Systems and methods for detecting and scoring anomalies

1. A computer-implemented method for analyzing a digital interaction, the method comprising acts of:

determining, by at least one processor, whether the digital interaction is suspicious, wherein the act of determining whether the digital interaction is suspicious comprises an act of matching the digital interaction to a profile comprising at least one anomalous attribute, and wherein the act of matching the digital interaction to the profile comprises acts of:

determining, from the digital interaction, a value of the at least one anomalous attribute;

determining, based on information stored in the profile, whether the value of the at least one anomalous attribute exhibits an anomaly; and

in response to determining that the value of the at least one anomalous attribute exhibits an anomaly, calculating a penalty score for the digital interaction, wherein the penalty score is calculated based at least in part on a count of anomalous attributes for which values determined from the digital interaction exhibit anomalies;

in response to determining that the digital interaction is suspicious, deploying a security probe of a first type to collect first data from the digital interaction;

analyzing first data collected from the digital interaction by the security probe of the first type to determine if the digital interaction continues to appear suspicious; and

in response to analyzing the first data collected from the digital interaction:

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction continues to appear suspicious, deploying a security probe of a second type to collect second data from the digital interaction; and

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction no longer appears suspicious, deploying a security probe of a third type to collect third data from the digital interaction.

2. The method of claim 1 , wherein the digital interaction is determined to be suspicious if the penalty score exceeds a selected threshold.

3. The method of claim 1 , wherein the security probe of a first type comprises at least one JavaScript statement, and wherein the act of analyzing the first data collected from the digital interaction by the security probe of the first type comprises:

analyzing an execution result of the at least one JavaScript statement, the execution result being received from a computing device carrying out the digital interaction, to determine if the execution result is consistent with a user agent type reported in the digital interaction.

4. The method of claim 3 , wherein:

the at least one JavaScript statement comprises at least one first JavaScript statement;

the security probe of a second type comprises at least one second JavaScript statement to be executed by the computing device carrying out the digital interaction; and

the method further comprises an act of analyzing second data collected from the digital interaction by the security probe of the second type to determine if a JavaScript engine is running on the computing device.

5. The method of claim 3 , wherein the security probe of a third type comprises at least one instruction to manipulate a GUI field, and the method further comprises acts of:

receiving third data collected from the digital interaction by the security probe of the third type, the third data comprising at least one pointer event; and

determining whether the at least one pointer event is consistent with the at least one instruction to manipulate a GUI field.

6. The method of claim 1 , further comprising acts of:

using a sensor to monitor a plurality of digital interactions;

determining, based on an output of the sensor, whether the at least one attribute is anomalous; and

in response to determining that the at least one attribute is anomalous, including the at least one attribute in the profile.

7. The method of claim 6 , wherein determining whether the value of the at least one attribute determined from the digital interaction exhibits an anomaly comprises determining whether the value of the at least one attribute determined from the digital interaction exceeds a selected threshold.

8. The method of claim 7 , wherein the selected threshold is determined based on the output of the sensor.

9. A system for analyzing a digital interaction, the system comprising:

at least one computer-readable storage device having stored thereon executable instructions; and

at least one processor programmed by the executable instructions to perform a method comprising acts of:

determining whether the digital interaction is suspicious, wherein the act of determining whether the digital interaction is suspicious comprises an act of matching the digital interaction to a profile comprising at least one anomalous attribute, and wherein the act of matching the digital interaction to the profile comprises acts of:

determining, from the digital interaction, a value of the at least one anomalous attribute;

determining, based on information stored in the profile, whether the value of the at least one anomalous attribute exhibits an anomaly; and

in response to determining that the value of the at least one anomalous attribute exhibits an anomaly, calculating a penalty score for the digital interaction, wherein the penalty score is calculated based at least in part on a count of anomalous attributes for which values determined from the digital interaction exhibit anomalies;

in response to determining that the digital interaction is suspicious, deploying a security probe of a first type to collect first data from the digital interaction;

analyzing first data collected from the digital interaction by the security probe of the first type to determine if the digital interaction continues to appear suspicious; and

in response to analyzing the first data collected from the digital interaction:

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction continues to appear suspicious, deploying a security probe of a second type to collect second data from the digital interaction; and

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction no longer appears suspicious, deploying a security probe of a third type to collect third data from the digital interaction.

10. The system of claim 9 , wherein the digital interaction is determined to be suspicious if the penalty score exceeds a selected threshold.

11. The system of claim 9 , wherein the security probe of a first type comprises at least one JavaScript statement, and wherein the act of analyzing the first data collected from the digital interaction by the security probe of the first type comprises:

analyzing an execution result of the at least one JavaScript statement, the execution result being received from a computing device carrying out the digital interaction, to determine if the execution result is consistent with a user agent type reported in the digital interaction.

