Systems and methods for detecting user activities to identify deceptive activity

A computer-implemented method to determine whether user interaction activities are indicative of deceptive actions is described. Performance of at least one user interaction activity on a computing device is detected. The performance of the at least one user interaction activity is logged. A determination is made as to whether the logged user interaction activity matches a signature. A notification message is generated based on the determination that the logged user interaction activity matches the signature.

BACKGROUND

The use of computer systems and computer-related technologies continues to increase at a rapid pace. This increased use of computer systems has influenced the advances made to computer-related technologies. Indeed, computer systems have increasingly become an integral part of the business world and the activities of individual consumers. Computer systems may be used to carry out several business, industry, and academic endeavors. The wide-spread use of computers has been accelerated by the increased use of computer networks, including the Internet.

Many businesses use one or more computer networks to communicate and share data between the various computers connected to the networks. The productivity and efficiency of employees often require human and computer interaction. Users of computer technologies continue to demand an increase in the efficiency of these technologies. Improving the efficiency of computer technologies is desirable to anyone who uses and relies on computers.

Computing systems may be targets of attacks. For example, attackers may attempt to gain remote control of a computing system to extract sensitive information and data from the computing system. In some cases, a user of a computer system may unknowingly be the victim of such an attack. Attackers may impersonate a legitimate entity and trick the user into performing certain actions on the computing system. These actions may result in the user unknowingly granting the attackers access to the computing system. Once in control, the attackers may harvest sensitive information stored on the computing system, infect the system with malware, and the like. The sensitive information may include financial data, passwords, identification information, etc. As a result, the user's financial and personal information may be compromised. In addition, the user's computing device may be rendered infected and unable to perform.

SUMMARY

According to at least one embodiment, a computer-implemented method to determine whether user interaction activities are indicative of deceptive actions is described. Performance of at least one user interaction activity on a computing device may be detected. The performance of the at least one user interaction activity may be logged. A determination is made as to whether the logged user interaction activity matches a signature. A notification message may be generated based on the determination that the logged user interaction activity matches the signature.

In one embodiment, the determination as to whether the logged user interaction activity matches the signature may be initialized when an end point is detected. The end point may be a file download, initialization of a remote access session, or accessing a website requesting sensitive data. The user interaction activity may include an interaction between a user and the computing device.

In one configuration, the notification message may include a query to a user as to whether the user is currently engaged in a telephone call. A log that includes a past history of user interaction activities on the computing device may be analyzed to determine a frequency of occurrence of each user interaction activity. A score may be assigned to the detected at least one user interaction activity. The score may be based on the frequency of occurrence in the past of the at least one user interaction activity. The signature may include a sequence of at least one user interaction activity. In one configuration, the performance of an end point may be prevented until a determination is made as to whether the logged at least one user interaction activity matches the signature.

A computing device configured to determine whether user interaction activities are indicative of deceptive actions is also described. The computing device may include a processor and memory in electronic communication with the processor. The computing device may further include a deception identification module stored in the memory. The module may be configured to detect performance of at least one user interaction activity on a computing device, and log the performance of the at least one user interaction activity. The module may be further configured to determine whether the logged user interaction activity matches a signature, and generate a notification message based on the determination that the logged user interaction activity matches the signature.

A computer-program product to determine whether user interaction activities are indicative of deceptive actions is also described. The computer-program product may include a non-transitory computer-readable medium having instructions thereon. The instructions may include code programmed to detect performance of at least one user interaction activity on a computing device, and code programmed to log the performance of the at least one user interaction activity. The instructions may further include code programmed to determine whether the logged user interaction activity matches a signature, and code programmed to generate a notification message based on the determination that the logged user interaction activity matches the signature.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

Anti-virus software may be used to prevent, detect, and remove malware, including, but not limited to, computer viruses, computer worms, Trojan horses, spyware, and adware. In some cases, however, a user may be a victim of an anti-virus scam. An anti-virus scam may include the user being contacted by a person that is impersonating a technical support person. The user may be contacted via phone, email, instant message, etc. The impersonator may inform the user that the user's computer may be infected with a virus, worm, and the like. Then, the impersonator may direct the user to a particular place on the user's computer that may display error messages or warnings. The displayed error messages or warnings, unbeknownst to the user, may be perfectly normal on a computer. The impersonator, however, may use the existence of these error messages or warnings as proof that the user's machine is infected.

