Patent Description:
The sphere of banking services has significantly expanded in recent years. Bank customers are being offered new ways of interacting with the bank and methods of payment and transfer of funds as users of their IT infrastructure. The multitude of payment systems, credit cards and banking services (the bank services are often called remote banking services) lets the user carry out a variety of transactions using computing devices. Online banking and mobile banking are making it possible to carry out financial operations with the use of credit card or bank account information.

Various mechanisms exist for protecting the funds of the user against being accessed by third parties. When the user is working with online banking, a method such as double authentication is often used. After entering authentication data on the bank site with the use of a browser or in the bank's application on a mobile device (such as a login and password, which may become accessible to third parties), the bank sends a message to the user on his or her mobile telephone, containing for example a supplemental verification code, which needs to be entered in a special field.

However, it should be mentioned that there are many attacks exploiting vulnerabilities in the interaction of the user with banking services, which are carried out by criminals with the goal of obtaining access to the user's funds. Often such attacks are known as fraudulent activity. Thus, for example, the login and password for access to online banking may be obtained with the aid of phishing sites. Malicious software for mobile devices lets the criminals gain access to the supplemental verification codes and carry out transactions with confirmation, unbeknownst to the user.

Systems and methods are known which employ a so-called "fingerprint" of the user's device in order to protect the user against fraud activity. A user generally makes use of the same devices, each device containing a particular suite of software and features (hardware and software data) which are known to the bank. If the software suite is altered on the device, or if the device itself is changed, there is a high probability that fraudulent activity is taking place. When fraudulent activity is carried out on a device, that device is deemed to be dangerous by the remote bank services. Examples of systems and methods for identifying fraudulent activity from a user device are disclosed in <CIT>, <CIT> and <CIT>. <CIT> discloses a list of IP addresses and corresponding device types are available for supervised learning and that this may not be the case for administrators trying to understand what devices are on a poorly documented legacy network. <CIT> describes an illustration of unsupervised learning with Gaussian mixture models (GMM) using a full covariance matrix and a signature vector consisting of means and variances with a time slice of one day was demonstrated. The unsupervised technique can allow administrators to develop an accurate database of fingerprints with little knowledge of the network itself. <CIT> discloses a power fingerprinting system for assessing integrity of a target computer-based system. <CIT> discloses a system configured to detect a threat activity on a network.

However, collisions of device fingerprints may occur. Oftentimes the devices do not provide access to identify their serial numbers or IMEI, and therefore two devices may have the same fingerprints, or fingerprints resembling each other to a degree greater than a threshold value.

Moreover, the matching of a fingerprint may indicate that the device of a legitimate user may be being used by another user, or an attempt is being made to emulate (duplicate) the user's device.

It should also be mentioned that it is not possible to compare the fingerprint of a device from which a user is interacting with an online service to all known fingerprints in a short period of time, due to the significant number of known fingerprints (millions of them).

Therefore, as one optimization possibility, it is necessary to also solve the problem of identifying similar fingerprints (candidates) among all known fingerprints. The present disclosure effectively solves the problem of selecting candidates for comparing of fingerprints of devices when a user is interacting with online services.

The present disclosure describes methods identifying fraudulent activity from a user device using a chain of device fingerprints from the multitude of all known fingerprints of devices.

The technical result of the present disclosure is to realize the stated purpose.

According to one example, method comprises calculating a digital fingerprint of one or more devices belonging to a user accessing an online service, determining a group of digital fingerprints where the digital fingerprint occurs, calculating a plurality of vectors of features for changed features of each digital fingerprint within the determined group, calculating a probability that the digital fingerprint and each digital fingerprint within the determined group belong to a same chain of fingerprints, identifying a set of candidates from the digital fingerprints of the group whose probability of belonging to the same chain of fingerprints crosses a threshold value, comparing the calculated digital fingerprint of the one or more devices with the fingerprints of devices in the set of candidates, determining whether the one or more devices correspond to one of the devices identified in the set of candidates when the comparison results in a match higher than a specified threshold and in response to determining that the one or more devices correspond to one of the devices in the set of candidates, permitting the user actions, otherwise tracking the user interactions with the online service as fraudulent activity.

According to another example, a method is presented in which fingerprints are broken down into groups according to features such that the measure of similarity between any given pair of fingerprints from different groups is equal to zero.

According to one example, a method is presented in which a matrix of joint pairwise probabilities of features is calculated.

According to one example, a method is presented in which the columns and rows corresponding to a vector of altered features are identified from the mentioned matrix of joint pairwise probabilities.

According to one example, a method is presented in which the minimal element in the calculated matrix is identified.

According to one example, wherein common features of a group comprise operating system family and browser family.

According to one example, the method further comprises calculating a probability of change in features during a chain of values of the digital fingerprint of the device ordered in time.

