Granted Patent B2

US 9,959,399 · App. 14/598,420 · Granted May 1, 2018

Inventor: Jiawen Su (Sunnyvale, CA)

Assignee: Citrix Systems, Inc.

G06F21/316G06F21/552G06F21/88H04L63/10H04W12/12

Abstract

Claims (87)

1. An apparatus comprising:

a communication transceiver;

a hardware processor; and

a computer readable medium storing instructions that, when executed by the hardware processor, cause the apparatus to:

store a plurality of usage parameters associated with the apparatus, wherein the plurality of usage parameters includes an app usage parameter, a location parameter, and an in-app use parameter;

store a first signature including a first set of parameter values for the plurality of usage parameters based on a first set of user inputs;

generate a second signature including a second set of parameter values for the plurality of usage parameters based on a second set of user inputs;

compare the second signature with the first signature to determine a signature difference value representative of a difference between the first signature and the second signature;

compute an average signature difference value over a plurality of past signature difference values associated with usage of the apparatus;

generate a confidence score for the second signature based at least on a ratio of the signature difference value to the average signature difference value;

if the confidence score is greater than a preset maximum score threshold,

identify the second set of user inputs as being fraudulent; and

in response to determining that the communication transceiver is in an inactive state, activate the communication transceiver without alerting a user of the apparatus and establish a communication link with a remote server; and

if the confidence score is less than or equal to the preset maximum score threshold, identify the second set of user inputs as being not fraudulent and update the average signature difference value based on the signature difference value.

2. The apparatus of claim 1 , wherein the computer readable medium stores instructions that, when executed by the hardware processor, further cause the apparatus to:

if the confidence score is greater than the preset maximum score threshold, prevent access to one or more functions of the apparatus by the user;

receive, from a remote computing device, an acknowledgement indicating that the user is an authorized user of the apparatus; and

in response to the receiving, permit access to the one or more functions of the apparatus by the user.

3. The apparatus of claim 1 , wherein the computer readable medium stores instructions that, when executed by the hardware processor, further cause the apparatus to:

if the confidence score is less than or equal to the preset maximum score threshold, update the first signature based on the second signature.

4. The apparatus of claim 3 , wherein the computer readable medium stores instructions that, when executed by the hardware processor, further cause the apparatus to:

generate a third signature including a third set of parameter values for the plurality of usage parameters based on a third set of user inputs;

compare the third signature with the updated first signature;

generate a different signature difference value based on the comparing of the third signature with the updated first signature;

generate a different confidence score for the third signature based on a ratio of the different signature difference value to the updated average signature difference value;

in response to a determination that the different confidence score is greater than the preset maximum score threshold, identify the third set of user inputs as being fraudulent; and

in response to a determination that the different confidence score is less than or equal to the preset maximum score threshold,

update the updated first signature based on the third signature; and

update the updated average signature difference value based on the different signature difference value.

5. The apparatus of claim 1 , wherein the computer readable medium stores instructions that, when executed by the hardware processor, further cause the apparatus to:

generate a first set of signatures for the plurality of usage parameters; and

appending each signature of the first set of signatures to generate the second signature.

6. The apparatus of claim 1 ,

wherein the app usage parameter is a parameter for a number to times each app installed at the apparatus is opened or accessed by a user or an application;

wherein the location parameter is a parameter for a distance between a current geographic location of the apparatus and a previous geographic location of the apparatus; and

wherein the in-app use parameter is a parameter for a number of emails opened or accessed by the user.