In one example, the user may then give the impersonator remote access to his/her computer believing the impersonator will fix the problem. The impersonator may then actually infect the user's machine with spyware, viruses, etc. The impersonator may also gain access to sensitive information (e.g., bank account numbers, usernames, passwords, and the like). In addition, the impersonator may direct the user to a website that requests payment information from the user, such as a credit card number. This website may be under the control of the impersonator and once the credit card information is entered, the impersonator may gain access to the credit card information and cause financial damage to the user. Further, the user may be instructed by the impersonator to download a file to correct the displayed error messages or warnings. This file, however, may include a virus, spyware, a Trojan horse, etc. As a result, the user becomes the victim of an anti-virus scam. The present systems and methods may detect actions of the user to discern whether the user may be currently or potentially the victim of an anti-virus scam.

FIG. 1is a block diagram100illustrating one embodiment of an environment in which the present systems and methods may be implemented. In one example, a client device102may communicate with a server106across a network112connection. The client device102may be a personal computer (PC), a laptop, a notebook, a tablet, a smartphone, or any other type of computing device. The client device102and the server106may each communicate with a database110-a-1and110-a-2, respectively.

In one example, the database110-a-2in communication with the server106may store at least one signature. A signature may include a set of steps that a user may be asked to perform by someone wishing to deceive him/her. For example, a signature may include a set of user inaction activities that an impersonator may ask the user to perform during an anti-virus scam.

The server106may include a signature creation module108. The module108may create signatures representing a set of activities the user has previously taken on the client device102. The created signatures may be stored in the database110-a-2.

In one configuration, the database110-a-1in communication with the client device102may store signatures received from the server106. The client device may include a deception identification module104. The module104may identify user interaction activities performed by the user of the client device102. The module104may compare the identified activities with the signatures stored in the database110-a-1. If the set of activities performed by the user match a stored signature, the deception identification module104may generate an alert to the user indicating the possibility that he/she is being deceived. Details regarding the deception identification module104will be described below.

FIG. 2is a block diagram illustrating one embodiment of a deception identification module104-a. The module104-amay be an example of the module104ofFIG. 1. In one configuration, the deception identification module104-amay include a detection module202, a comparison module204, and an alert generation module206. In one example, the detection module202may monitor the client device102to detect activities performed by the user. These activities may include, but are not limited to, selecting the “start” menu if the client device102is running a Windows® operating system, selecting the “run” command from the start menu, selecting a particular application to execute, etc. The detection module202may also detect when other activities may occur, such as, but not limited to, the downloading of a file, the initialization of a remote access session, the accessing of a particular website that requests payment information, and the like.

In one configuration, the comparison module204may compare the sequence of user interaction activities that have been detected by the detection module202against signatures stored in the database110-a-1. As described above, the signatures may be received from the server106. Each signature may represent a series of user interaction activities in a particular sequence. The alert generation module206may generate an alert to the user based on the comparison module204determining that actions detected by the detection module202match a signature.

FIG. 3illustrates one embodiment of a deception identification module104-b. The module104-bmay be an example of the deception identification module104ofFIG. 1or2.

The module104-bmay include a detection module202-a, which may be an example of the detection module202ofFIG. 2. In one configuration, the detection module202-amay include a user interaction detection module302and an end point detection module304. In one embodiment, the user interaction detection module302may monitor the client device102and detect interactions between the user and the device102. The end point detection module304may detect the occurrence of a particular activity. For example, the end point detection module304may detect when a file is being downloaded to the client device102, when a remote access session is granted by the client device102, when a web browser executing on the client device102accesses a certain type of website, such as a website that requests payment information, and the like.

