Monitoring user authenticity

1. A server system for monitoring user authenticity during user activities in user sessions on at least one application server, the server system comprising:

one or more processors; and

at least one computer readable storage memory comprising program code that, when executed by the one or more processors, causes the one or more processors to:

perform a user-modeling process in which a user model is adapted session-by-session to user activities, wherein the user model includes a plurality of adaptive feature-specific user-behavior models that are associated with features indicative of user behavior; and

perform a user-verification process comprising:

determining a plurality of feature-specific risk-score values, wherein determining each feature-specific risk-score value comprises comparing at least one of the adaptive feature-specific user-behavior models with each respective feature extracted from one or more of the user activities during one of the user sessions on the at least one application server,

determining a total risk-score value indicative of user non-authenticity by:

a) weighting and combining the feature-specific risk-score values, wherein the feature-specific risk-score values are combined by a multi-criteria decision analysis technique, and

b) weighting and combining pre-combined risk-score values, wherein the pre-combined risk-score values are determined by combining a portion of the feature-specific risk-score values using multi-criteria decision analysis, and

in response to the total risk-score value exceeding a given threshold, performing a corrective action selected from the group consisting of (i) signing out the user, (ii) requesting a two-factor authentication from the user, (iii) locking the user, and (iv) initiating an alert function,

wherein the user model is adapted on a user-model server based on the user activities associated with different applications on the at least one application server, and the adaptive feature-specific user-behavior models are specific for the different applications.

2. The server system of claim 1 wherein the features are selected from the group consisting of client information, office information, and organization information.

3. The server system of claim 1 wherein the user model is replicated from the user-model server to the at least one application server, and the total risk-score value is determined on the at least one application server using the user model.

4. The server system of claim 1 wherein the features are selected from the group consisting of origins of the user activities, time stamps of the user activities, and durations of the user sessions in which the user activities are performed.

5. The server system of claim 1 wherein the features are time stamps of the user activities, a feature-specific behavior model is associated with the time stamps of the user activities and comprises a Gaussian-mixture model of the time stamps of the user activities, and the feature-specific risk-score value associated with the time stamps of the user activities is calculated based on a complement of probabilities from the Gaussian-mixture model.

6. The server system of claim 1 wherein the features are the durations of the user sessions, a feature-specific behavior model is associated with the durations of the user sessions, and the feature-specific behavior-model maps the durations of the user sessions to (i) a moving average, (ii) a median, (iii) a standard-deviation, or (iv) a quantile.

7. The server system of claim 1 wherein the features comprise a sequence of actions performed by the user, a feature-specific behavior model is associated with the actions and is a Markov chain model, and the feature-specific risk-score value associated with the sequence of actions performed by the user is calculated by determining a complement of the Markov-probability of the sequence extracted from the actions.

8. The server system of claim 1 wherein the feature-specific risk-score values are combined by weighting the score values according to their relative fraud probability.

9. The server system of claim 1 wherein the multi-criteria decision analysis technique is based on a weighted ordered-weighted-average, an ordered-weighted average, or a fuzzy integral of the feature-specific risk-score values.

10. The server system of claim 1 wherein the corrective action is performed in response to a certain feature pattern being detected and regardless of the total risk-score value.

11. A method of monitoring user authenticity during user activities in user sessions on at least one application server, the method comprising:

performing a user-modeling process in which a user model is adapted session-by-session to user activities, wherein the user model includes a plurality of adaptive feature-specific user-behavior models that are associated with features indicative of user behavior; and

perform, by one or more processors of the at least one application server, a user-verification process comprising:

determining a plurality of feature-specific risk-score values, wherein determining each feature-specific risk-score value comprises comparing at least one of the adaptive feature-specific user-behavior models with a respective feature extracted from one or more of the user activities in one of the user sessions on the at least one application server,

determining a total risk-score value indicative of user non-authenticity by:

