Detecting anomalous behavior of a device
Detecting anomalous behavior of a device, including: generating, using information describing historical activity associated with a user device, a trained model for detecting normal activity for the user device; gathering information describing current activity associated with the user device; and determining, by using the information describing current activity associated with the user device as input to the trained model, whether the user device has deviated from normal activity.
1. A method of detecting anomalous behavior of a device, the method comprising:
generating, using information describing historical activity associated with a device associated with a user, a trained model for detecting normal activity for the device, wherein the trained model is specific to the device;
gathering information describing current activity associated with the device;
determining, by using the information describing current activity associated with the device as input to the trained model, whether the device has deviated from normal activity; and
initiating a remediation workflow after determining that device has deviated from normal activity.
2. The method of claim 1 wherein:
generating a trained model for detecting normal activity for the device further comprises generating the trained model using information describing locations at which the device was utilized; and
gathering information describing current activity associated with the device further comprises gathering information describing a location at which the device is currently being used.
3. The method of claim 1 wherein:
generating a trained model for detecting normal activity for the device further comprises generating the trained model using information describing usage of one or more applications accessed by the device; and
gathering information describing current activity associated with the device further comprises gathering information describing usage of applications accessed by the device.
4. The method of claim 1 wherein:
generating a trained model for detecting normal activity for the device further comprises generating the trained model using information describing times at which activity previously occurred; and
gathering information describing current activity associated with the device further comprises gathering information describing times at which current activity occurred on the device.
5. The method of claim 1 further comprising periodically retraining the trained model.
6. The method of claim 1 further comprising generating an alert after determining that the device has deviated from normal activity.
7. The method of claim 1 , wherein the remediation workflow is configured to prevent abnormal activity by the device.
8. The method of claim 1 , wherein the remediation workflow is configured to enable abnormal activity by the device upon satisfaction of a condition.
9. The method of claim 1 , wherein the condition comprises a third-party approval or a user authentication.
10. A system for detecting anomalous behavior of a device, the system including at least one processor and memory storing computer program instructions that, when executed, cause the system to carry out the steps of:
generating, using information describing historical activity associated with a device associated with a user, a trained model for detecting normal activity for the device, wherein the trained model is specific to the device;
gathering information describing current activity associated with the device;
determining, by using the information describing current activity associated with the device as input to the trained model, whether the device has deviated from normal activity; and
initiating a remediation workflow after determining that device has deviated from normal activity.
11. The system of claim 10 wherein:
generating a trained model for detecting normal activity for the device further comprises generating the trained model using information describing physical locations at which the device was utilized; and
gathering information describing current activity associated with the device further comprises gathering information describing a location at which the device is currently being used.
12. The system of claim 10 wherein:
generating a trained model for detecting normal activity for the device further comprises generating the trained model using information describing usage of one or more applications accessed by the device; and
gathering information describing current activity associated with the device further comprises gathering information describing usage of applications accessed by the device.
13. The system of claim 10 wherein:
generating a trained model for detecting normal activity for the device further comprises generating the trained model using information describing times at which activity previously occurred; and
gathering information describing current activity associated with the device further comprises gathering information describing times at which current activity occurred on the device.
14. The system of claim 10 further comprising computer program instructions that, when executed, cause the system to carry out the step of periodically retraining the trained model.
15. The system of claim 10 further comprising computer program instructions that, when executed, cause the system to carry out the step of generating an alert after determining that the device has deviated from normal activity.
16. A computer program product for detecting anomalous behavior of a device, the computer program product disposed on a non-transitory computer readable medium, the computer program product including computer program instructions that, when executed, carry out the steps of:
generating, using information describing historical activity associated with a device associated with a user, a trained model for detecting normal activity for the device, wherein the trained model is specific to the device;
gathering information describing current activity associated with the device;
determining, by using the information describing current activity associated with the device as input to the trained model, whether the device has deviated from normal activity; and
initiating a remediation workflow after determining that device has deviated from normal activity.
17. The computer program product of claim 16 wherein:
generating a trained model for detecting normal activity for the device further comprises generating the trained model using information describing locations at which the device was utilized; and
gathering information describing current activity associated with the device further comprises gathering information describing a location at which the device is currently being used.
18. The computer program product of claim 16 wherein:
generating a trained model for detecting normal activity for the device further comprises generating the trained model using information describing usage of one or more applications accessed by the device; and
gathering information describing current activity associated with the device further comprises gathering information describing usage of applications accessed by the device.
19. The computer program product of claim 16 wherein:
generating a trained model for detecting normal activity for the device further comprises generating the trained model using information describing times at which activity previously occurred; and
gathering information describing current activity associated with the device further comprises gathering information describing times at which current activity occurred on the device.
20. The computer program product of claim 16 further comprising computer program instructions that, when executed, carry out the step of periodically retraining the trained model.