The deception identification module104-bmay further include a user interaction log306. The log306may include a current user interaction log308and a past user interaction log310. The current user interaction log308may be a log of activities performed by the user during a current session at the client device102. These activities may be detected by the detection module202-a. When the current session is terminated, the current user interaction log308may be cleared and emptied. The past user interaction log310may be a log of activities executed by the user during the current session as well as activities performed during past sessions. In other words, the past user interaction log310may be an ongoing history of user interaction steps taken by the user on the client device102.

The deception identification module104-bmay further include a score generation module312. The module312may analyze a particular activity performed by the user and assign a score or weight factor to the activity. The assigned score may represent how unusual or suspicious the particular activity may be. For example, if the user performs an activity that the user has not performed before (using the past user interaction log310), the score generation module312may generate a score that represents the unusualness of the activity.

In one configuration, the deception identification module104-bmay also include a comparison module204and an alert generation module206. The comparison module204may compare the steps included in the current user interaction log308with signatures received from the server106. The comparison module204may be triggered to compare the current log308with the signatures each time the user interaction detection module302detects an activity performed by the user on the client device102. In addition, the comparison may be triggered when the end point detection module304detects the performance of a particular end point (e.g., file download, initialization of a remote session, access of a website requesting payment information, etc.). Further, the comparison may be initialized when the user interaction module302detects a particular activity performed by the user. The alert generation module206may provide an informational alert to the user based on the results of the comparison.

The following provides an example of the deception identification module104-bidentifying the potential deception of the user based on the user's actions on the client device102. In one example, the user may be contacted by a person purporting to be a technical support person for the user's client device102. The user may be contacted through a phone call, an email, a text message, an instant message, and the like. For sake of clarity, the following is an example of the user receiving a phone call. During the call, the alleged technical support person may inform the user that his/her machine may be infected, vulnerable to attack, etc. The person may instruct the user to perform a certain sequence of actions. For example, the user may be instructed to click on the start menu button (if the client device102is using the Windows® operating system). If the user clicks on the start menu, the user interaction detection module302may detect this step and this step may be stored in the current user interaction log308. The score generation module308may access the past user interaction log310to determine how often in the past the user has clicked the start menu. If the user has frequently performed this action in the past, the score generation module308may assign a relatively low score to this detected step indicating that the performance of this step is not that unusual by the user.

The person representing an alleged technical support person may continue to instruct the user to perform other activities. Each performed activity may be detected and logged in the current user interaction log308. A score may also be assigned to each logged activity based on the past user interaction log310. At any time during the detection of these activities (including the detection of an end point), the comparison module204may be triggered to compare the sequence of activities in the current user interaction log308against signatures received from the server106. As explained above, each signature may represent a certain sequence of activities. If the activities in the log308match a signature, the alert generation module206may generate an alert to the user.

In one example, the alert may include a series of questions for the user to answer. For example, the alert may query the user as to whether the user is currently on the phone with a person claiming to be a technical support person. If the user answers in the affirmative, the alert may notify the user that he/she is possibly being deceived. The alert messages may include a certain confidence score based on the scores of the detected activities. For example, if the user performs steps A, B, and C and one or more of these steps are assigned a score that indicates a high level of unusualness, the alert message may indicate to the user that the confidence level that the user is being deceived is high. When the user receives an alert message, the user may choose to terminate the phone call, refuse to perform any future actions, obtain additional information about the person claiming to be a technical support person, etc.

FIG. 4is a block diagram illustrating one example of a user interaction log306-a. The log306-amay be an example of the user interaction log306ofFIG. 3. In one example, the user interaction log306-amay be in communication with a database110-b-1, which may be an example of the database110-a-1ofFIG. 1.

In one configuration, the database110-b-1may store one or more signatures. For example, the database110-b-1may store a first signature428and a second signature430. Each signature428,430may represent a certain sequence of steps or activities a user may perform on the client device102. For example, the first signature420may include step A402, followed by step B404, followed by step C406. The second signature430may include step A402, followed by step D414, followed by step J418. Each of the steps may be user interaction activities. In other words, each of the steps may be actions performed by a user of the client device102. In addition, one or more of the steps may be an end point. For example, referring to the second signature430, steps A and D may be user inaction steps while step J418represents a particular end point, such as a file download, a remote access session, a website requesting payment information, etc.

