Patent ID: 8990935
Filing Date: 2015-03-24
Classification: G06F,H04L

Abstract:
1. A method performed by data processing apparatus, the method comprising: accessing, by a data processing apparatus, activity data describing: generating, by the data processing apparatus, a first activity sequence signature from the first activity sequence; generating, by the data processing apparatus and for each second activity sequence, a respective second activity sequence signature from the second activity sequence; for each second activity sequence, determining, by the data processing apparatus and from the first activity sequence signature and the second activity sequence signature of the second activity sequence, a similarity measure that is a measure of similarity of the first activity sequence to the second activity sequence; for each second activity sequence having a similarity measure that meets a threshold, determining by the data processing apparatus that a security violation occurred durin the second user session of the second activity sequence; and for each second activity sequence having a similarity measure that does not meet the threshold, determining by the data processing apparatus that a security violation did not occur during the second user session of the second activity sequence; wherein generating each activity sequence signature comprises: