; and
following said classifying, conducting an analysis of the confidence of said classifying based on comparing said behavioral data sample with profiles of other users and on at least two of the following: quality features of a previously generated profile, quality features of said behavioral data sample, and tests which are performed on said behavioral data sample, wherein
a. said analysis based on said quality features of a previously generated profile including analysis of at least three of the following:
i. a number of said at least one data samples used to generate said behavioral profile,
ii. a size of said at least one data samples used to generate said behavioral profile
iii. a type of said at least one data samples used to generate said behavioral profile, and
iv. consistency of the at least one data samples used to generate said behavioral profile
b. said analysis based on said quality features of said behavioral data sample including analysis of at least two of the following:
i. a length of said behavioral data sample,
ii. a size of said behavioral data sample,
iii. a type of said behavioral data sample, and
iv. anonymized data to calculate the confidence,
c. said analysis based on said tests which are performed on said behavioral data sample including analysis of at least two of the following:
i. a number of said tests that are performed,
ii. a weighting of said tests that are performed,
iii. a quality of said tests that are performed,
iv. a confidence of said tests that are performed, and
v. a type of said tests that are performed,
d. said comparing said behavioral data sample with profiles of other users including at least two of the following:
i. comparing said behavioral data sample with profiles of other users,
ii. comparing a confidence of said behavioral data sample in regard to said behavioral profile of said authorized user with the confidence of said behavioral data sample in regard to profiles of other users, and
iii. comparing the score of said behavioral data sample in regard to said behavioral profile of said authorized user with the score of said behavioral data sample in regard to said profiles of other users; and
comparing said behavioral data sample against previously approved behaviors using a Gaussian or other distribution function; and
rejecting said user or asking said user to re-authenticate if said comparison results in the confidence of a fraud being greater than the confidence of the behavioral data sample belonging to said authorized user.
2. A method according to claim 1 , further comprising rejecting said user if said analysis results in the confidence of a fraud being greater than the confidence of the behavioral data sample belonging to said authorized user.
3. A method according to claim 1 , further comprising identifying and signaling generated replay attacks by comparing said behavioral data sample with previously approved behaviors.