The user interaction log306-amay include a current user interaction log308-aand a past user interaction log310-a. The current log308-amay include a log of steps performed by the user during a current session at the client device102. For example, the user may have performed step A402, step B404, and step C406during the current session. The past user interaction log310-amay be a log of the steps the user has performed during previous sessions at the client device102. In one embodiment, each step logged in the past user interaction log310-amay include a frequency indicator. For example, step A402may be included in the past log310-abecause the user has previously performed step A402. Linked to step A402may be a step A frequency420. The frequency420may be dynamic and may indicate how often the user has performed step A402in the past. As a result, when the user performs step A402during the current session, step A402may be logged in the current log308-aand the step A frequency420in the past log310-amay be updated.

A score may be linked to the performance of step A402in the current log308-a. The score may indicate how unusual it is that the user is performing step A402during the current session. If the step A frequency420is low, the score408in the current log308-amay represent that it is unusual for the user to perform step A402.

As illustrated, the current log308-amay indicate that the user has performed steps A, B, and C. In the past, the user may have performed steps A, D, G, and J, as indicated by the past user interaction log310-a. As a result, the scores for steps B and C may indicate that it is more unusual for the user to perform steps B and C than step A, because the user has not performed steps B and C in the past.

In one configuration, the sequence of steps in the current log308-amay be compared with the signatures428,430stored in the database110-b-1. In this example, the sequence of steps in the current log308-amay match the first signature428. As a result, an alert may be generated and provided to the user that notifies the user that the user is currently being deceived. For example, step A402may be the step of clicking on the start menu, step B404may be step of selecting “run” from the start menu, and step C406may be the step of entering “EventViewer” in the data field of the “run” command. This sequence of steps may be unusual for a user to perform (as indicated by the score of each step). As a result, the present systems and methods may discern whether the user is possibly being deceived based on a comparison of steps performed by the user to signatures representing steps that indicate known deceitful behavior.

FIG. 5is a block diagram illustrating one example of a server106-a, that may implement the present systems and methods. The server106-amay be an example of the server106ofFIG. 1. In one embodiment, the server106-amay include a signature creation module108-a. The module108-amay include an aggregation module502and an analysis module504.

The aggregation module502may aggregate user interaction activities performed by users on multiple client devices that do not match a previously generated signature. For example, a user on a first client device may perform the steps G, K, and M. These steps may be logged in the current log308of the first client device and compared against signatures received from the server106-a. If the logged steps do not match a signature, the first client device may transmit data representing the performance of these steps to the server106-a. The aggregation module502may aggregate each instance of the performance of steps received from various client devices. The analysis module504may analyze the aggregated data to determine whether a certain number of users are performing similar sequences of steps on their respective client devices. If the analysis module504identifies certain patterns of steps received from various client devices, the signature creation module108-amay create a new signature representing the performance of these steps. This new signature may then be transmitted to the client devices. As a result, when a user next performs the steps G, K, and M, they may match a signature received from the server106-aand an alert message may be generated indicating that the user is possibly being deceived. As threats and attacks are modified, the signatures may also be updated accordingly. For example, if it is determined that performing steps G, K, and O is indicative of deception, the signature may be updated to further include the performance of step O.

FIG. 6is a flow diagram illustrating one embodiment of a method600to discern whether user interaction activities are indicative of deception. The method600may be implemented by the deception identification module104ofFIG. 1,2, or3.

In one example, at block602, the performance of at least one user interaction activity may be detected. At block604, the performance of the at least one user interaction activity may be logged. At block606, a determination may be made as to whether the logged user interaction activity matches a signature. If it is determined that the activity does not match a signature, the method600may return to block602to detect performance of user interaction activities. If, however, it is determined that the logged activity does match a signature, at block608, a notification message may be generated. The message may query the user as to whether the user is currently on the phone with someone claiming to be a technical support person, whether the user is following steps outlined in an email received from an alleged technical support entity, and the like. If the user answers in the affirmative, the message may inform the user that he/she is possibly being deceived.