a) weighting and combining the feature-specific risk-score values, wherein the feature-specific risk-score values are combined by a multi-criteria decision analysis technique, and

b) weighting and combining pre-combined risk-score values, wherein the pre-combined risk-score values are determined by combining a portion of the feature-specific risk-score values using multi-criteria decision analysis, and

in response to the total risk-score value exceeding a given threshold, performing a corrective action selected from the group consisting of (i) signing out the user, (ii) requesting a two-factor authentication from the user, (iii) locking the user, and (iv) initiating an alert function,

wherein the user model is adapted on a user-model server based on the user activities associated with different applications on the at least one application server, and the adaptive feature-specific user-behavior models are specific for the different applications.

12. The method of claim 11 wherein the features are selected from the group consisting of client information, office information, and organization information.

13. The method of claim 11 wherein the user model is replicated from the user-model server to the at least one application server, and the total risk-score value is determined on the at least one application server using the user model.

14. The method of claim 11 wherein the features are selected from the group consisting of origins of the user activities, time stamps of the user activities, and durations of the user sessions in which the user activities are performed.

15. The method of claim 11 wherein the features are time stamps of the user activities, a feature-specific behavior model is associated with the time stamps of the user activities and comprises a Gaussian-mixture model of the time stamps of the user activities, and the feature-specific risk-score value associated with the time stamps of the user activities is calculated based on a complement of probabilities from the Gaussian-mixture model.

16. The method of claim 11 wherein the features are the durations of the user sessions, a feature-specific behavior model is associated with the durations of the user sessions, and the feature-specific behavior-model maps the durations of the user sessions to at least one of (i) a moving average, (ii) a median, (iii) a standard-deviation, or (iv) a quantile.

17. The method of claim 11 wherein the features comprise a sequence of actions performed by the user, a feature-specific behavior model is associated with the actions and is a Markov chain model, and the feature-specific risk-score value associated with the sequence of actions performed by the user is calculated by determining a complement of the Markov-probability of the sequence extracted from the actions.

18. The method of claim 11 wherein the feature-specific risk-score values are combined by weighting the score values according to their relative fraud probability.

19. The method of claim 11 wherein the multi-criteria decision analysis technique is based on a weighted ordered-weighted-average, an ordered-weighted average, or a fuzzy integral of the feature-specific risk-score values.

20. The method of claim 11 wherein the corrective action is performed in response to a certain feature pattern being detected and regardless of the total risk-score value.

21. A computer program product for monitoring user authenticity during user activities in user sessions on at least one application server, the computer program product comprising:

a non-transitory computer readable storage medium; and

program code on the non-transitory computer readable storage medium, the program code, when executed by one or more processors, causes the one or more processors to:

perform a user-modeling process in which a user model is adapted session-by-session to user activities, wherein the user model includes a plurality of adaptive feature-specific user-behavior models that are associated with features indicative of user behavior; and

perform a user-verification process comprising:

determining a plurality of feature-specific risk-score values, wherein determining each feature-specific risk-score value comprises comparing at least one of the adaptive feature-specific user-behavior models with a respective feature extracted from one or more of the user activities in one of the user sessions on the at least one application server,

determining a total risk-score value indicative of user non-authenticity by:

a) weighting and combining the feature-specific risk-score values, wherein the feature-specific risk-score values are combined by a multi-criteria decision analysis technique, and

b) weighting and combining pre-combined risk-score values, wherein the pre-combined risk-score values are determined by combining a portion of the feature-specific risk-score values using multi-criteria decision analysis, and

in response to the total risk-score value exceeding a given threshold, performing a corrective action selected from the group consisting of (i) signing out the user, (ii) requesting a two-factor authentication from the user, (iii) locking the user, and (iv) initiating an alert function,

wherein the user model is adapted on a user-model server based on the user activities associated with different applications on the at least one application server, and the adaptive feature-specific user-behavior models are specific for the different applications.