12. The system of claim 11 , wherein:

the at least one JavaScript statement comprises at least one first JavaScript statement;

the security probe of a second type comprises at least one second JavaScript statement to be executed by the computing device carrying out the digital interaction; and

the method further comprises an act of analyzing second data collected from the digital interaction by the security probe of the second type to determine if a JavaScript engine is running on the computing device.

13. The system of claim 11 , wherein the security probe of a third type comprises at least one instruction to manipulate a GUI field, and wherein the method further comprises acts of:

receiving third data collected from the digital interaction by the security probe of the third type, the third data comprising at least one pointer event; and

determining whether the at least one pointer event is consistent with the at least one instruction to manipulate a GUI field.

14. The system of claim 9 , wherein the method further comprises acts of:

using a sensor to monitor a plurality of digital interactions;

determining, based on an output of the sensor, whether the at least one attribute is anomalous; and

in response to determining that the at least one attribute is anomalous, including the at least one attribute in the profile.

15. The system of claim 14 , wherein determining whether the value of the at least one attribute determined from the digital interaction exhibits an anomaly comprises determining whether the value of the at least one attribute determined from the digital interaction exceeds a selected threshold.

16. The system of claim 15 , wherein the selected threshold is determined based on the output of the sensor.

17. A computer-implemented method for analyzing a digital interaction, the method comprising acts of:

determining, by at least one processor, whether the digital interaction is suspicious;

in response to determining that the digital interaction is suspicious, deploying a security probe of a first type to collect first data from the digital interaction;

analyzing first data collected from the digital interaction by the security probe of the first type to determine if the digital interaction continues to appear suspicious, wherein the security probe of a first type comprises at least one JavaScript statement, and wherein the act of analyzing the first data collected from the digital interaction by the security probe of the first type comprises analyzing an execution result of the at least one JavaScript statement, the execution result being received from a computing device carrying out the digital interaction, to determine if the execution result is consistent with a user agent type reported in the digital interaction; and

in response to analyzing the first data collected from the digital interaction:

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction continues to appear suspicious, deploying a security probe of a second type to collect second data from the digital interaction; and

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction no longer appears suspicious, deploying a security probe of a third type to collect third data from the digital interaction.

18. The method of claim 17 , wherein:

the at least one JavaScript statement comprises at least one first JavaScript statement;

the security probe of a second type comprises at least one second JavaScript statement to be executed by the computing device carrying out the digital interaction; and

the method further comprises an act of analyzing second data collected from the digital interaction by the security probe of the second type to determine if a JavaScript engine is running on the computing device.

19. The method of claim 17 , wherein the security probe of a third type comprises at least one instruction to manipulate a GUI field, and wherein the method further comprises acts of:

receiving third data collected from the digital interaction by the security probe of the third type, the third data comprising at least one pointer event; and

determining whether the at least one pointer event is consistent with the at least one instruction to manipulate a GUI field.

20. A system for analyzing a digital interaction, the system comprising:

at least one computer-readable storage device having stored thereon executable instructions; and

at least one processor programmed by the executable instructions to perform a method comprising acts of:

determining, by the at least one processor, whether the digital interaction is suspicious;

in response to determining that the digital interaction is suspicious, deploying a security probe of a first type to collect first data from the digital interaction;

analyzing first data collected from the digital interaction by the security probe of the first type to determine if the digital interaction continues to appear suspicious, wherein the security probe of a first type comprises at least one JavaScript statement, and wherein the act of analyzing the first data collected from the digital interaction by the security probe of the first type comprises analyzing an execution result of the at least one JavaScript statement, the execution result being received from a computing device carrying out the digital interaction, to determine if the execution result is consistent with a user agent type reported in the digital interaction; and

in response to the analyzing of the first data collected from the digital interaction:

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction continues to appear suspicious, deploying a security probe of a second type to collect second data from the digital interaction; and

if the first data collected from the digital interaction by the security probe of the first type indicates that the digital interaction no longer appears suspicious, deploying a security probe of a third type to collect third data from the digital interaction.

21. The system of claim 20 , wherein:

the at least one JavaScript statement comprises at least one first JavaScript statement;

the security probe of a second type comprises at least one second JavaScript statement to be executed by the computing device carrying out the digital interaction; and

the method further comprises an act of analyzing second data collected from the digital interaction by the security probe of the second type to determine if a JavaScript engine is running on the computing device.

22. The system of claim 20 , wherein the security probe of a third type comprises at least one instruction to manipulate a GUI field, and wherein the method further comprises acts of:

receiving third data collected from the digital interaction by the security probe of the third type, the third data comprising at least one pointer event; and

determining whether the at least one pointer event is consistent with the at least one instruction to manipulate a GUI field.