As described above, one example of a deception may include the user being asked to follow the steps, a) Click on “Start” and then select “Run” b) On the Run field, enter “EventViewer” c) Open a browser and access a website for remote access. Accessing “EventViewer” may display a log of events that have occurred on the user's machine. This log may naturally include several error messages or warnings that are on a computing device. An impersonator, however, may instruct the user to open EventViewer and then use the display of error messages as proof that the user's machine is possibly infected. A user that does not comprehend the purpose of such logs, such as EventViewer, a prefect folder, etc., may view the error messages and believe the person impersonating a technical support person.

The user may be asked to open a web browser to access a malicious website masquerading as a good website to initialize a remote access session. Instead, the website may include a virus, worm, Trojan, etc. If the user follows these steps, the person that contacted the user may then have access to their machine and may steal sensitive information, infect their computer, and the like.

As explained above, the signatures may represent flows of action, such as steps a)-c) described above. In one example, the SetWindowTitle for defined processes may be monitored for these sequences of actions. Once, for example, the first step (e.g., step (a)) begins the actions of the user may be monitored to check to see if the steps in the context are fulfilled within a certain time frame and without a certain amount of deviation.

To detect if an accessed website allows for remote access sessions to initialize, content keywords, title keywords, uniform resource locators (URLs) of websites registered to previous offenders, known good remote login websites, etc. may be stored. Further, if the user provides payment information (such as a credit card number on a website), the transmission of this data may be blocked until the user agrees that the data is to be transmitted. If the establishment of a remote session is attempted, this may be suspended until the current actions of the user may be compared against a signature.

FIG. 7is a flow diagram illustrating one example of a method700to determine whether actions performed by a user indicate the user is being deceived. The method700may be implemented by the detection identification module104ofFIG. 1,2, or3.

At block702, the performance of at least one user interaction activity may be detected. At block704, the performance of the at least one user interaction activity may be logged. At block706, a determination may be made as to whether the logged user interaction activity matches a signature. If it is determined that the activity does not match a signature, the method700may return to detect the performance of user interaction activities. If, however, it is determined that the logged activity matches a signature, at block708, an activity score assigned to the logged user interaction activity may be analyzed. At block710, a determination may be made as to whether the activity score satisfies a threshold. For example, the user may perform a sequence of steps that match a signature, but the user may frequently perform these steps. As a result, the scores assigned to each step may be relatively low indicating that the likelihood of the user being deceived by performing these steps is also relatively low. If it is determined that the score does not satisfy the threshold (likelihood of deceit is low), the method700may return to detect the performance of user interaction activities. If, however, it is determined that the activity score does satisfy a threshold, at block712, a notification message may be generated and presented to the user. The content of the message may vary depending on the activity score assigned to the user interaction activity. For example, if the score indicates a high likelihood of deceit, the message may inform the user that there is a high possibility the user is being deceived.

FIG. 8is a flow diagram illustrating one example of a method800to create a signature representing user interaction steps that may be indicative of deceitful behavior. The method800may be implemented by the server106ofFIG. 1or5.

At block802, data may be received from a first client device relating to the performance of at least one user interaction activity. The activity may have been performed on the first client device. At block804, the data may be aggregated with data received from additional client devices relating to the performance of the at least one user interaction activity. At block806, a determination may be made as to whether the aggregated data satisfy a threshold. If the aggregated data do not satisfy the threshold, the method800may return to receive data from the client devices. If, however, it is determined that the aggregated data do satisfy the threshold, at block808, a signature may be created. The signature may include the step of performing the at least one user interaction activity. At block810, the created signature may be transmitted to at least one client device.