7. An apparatus comprising:

a communication transceiver;

a hardware processor; and

a computer readable medium storing instructions that, when executed by the hardware processor, cause the apparatus to:

generate a first signature representative of a historical usage pattern of the apparatus by an authorized user based on a first set of parameter values;

receive, via one or more input interfaces, one or more inputs from a user;

generate a second set of parameters values based at least in part on the one or more inputs of the user;

generate a second signature representative of a usage pattern of the apparatus by the user based on the second set of parameter values, wherein a plurality of parameters is associated with the first set of parameter values and the second set of parameter values;

determine a signature difference value representative of a difference between the first signature and the second signature;

compute an average signature difference value over a plurality of past signature difference values associated with usage of the apparatus;

generate a confidence score for the second signature based at least on a ratio of the signature difference value to the average signature difference value;

if the confidence score is greater than a preset maximum score threshold,

identify the user as being an unauthorized user; and

in response to determining that the communication transceiver is in an inactive state, activate the communication transceiver without alerting the user of the apparatus and establish a communication link with a remote server; and

if the confidence score is less than or equal to the preset maximum score threshold, identify the user as the authorized user and update the average signature difference value based on the signature difference value.

8. The apparatus of claim 7 , wherein the computer readable medium stores instructions that, when executed by the hardware processor, further cause the apparatus to:

if the user is the unauthorized user, prevent access to one or more functions of the apparatus by the user.

9. The apparatus of claim 7 , wherein the computer readable medium stores instructions that, when executed by the hardware processor, further cause the apparatus to:

if the user is the authorized user, update the first signature based on the second signature using an exponentially weighted moving average.

10. The apparatus of claim 7 , wherein the signature difference value is a Euclidean distance between the first signature and the second signature, and wherein the average signature difference value is an average Euclidean distance.

11. The apparatus of claim 7 , wherein the computer readable medium stores instructions that, when executed by the hardware processor, further cause the apparatus to:

determine a plurality of signatures, wherein each signature is based on a parameter of the plurality of parameters; and

append the plurality of signatures to generate the second signature.

12. The apparatus of claim 7 , wherein the computer readable medium stores instructions that, when executed by the hardware processor, further cause the apparatus to:

determine whether to generate the second signature based on whether a preset time period has elapsed since a previous signature was generated.

13. The apparatus of claim 7 , wherein the first signature is a first vector and the second signature is a second vector.

14. The apparatus of claim 7 , wherein at least one parameter, of the plurality of parameters, is a parameter for one of: a number of times an app installed at the apparatus is opened by the user or a distance between a geographic location and a previous geographic location of the apparatus.

15. An apparatus comprising:

a communication transceiver;

a hardware processor; and

a computer readable medium storing instructions that, when executed by the hardware processor, cause the apparatus to:

receive, via one or more input interfaces, one or more user inputs from a user;

determine a set of parameter values for each usage parameter of a plurality of usage parameters associated with the apparatus based on the one or more user inputs;

generate a vector for each usage parameter based on the corresponding set of parameters values;

append the vectors to form an overall vector representative of the one or more user inputs;

generate a signature difference value based at least on a comparison of the overall vector with a historical vector associated with usage of the apparatus by an authorized user;

compute an average signature difference value over a plurality of past signature difference values associated with usage of the apparatus;

generate a confidence score based on a ratio of the signature difference value and the average signature difference value;

if the confidence score is greater than a preset maximum score threshold,

determine that the user is an unauthorized user; and

in response to determining that the communication transceiver is in an inactive state, activate the communication transceiver without alerting the user of the apparatus and establish a communication link with a remote server; and

if the confidence score is less than or equal to the preset maximum score threshold, determine that the user is the authorized user.

16. The apparatus of claim 15 , wherein the computer readable medium stores instructions that, when executed by the hardware processor, further cause the apparatus to:

update the historical vector based on the overall vector.

17. The apparatus of claim 15 , wherein the plurality of usage parameters includes an app usage parameter, a location parameter, and an in-app use parameter.

18. The apparatus of claim 17 ,

wherein the app usage parameter is a parameter for a number to times each app installed at the apparatus is opened or accessed by the user or an application;

wherein the location parameter is a parameter for a distance between a current geographic location of the apparatus and a previous geographic location of the apparatus; and

wherein the in-app use parameter is a parameter for a number of emails opened or accessed by the user.

19. The apparatus of claim 15 , wherein the computer readable medium stores instructions that, when executed by the hardware processor, further cause the apparatus to:

determine whether to generate the vector based on whether a preset time period has elapsed since a previous vector was generated.

Assignments (9)

Continuity (1)