Patent ID: 11928243
Assignee: AO KASPERSKY LAB
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 8:
9. A system for detecting hacking activities, the system comprising:
a hardware processor configured to:
categorize a plurality of web pages of a web site providing bank services using a trained semantic model, wherein the categorizing a plurality of web pages based at least on juxtapositioning of particular words contained within the plurality of web pages, and wherein the plurality of web pages is further categorized based on frequency of occurrence of particular words contained within the plurality of web pages, and wherein the semantic model uses at least one resource identifier of a web page as an input and generates a web page category as an output;
identify one or more attributes of an interaction between a user and bank services, wherein the one or more attributes comprise at least one of: a user activity attribute identifying an action to be performed at a time of the interaction with the bank services, a resource identifier attribute identifying the resource used by the user to perform the action, a device identifier attribute identifying a device used by the user to perform the action;
send the device identifier attribute identifying the device to a server associated with the bank services;
analyze the one or more identified attributes by comparing the one or more identified attributes with known attributes of hacking interactions based on a corresponding web page category and a change of a resource identifier attribute within a predetermined time interval of the interaction between the user and the bank services or a change of a device identifier attribute within the predetermined time interval of the interaction between the user and the bank services;
identify hacking activity based on results of an analysis;
send a notification of the hacking activity occurring on the device used by the user to perform the action to the server associated with the bank services; and
designate the device used by the user to perform the action and on which the hacking activity is identified as an untrusted device.