FIG. 9depicts a block diagram of a computer system910suitable for implementing the present systems and methods. Computer system910includes a bus912which interconnects major subsystems of computer system910, such as a central processor914, a system memory917(typically RAM, but which may also include ROM, flash RAM, or the like), an input/output controller918, an external audio device, such as a speaker system920via an audio output interface922, an external device, such as a display screen924via display adapter926, serial ports928and930, a keyboard932(interfaced with a keyboard controller933), multiple USB devices992(interfaced with a USB controller991), a storage interface934, a floppy disk unit937operative to receive a floppy disk938, a host bus adapter (HBA) interface card935A operative to connect with a Fibre Channel network990, a host bus adapter (HBA) interface card935B operative to connect to a SCSI bus939, and an optical disk drive940operative to receive an optical disk942. Also included are a mouse946(or other point-and-click device, coupled to bus912via serial port928), a modem947(coupled to bus912via serial port930), and a network interface948(coupled directly to bus912).

Bus912allows data communication between central processor914and system memory917, which may include read-only memory (ROM) or flash memory (neither shown), and random access memory (RAM) (not shown), as previously noted. The RAM is generally the main memory into which the operating system and application programs are loaded. The ROM or flash memory can contain, among other code, the Basic Input-Output system (BIOS) which controls basic hardware operation such as the interaction with peripheral components or devices. For example, the deception identification module104to implement the present systems and methods may be stored within the system memory917. Applications resident with computer system910are generally stored on and accessed via a non-transitory computer readable medium, such as a hard disk drive (e.g., fixed disk944), an optical drive (e.g., optical drive940), a floppy disk unit937, or other storage medium. Additionally, applications can be in the form of electronic signals modulated in accordance with the application and data communication technology when accessed via network modem947or interface948.

Storage interface934, as with the other storage interfaces of computer system910, can connect to a standard computer readable medium for storage and/or retrieval of information, such as a fixed disk drive944. Fixed disk drive944may be a part of computer system910or may be separate and accessed through other interface systems. Modem947may provide a direct connection to a remote server via a telephone link or to the Internet via an internet service provider (ISP). Network interface948may provide a direct connection to a remote server via a direct network link to the Internet via a POP (point of presence). Network interface948may provide such connection using wireless techniques, including digital cellular telephone connection, Cellular Digital Packet Data (CDPD) connection, digital satellite data connection or the like.

Many other devices or subsystems (not shown) may be connected in a similar manner (e.g., document scanners, digital cameras and so on). Conversely, all of the devices shown inFIG. 9need not be present to practice the present systems and methods. The devices and subsystems can be interconnected in different ways from that shown inFIG. 9. The operation of a computer system such as that shown inFIG. 9is readily known in the art and is not discussed in detail in this application. Code to implement the present disclosure can be stored in a non-transitory computer-readable medium such as one or more of system memory917, fixed disk944, optical disk942, or floppy disk938. The operating system provided on computer system910may be MS-DOS®, MS-WINDOWS®, OS/2®, UNIX®, Linux®, or another known operating system.

FIG. 10is a block diagram depicting a network architecture1000in which client systems1010,1020and1030, as well as storage servers1040A,1040B (any of which can be implemented using computer system1010), are coupled to a network1050. In one embodiment, the deception identification module104may be located within the storage servers1040A,1040B to implement the present systems and methods. The storage server1040A is further depicted as having storage devices1060A(1)-(N) directly attached, and storage server1040B is depicted with storage devices1060B(1)-(N) directly attached. SAN fabric1070supports access to storage devices1080(1)-(N) by storage servers1040A,1040B, and so by client systems1010,1020and1030via network1050. Intelligent storage array1090is also shown as an example of a specific storage device accessible via SAN fabric1070.

With reference to computer system910, modem947, network interface948or some other method can be used to provide connectivity from each of client computer systems1010,1020, and1030to network1050. Client systems1010,1020, and1030are able to access information on storage server1040A or1040B using, for example, a web browser or other client software (not shown). Such a client allows client systems1010,1020, and1030to access data hosted by storage server1040A or1040B or one of storage devices1060A(1)-(N),1060B(1)-(N),1080(1)-(N) or intelligent storage array1090.FIG. 10depicts the use of a network such as the Internet for exchanging data, but the present systems and methods are not limited to the Internet or any particular network-based environment.