Detecting and preventing malware attacks using simulated analytics and continuous authentication
Aspects of the disclosure relate to detecting and preventing malware attacks using simulated analytics and continuous authentication. An application server may receive device information and processing capabilities information of a client device. Based on the device information and the processing capabilities information, the application server may generate analytical output data indicating, for each transaction executed on the client device, a transaction processing time. The application server may receive transaction information associated with a transaction being executed at the client device. Based on the received transaction information and the analytical output data, the application server may simulate the transaction being executed at the client device and determine expected payload data. The application server may receive an authorization request including actual payload data associated with the transaction being executed at the client device. The application server may compare the expected payload data with the actual payload data and send an authorization response.
1 . A system comprising:
a client device;
an application server; and
an application interface located between the client device and the application server, wherein the application server is configured to:
receive, via the application interface, device information of the client device;
receive, via the application interface, processing capabilities information of the client device, wherein the processing capabilities information of the client device is determined by executing simulated processing of one or more types of transactions at the client device during an enrollment process;
based on the device information and the processing capabilities information, generate analytical output data indicating, for each transaction executed on the client device, a transaction processing time, and transmit the analytical output data for storage in one or more database tables;
receive transaction information associated with a transaction being executed at the client device;
based on the received transaction information and the analytical output data, simulate the transaction being executed at the client device using a virtual representation of the client device;
determine expected payload data based on the simulation, wherein the expected payload data comprises an execution time and a data size;
receive an authorization request, wherein the authorization request includes actual payload data associated with the transaction being executed at the client device, wherein the actual payload data comprises an execution time and a data size;
compare the expected payload data with the actual payload data to determine a relative match amount or a relative match percentage;
compare the relative match amount or the relative match percentage to a match threshold to determine when the expected payload data matches the actual payload data; and
based on the comparison, send an authorization response, wherein when the expected payload data does not match the actual payload data, the authorization response comprises a notification indicating presence of malware.
2 . The system of claim 1 , wherein the analytical output data comprises a graphical visualization representing results of a simulated process.
3 . The system of claim 1 , wherein simulating the transaction being executed at the client device comprising simulating transaction steps of the transaction based on the device information and the processing capabilities information of the client device.
4 . The system of claim 1 , wherein receiving the device information of the client device comprises receiving information related to one or more of: a device type, a vendor name, a model name or number, a firmware version, a product name, a device identifier, or a processor identifier.
5 . The system of claim 1 , wherein sending the authorization response comprises sending a message indicating whether the transaction is approved or denied.
6 . The system of claim 1 , wherein receiving transaction information associated with the transaction being executed at the client device comprises receiving information indicative of a transaction type.
7 . The system of claim 1 , wherein the transaction being executed at the client device comprises a transaction initiated on the client device via a mobile application.
8 . A method comprising: at a computing platform comprising at least one processor, a communication interface, and memory:
receiving, by the at least one processor, via the communication interface, device information of a client device;
receiving, by the at least one processor, via the communication interface, processing capabilities information of the client device, wherein the processing capabilities information of the client device is determined by executing simulated processing of one or more types of transactions at the client device during an enrollment process;
based on the device information and the processing capabilities information, generating, by the at least one processor, analytical output data indicating, for each transaction executed on the client device, a transaction processing time, and transmitting the analytical output data for storage in one or more database tables;
receiving, by the at least one processor, transaction information associated with a transaction being executed at the client device using a virtual representation of the client device;
based on the received transaction information and the analytical output data, simulating, by the at least one processor, the transaction being executed at the client device;
determining, by the at least one processor, expected payload data based on the simulation, wherein the expected payload data comprises an execution time and a data size;
receiving, by the at least one processor, an authorization request, wherein the authorization request includes actual payload data associated with the transaction being executed at the client device, wherein the actual payload data comprises an execution time and a data size;
comparing, by the at least one processor, the expected payload data with the actual payload data to determine a relative match amount or a relative match percentage;
comparing the relative match amount or the relative match percentage to a match threshold to determine when the expected payload data matches the actual payload data; and
based on the comparison, sending, by the at least one processor, an authorization response, wherein when the expected payload data does not match the actual payload data, the authorization response comprises a notification indicating presence of malware.
9 . The method of claim 8 , wherein the analytical output data comprises a graphical visualization representing results of a simulated process.
10 . The method of claim 8 , wherein simulating the transaction being executed at the client device comprising simulating transaction steps of the transaction based on the device information and the processing capabilities information of the client device.
11 . The method of claim 8 , wherein receiving the device information of the client device comprises receiving information related to one or more of: a device type, a vendor name, a model name or number, a firmware version, a product name, a device identifier, or a processor identifier.
12 . The method of claim 8 , wherein sending the authorization response comprises sending a message indicating whether the transaction is approved or denied.
13 . The method of claim 8 , wherein receiving transaction information associated with the transaction being executed at the client device comprises receiving information indicative of a transaction type.
14 . One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:
receive, via the communication interface, device information of a client device;
receive, via the communication interface, processing capabilities information of the client device, wherein the processing capabilities information of the client device is determined by executing simulated processing of one or more types of transactions at the client device during an enrollment process;
based on the device information and the processing capabilities information, generate analytical output data indicating, for each transaction executed on the client device, a transaction processing time, and transmit the analytical output data for storage in one or more database tables;
receive transaction information associated with a transaction being executed at the client device using a virtual representation of the client device;
based on the received transaction information and the analytical output data, simulate the transaction being executed at the client device;
determine expected payload data based on the simulation, wherein the expected payload data comprises an execution time and a data size;
receive an authorization request, wherein the authorization request includes actual payload data associated with the transaction being executed at the client device, wherein the actual payload data comprises an execution time and a data size;
compare the expected payload data with the actual payload data to determine a relative match amount or a relative match percentage;
compare the relative match amount or the relative match percentage to a match threshold to determine when the expected payload data matches the actual payload data; and based on the comparison, send an authorization response, wherein when the expected payload data does not match the actual payload data, the authorization response comprises a notification indicating presence of malware.