System and method to identify user and device behavior abnormalities to continuously measure transaction risk
Aspects of the disclosure provide techniques for using behavior based information for providing and restricting access to a secure website, or computer network and its assets to a user. Components of the system may include the following. Client remote computing device, network and browser unique attribute data collection and fingerprinting. Method for capturing user habits and fingerprinting with ability to detect abnormalities through AIML using mobile and wearable device applications. System for detection of normality of user behavior based on habits, and cyber transactions, device access and determining a confidence score associated with each transaction. Method for calculating individual transaction risk based on contextual factors such as user behavior, device, browser and the network traffic and request for authentication by account owner when risk greater than allowed threshold. Method and system to identify user device, browser, and behavior unique attributes, storing and later matching to infer change upon consequent transactions and measuring transaction risk through a search and match against classified set of static and dynamic attributes using a user, browser traffic, device search and match engine.
1. A system for using user entity context and behavior information for providing and restricting access to a secure computer network comprising:
a plurality of hardware processors coupled to a network interface, the hardware processors configured to:
capture behavioral and contextual factors of a user entity interacting with a client device used to access cloud services, wherein the behavioral and contextual factors include the user entity behavior and habits, client device characteristics, client device browser characteristics and network traffic when transacting and not transacting with the secure computer network;
calculate a transaction risk and confidence score of a user entity, the client device and the client device browser for a transaction request based on the user entity behavior and habits and client device characteristics obtained from the user entity when transacting and not transacting with the secure computer network; and
compare the transaction risk and confidence score to a predetermined threshold required risk score to determine whether the transaction request is automatically approved and when not approved, send an out of band authentication request to a user entity device to authenticate and authorize access.
2. The system of claim 1 , wherein the behavioral and contextual factors required to determine the transaction risk and confidence score are limited to the user entity behavior and habits and client device characteristics and wherein the number of behavioral and contextual factors used to determine the transaction risk and confidence score are increased depending on the level of risk associated with deviation of the user entity and client device normal behavior.
3. The system of claim 1 , wherein the behavioral and contextual factors of the user entity interacting with the client device include at least one from the group consisting of: unique attribute data collection and fingerprinting of the network; unique attribute data collection and fingerprinting of the client device; and unique attribute data collection and fingerprinting of the client device browser.
4. The system of claim 1 , wherein the plurality of processors are further configured to:
measure the transaction risk through a search and match against a set of static and dynamic attributes using the behavioral and contextual factors of the user entity, the client device characteristics, and the client device browser characteristics; and
match the attributes of past approved transactions.
5. The system of claim 1 , wherein the out-of-band authentication request is performed using at least one from a group consisting of:
email, short message service (sms), voice, push, voice call, secure key, biometric authentication, and nearfield communications with the user entity device.
6. The system of claim 1 , wherein the contextual data of the user entity device contributes to the calculation of the transaction risk and confidence score.
7. The system of claim 1 , wherein the behavioral and contextual factors further include at least one of the group of egocentric and allocentric factors consisting of:
the user entity device model, the user entity device hardware configuration, the user entity device operating system, the user entity device applications, the user entity device web browser version, information of the client device.
8. A method for using user entity context and behavior information for providing and restricting access to a secure computer network comprising:
capturing behavioral and contextual factors of a user entity interacting with a client device used to access cloud services, wherein the behavioral and contextual factors include the user entity behavior and habits, client device characteristics, client device browser characteristics and network traffic when transacting and not transacting with the secure computer network;
calculating a transaction risk and confidence score of a user entity, the client device and the client device browser for a transaction request based on the user entity behavior and habits and client device characteristics obtained from the user entity when transacting and not transacting with the secure computer network; and
comparing the transaction risk and confidence score to a predetermined threshold required risk score to determine whether the transaction request is automatically approved and when not approved, send an out of band authentication request to a user entity device to authenticate and authorize access.
9. The method of claim 8 , wherein the behavioral and contextual factors required to determine the transaction risk and confidence score are limited to the user entity behavior and habits and client device characteristics and wherein the number of behavioral and contextual factors used to determine the transaction risk and confidence score are increased depending on the level of risk associated with deviation of the user entity and client device normal behavior.
10. The method of claim 8 , wherein the behavioral and contextual factors of the user entity interacting with the client device include at least one from the group consisting of: unique attribute data collection and fingerprinting of the network;
unique attribute data collection and fingerprinting of the client device; and unique attribute data collection and fingerprinting of the client device browser.
11. The method of claim 8 , further comprising:
measuring the transaction risk through a search and match against a set of static and dynamic attributes using the behavioral and contextual factors of the user entity, the client device characteristics, and the client device browser characteristics; and
matching the attributes past approved transactions.
12. The method of claim 8 , wherein the out-of-band authentication request is performed using at least one from a group consisting of:
email, short message service (sms), voice, push, voice call, secure key, and biometric authentication, and nearfield communications with the user entity device.
13. The method of claim 8 , wherein the contextual data of a user entity device contributes to the calculation of the transaction risk and confidence score.
14. The method of claim 8 , wherein the behavioral and contextual factors further include at least one of the group of egocentric and allocentric factors consisting of:
the user entity device model, the user entity device hardware configuration, the user entity device operating system, the user entity device applications, the user entity device web browser version, information of the client device.
15. The system of claim 1 wherein the user entity device includes hardware sensors embedded inside the user entity device to measure haptic-taptic factors; and
wherein the behavioral and contextual factors include the haptic-taptic factors.
16. The system of claim 1 wherein the user entity device includes a plurality of sensors to capture ambient noise, movements and location of the user entity device; and
wherein the behavioral and contextual factors include the ambient noise, movements and location of the user entity device.
17. The method of claim 8 wherein the user entity device includes hardware sensors embedded inside the user entity device to measure haptic-taptic factors; and
wherein the behavioral and contextual factors include the haptic-taptic factors.
18. The method of claim 8 wherein the user entity device includes a plurality of sensors to capture ambient noise, movements and location of the user entity device; and
wherein the behavioral and contextual factors include the ambient noise, movements and location of the user entity device.