Systems and methods for assessing security risk
Systems and methods for providing identification tests. In some embodiments, a system and a method are provided for generating and serving to a user an animated challenge graphic comprising a challenge character set whose appearance may change over time. In some embodiments, marketing content may be incorporated into a challenge message for use in an identification test. The marketing content may be accompanied by randomly selected content to increase a level of security of the identification test. In some embodiments, a challenge message for use in an identification test may be provided based on information regarding a transaction for which the identification test is administered. For example, the transaction information may include a user identifier such as an IP address. In some embodiments, identification test results may be tracked and analyzed to identify a pattern of behavior associated with a user identifier. A score indicative of a level of trustworthiness may be computed for the user identifier.
1. A system for assessing security risk associated with an electronic transaction, the electronic transaction being a first electronic transaction between a user system and a publisher system, the system comprising at least one processor programmed to:
analyze a first input pattern observed from the first electronic transaction to determine whether a plurality of web site input controls are accessed in an expected order, wherein the expected order corresponds to at least one of (i) a visual layout of a web page configured to display the website input controls and (ii) a defined Hypertext Markup Language (HTML) tabindex;
analyze a second input pattern observed from the first electronic transaction, the second input pattern related to timing of the plurality of web site input controls being accessed;
identify a network address from which at least one communication pertaining to the first electronic transaction is received by a web server of the publisher system;
use the network address to cross reference one or more account identifiers, wherein each account identifier of the one or more account identifiers cross referenced using the network address was observed in at least one of one or more other electronic transactions performed from the network address;
determine whether any account identifier of the one or more account identifiers cross referenced using the network address was previously flagged as being suspicious; and
if it is determined that at least one account identifier of the one or more account identifiers cross referenced using the network address was previously flagged as being suspicious:
flag the network address as also being suspicious; and
output an indication of an elevated level of risk.
2. The system of claim 1 , wherein the at least one processor is further programmed to:
maintain a transaction history of the network address, wherein the at least one processor is programmed to retrieve, from the transaction history of the network address, the one or more account identifiers observed in the one or more other electronic transactions performed from the network address.
3. The system of claim 2 , wherein the network address comprises an IP address.
4. The system of claim 1 , wherein the at least one processor is further programmed to:
determine, based at least in part on the elevated level of risk, at least one security measure to be taken.
5. The system of claim 4 , wherein the at least one security measure comprises allowing the electronic transaction to proceed but imposing one or more selected security requirements at one or more portions of a web site hosted by the web server of the publisher system.
6. The system of claim 4 , wherein the at least one security measure comprises a silent security measure configured to allow the electronic transaction to proceed but also configured to prevent, without providing a notification to the user system, one or more actions that are typically allowed once the electronic transaction has been completed.
7. A method for assessing security risk associated with an electronic transaction, the electronic transaction being a first electronic transaction between a user system and a publisher system, the method comprising acts of:
analyzing a first input pattern observed from the first electronic transaction to determine whether a plurality of web site input controls are accessed in an expected order, wherein the expected order corresponds to at least one of (i) a visual layout of a web page configured to display the website input controls and (ii) a defined Hypertext Markup Language (HTML) tabindex;
analyzing a second input pattern observed from the first electronic transaction, the second input pattern relating to timing of the plurality of web site input controls being accessed;
identifying a network address from which at least one communication pertaining to the first electronic transaction is received by a web server of the publisher system;
using the network address to cross reference one or more account identifiers, wherein each account identifier of the one or more account identifiers cross referenced using the network address was observed in at least one of one or more other electronic transactions performed from the network address;
determining whether any account identifier of the one or more account identifiers cross referenced using the network address was previously flagged as being suspicious; and
if it is determined that at least one account identifier of the one or more account identifiers cross referenced using the network address was previously flagged as being suspicious:
flagging the network address as also being suspicious; and
outputting an indication of an elevated level of risk.
8. The method of claim 7 , further comprising an act of:
maintaining a transaction history of the network address, wherein the one or more account identifiers observed in the one or more other electronic transactions performed from the network address are retrieved from the transaction history of the network address.
9. The method of claim 8 , wherein the network address comprises an IP address.
10. The method of claim 7 , further comprising an act of:
determining, based at least in part on the elevated level of risk, at least one security measure to be taken.
11. The method of claim 10 , wherein the at least one security measure comprises allowing the electronic transaction to proceed but imposing one or more selected security requirements at one or more portions of a web site hosted by the web server of the publisher system.
12. The method of claim 10 , wherein the at least one security measure comprises a silent security measure configured to allow the electronic transaction to proceed but also configured to prevent, without providing a notification to the user system, one or more actions that are typically allowed once the electronic transaction has been completed.
13. At least one non-transitory computer-readable medium having encoded thereon instructions which, when executed by at least one processor, cause the at least one processor to perform a method for assessing security risk associated with an electronic transaction between a user system and a publisher system, the electronic transaction being a first electronic transaction, the method comprising acts of:
analyzing a first input pattern observed from the first electronic transaction to determine whether, a plurality of web site input controls are accessed in an expected order, wherein the expected order corresponds to at least one of (i) a visual layout of a web page configured to display the website input controls and (ii) a defined Hypertext Markup Language (HTML) tabindex;
analyzing a second input pattern observed from the first electronic transaction, the second input pattern relating to timing of the plurality of web site input controls being accessed;
identifying a network address from which at least one communication pertaining to the first electronic transaction is received by a web server of the publisher system;
using the network address to cross reference one or more account identifiers, wherein each account identifier of the one or more account identifiers cross referenced using the network address was observed in at least one of one or more other electronic transactions performed from the network address;
determining whether any account identifier of the one or more account identifiers cross referenced using the network address was previously flagged as being suspicious; and
if it is determined that at least one account identifier of the one or more account identifiers cross referenced using the network address was previously flagged as being suspicious:
flagging the network address as also being suspicious; and
outputting an indication of an elevated level of risk.
14. The at least one non-transitory computer-readable medium of claim 13 , wherein the method further comprises an act of:
determining, based at least in part on the elevated level of risk, at least one security measure to be taken, wherein the at least one security measure comprises allowing the electronic transaction to proceed but imposing one or more selected security requirements at one or more portions of a web site hosted by the web server of the publisher system.
15. The at least one non-transitory computer-readable medium of claim 13 , wherein the method further comprises an act of:
determining, based at least in part on the elevated level of risk, at least one security measure to be taken, wherein the at least one security measure comprises a silent security measure configured to allow the electronic transaction to proceed but also configured to prevent, without providing a notification to the user system, one or more actions that are typically allowed once the electronic transaction has been completed.