DETECTING DEVIATIONS FROM TYPICAL USER BEHAVIOR
Detecting deviations from typical user behavior, including: identifying a geographic location of a device that is associated with a user; determining device activity associated with the user; and detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.
1 . A method of detecting deviations from typical user behavior, the method comprising:
determining device activity associated with the user; and
detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.
2 . The method of claim 1 further comprising, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert.
3 . The method of claim 1 further comprising generating the profile associated with the user.
4 . The method of claim 1 wherein determining device activity associated with the user further comprises:
identifying one or more applications accessed by the device; and
identifying application behavior for the one or more applications.
5 . The method of claim 1 further comprising generating a user-specific polygraph, the user-specific polygraph including a location of the device and the device activity associated with the user.
6 . The method of claim 5 wherein the user-specific polygraph includes one or more alerts.
7 . The method of claim 1 wherein device activity associated with the user is continuously monitored for deviation from normal activity.
8 . The method of claim 1 wherein the device activity associated with the user and the profile associated with the user include temporal information.
9 . The method of claim 1 further comprising identifying a location of a device that is associated with a user.
10 . A system for detecting deviations from typical user behavior, the system including computer program instructions that, when executed, cause the system to carry out the steps of:
identifying a location of a device that is associated with a user;
determining device activity associated with the user; and
detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.
11 . The system of claim 10 further comprising computer program instructions that, when executed, cause the system to carry out the step of, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert.
12 . The system of claim 10 further comprising computer program instructions that, when executed, cause the system to carry out the step of generating the profile associated with the user.
13 . The system of claim 10 wherein determining device activity associated with the user further comprises:
identifying one or more applications accessed by the device; and
identifying application behavior for the one or more applications.
14 . The system of claim 10 further comprising computer program instructions that, when executed, cause the system to carry out the step of generating a user-specific polygraph, the user-specific polygraph including the location of the device and the device activity associated with the user.
15 . The system of claim 14 wherein the user-specific polygraph includes one or more alerts.
16 . The system of claim 10 wherein device activity associated with the user is continuously monitored for deviation from normal activity.
17 . The system of claim 10 wherein the device activity associated with the user and the profile associated with the user include temporal information.
18 . A computer program product for detecting deviations from typical user behavior, the computer program product disposed on a computer readable medium, the computer program product including computer program instructions that, when executed, carry out the steps of:
identifying a location of a device that is associated with a user;
determining device activity associated with the user; and
detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.
19 . The computer program product of claim 18 further comprising computer program instructions that, when executed, carry out the step of, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert.
20 . The computer program product of claim 18 further comprising computer program instructions that, when executed, carry out the step of generating a user-specific polygraph, the user-specific polygraph including the location of the device and the device activity associated with the user.