Systems and methods for detecting device location and usage
Systems and methods for detecting misuse of devices comprising: receiving, from a device, a message comprising a first hash of device data that is indicative of a current device location and usage; generating a second hash of stored data, the stored data being based on an expected location and usage associated with the device; comparing the first and second hashes; and when the first and second hashes do not match, generating an alert.
1. A system comprising:
a memory storing executable instructions; and
a processor in communication with the memory, wherein the processor when executing the executable instructions:
receives, from a device, a message comprising a first hash of device data that is indicative of a current timestamp and at least one of a current device location or a current device usage;
generates a second hash of stored data, the stored data being based on at least one of an expected location or an expected usage associated with the device;
compares the first and second hashes;
when the first and second hashes do not match, registers a mismatch;
determines a total number of mismatches for the device within a time period by:
retrieving, for at least one previous message received from the device, a previous timestamp; and
calculating, based on the current timestamp and the previous timestamp, the total number of mismatches for the device within the time period; and
when the total number of mismatches for the device is greater than a predetermined number, generates an alert.
2. The system of claim 1 , wherein the processor, when executing the executable instructions:
applies one or more filter rules that determine when the alert is generated.
3. The system of claim 1 , wherein the first hash of device data further comprises a unique identifier of the device, and the processor, when executing the executable instructions:
based on the unique identifier, determines an entity with which the device is associated.
4. The system of claim 1 , wherein the processor, when executing the executable instructions:
when the total number of mismatches for the device is less than the predetermined number, stores the message and an indication of the mismatch in a record associated with the device.
5. The system of claim 4 , wherein the processor, when executing the executable instructions:
receives, from the device, a subsequent message comprising a third hash of device data that is indicative of at least one of a current device location or a current device usage;
generates a fourth hash of stored data, the stored data being based on at least one of the expected location or the expected usage associated with the device;
compares the third and fourth hashes;
when the third and fourth hashes do not match, registers a subsequent mismatch;
based on the subsequent mismatch, determines the total number of mismatches for the device within the time period; and
when the total number of mismatches for the device is greater than the predetermined number, generates an alert.
6. A method comprising:
receiving, by a processor, from a device, a message comprising a first hash of device data that is indicative of a current timestamp and at least one of a current device location or a current device usage;
generating, by the processor, a second hash of stored data, the stored data being based on at least one of an expected location or an expected usage associated with the device;
comparing, by the processor, the first and second hashes;
when the first and second hashes do not match, registering, by the processor, a mismatch;
determining, by the processor, a total number of mismatches for the device within a time period by:
retrieving, for at least one previous message received from the device, a previous timestamp; and
calculating, based on the current timestamp and the previous timestamp, the total number of mismatches for the device within the time period; and
when the total number of mismatches for the device is greater than a predetermined number, generating, by the processor, an alert.
7. The method of claim 6 , further comprising:
applying, by the processor, one or more filter rules that determine when the alert is generated.
8. The method of claim 6 , wherein the first hash of device data further comprises a unique identifier of the device, the method further comprising:
based on the unique identifier, determining, by the processor, an entity with which the device is associated.
9. The method of claim 6 , further comprising:
when the total number of mismatches for the device is less than the predetermined number, storing, by the processor, the message and an indication of the mismatch in a record associated with the device.
10. The method of claim 9 , further comprising:
receiving, by the processor, from the device, a subsequent message comprising a third hash of device data that is indicative of at least one of a current device location or a current device usage;
generating, by the processor, a fourth hash of stored data, the stored data being based on at least one of the expected location or the expected usage associated with the device;
comparing, by the processor, the third and fourth hashes;
when the third and fourth hashes do not match, registering, by the processor, a subsequent mismatch;
based on the subsequent mismatch, determining, by the processor, the total number of mismatches for the device within the time period; and
when the total number of mismatches for the device is greater than the predetermined number, generating, by the processor, an alert.