Detecting Anomalous Behavior Using A Browser Extension

1 . A method of detecting anomalous behavior using a browser extension, the method comprising:

gathering first information describing activity associated with a user and generated by a browser extension on a user device;

gathering second information describing activity associated with the user and generated by an application executed on the user device; and

determining, based on the first information and the second information, whether the user has deviated from normal activity.

2 . The method of claim 1 wherein determining whether the user has deviated from normal activity is further based on historical information describing historical activity of the user.

3 . The method of claim 2 wherein the historical information is generated at least in party by the browser extension.

4 . The method of claim 3 wherein the historical information is generated at least in party by the application.

5 . The method of claim 1 wherein the first information describes a browser context during user activity.

6 . The method of claim 1 wherein determining whether the user has deviated from normal activity includes correlating portions of the first information with portions of the second information.

7 . The method of claim 1 further comprising generating an alert in response to determining that the user has deviated from normal activity.

8 . The method of claim 1 further comprising directing the user device to an approval workflow via the browser extension in response to determining that the user has deviated from normal activity.

9 . The method of claim 8 wherein the user device is directed to the approval workflow instead of a requested resource.

10 . The method of claim 8 wherein the user device is directed to the approval workflow inline with another resource.

11 . A computer program product for detecting anomalous behavior using a browser extension, the computer program product disposed on a computer readable medium, the computer program product including computer program instructions configurable to carry out the steps of:

gathering first information describing activity associated with a user and generated by a browser extension on a user device;

gathering second information describing activity associated with the user and generated by an application executed on the user device; and

determining, based on the first information and the second information, whether the user has deviated from normal activity.

12 . The computer program product of claim 11 wherein determining whether the user has deviated from normal activity is further based on historical information describing historical activity of the user.

13 . The computer program product of claim 12 wherein the historical information is generated at least in party by the browser extension.

14 . The computer program product of claim 13 wherein the historical information is generated at least in party by the application.

15 . The computer program product of claim 11 wherein the first information describes a browser context during user activity.

16 . The computer program product of claim 11 wherein determining whether the user has deviated from normal activity includes correlating portions of the first information with portions of the second information.

17 . The computer program product of claim 11 wherein the steps further comprise generating an alert in response to determining that the user has deviated from normal activity.

18 . The computer program product of claim 11 wherein the steps further comprise directing the user device to an approval workflow via the browser extension in response to determining that the user has deviated from normal activity.

19 . The computer program product of claim 18 wherein the user device is directed to the approval workflow instead of a requested resource.

20 . The computer program product of claim 18 wherein the user device is directed to the approval workflow inline with another resource.