According to one example, another exemplary method comprises: the digital fingerprint of the user's device is calculated with the aid of a collection module, wherein the digital fingerprint contains at least one characteristic of that device, collected at the moment of time when the interaction of the user with the remote services is occurring using that device; with the aid of an analysis module, a group of fingerprints is determined, in which the mentioned fingerprint occurs; with the aid of the analysis module, the vectors are calculated for features which have changed in that fingerprint and all the fingerprints of the group; the analysis module is used to calculate the probability of that fingerprint and each fingerprint of the group belonging to the same chain; the analysis module is used to identify fingerprints of the group whose probability of belonging to the same chain as the mentioned fingerprint is above a threshold value.

According to another example, a system of the present disclosure includes: a hardware processor configured to: calculate a digital fingerprint of one or more devices belonging to a user accessing an online service, determine a group of digital fingerprints where the digital fingerprint occurs, calculate a plurality of vectors of features for changed features of each digital fingerprint within the determined group, calculate a probability that the digital fingerprint and each digital fingerprint within the determined group belong to a same chain of fingerprints, identify a set of candidates from the digital fingerprints of the group whose probability of belonging to the same chain of fingerprints crosses a threshold value, compare the calculated digital fingerprint of the one or more devices with the fingerprints of devices in the set of candidates, determine whether the one or more devices correspond to one of the devices identified in the set of candidates when the comparison results in a match higher than a specified threshold and in response to determining that the one or more devices correspond to one of the devices in the set of candidates, permit the user interactions, otherwise tracking the user interactions with the online service as fraudulent activity.

The above simplified summary of example aspects serves to provide a basic understanding of the present disclosure. This summary is not an extensive overview of all contemplated aspects, and is intended to neither identify key or critical elements of all aspects nor delineate the scope of any or all aspects of the present disclosure. Its sole purpose is to present one or more aspects in a simplified form as a prelude to the more detailed description of the disclosure that follows. To the accomplishment of the foregoing, the one or more aspects of the present disclosure include the features described and exemplarily pointed out in the claims.

Exemplary aspects are described herein in the context of a system, method, and computer program product of selecting candidates for comparison of fingerprints of devices. Those of ordinary skill in the art will realize that the following description is illustrative only and is not intended to be in any way limiting. Other aspects will readily suggest themselves to those skilled in the art having the benefit of this disclosure. Reference will now be made in detail to implementations of the example aspects as illustrated in the accompanying drawings. The same reference indicators will be used to the extent possible throughout the drawings and the following description to refer to the same or like items.

The system of the present disclosure includes actual devices, systems, components, groups of components, realized with the use of hardware such as integrated microcircuits (application-specific integrated circuit, ASIC) or field-programmable gate arrays (FPGA) or, for example, in the form of a combination of software and hardware such as a microprocessor system and a set of program instructions, and also based on neurosynaptic chips. The functionality of the indicated components of the system may be realized exclusively by hardware, and also in the form of a combination, where some of the functionality of the components of the system is realized by software and some by hardware. In certain examples, some of the components or all of the components can be implemented on the processor of a general-purpose computer (such as the one depicted in <FIG>). Each of the components of the system may be realized within a single computing device or spread apart among several interconnected computing devices.

<FIG> is a block diagram of the system <NUM> for selecting candidates to compare the fingerprints of the devices <NUM> of a user. The system <NUM> comprises a collection module <NUM> and an analysis module <NUM>. In one example, the devices <NUM> are used by a user to interact with remote services. The system <NUM> is configured to resolve collisions of digital fingerprints (hereinafter, the term fingerprint is used) of devices <NUM> when a user is interacting with remote services. The remote services are network or online services which are running (functioning) on a remote server (or on a distributed system of servers) or as a cloud service, with which the user interacts using an account. Examples of such services are banking services, email, social networks, and others (hereafter in the text, online services <NUM>).

The device <NUM> in the context of the present disclosure includes a program execution environment running on a computing device. In one example, the program execution environment may be a browser running on a computer, a bank application running on a mobile device, or the like.

The present disclosure solves the problem of searching for similar fingerprints of devices <NUM> from the multitude of all known fingerprints of devices <NUM> to the fingerprint of the device <NUM> by which the user is interacting with the online service <NUM>.

To solve the problem, the probability of a pair of fingerprints belonging to a chain of fingerprints of the same device <NUM> is used as a measure of similarity. The chain of fingerprints of a device <NUM> refers to, in one example, a sequence of values, ordered in time, of fingerprints corresponding to the device <NUM>. In other words, the chain of fingerprints is a chain of evolution of a fingerprint for a given device <NUM>.

In one example, the collection module <NUM> is configured to gather fingerprints of devices <NUM>. In the general case, a fingerprint contains the characteristics of the device <NUM>. The characteristics of the device <NUM> include at least:.

In one example, the digital fingerprints are gathered by executing a script (such as a JavaScript) in the browser of the device <NUM>. The script may be stored on the remote server and transmitted to the device <NUM> when the device <NUM> accesses the online service <NUM>. Thus, the collection module <NUM> is stored on the server (e.g., a bank server), and the collection module <NUM> is executed on the device <NUM> of the user.

In yet another example, the digital fingerprints are gathered by security applications (such as antivirus applications). In this case, the collection module <NUM> is a module of the security application.

In yet another example, the gathering of the mentioned digital fingerprints is done by means of an application running on the device <NUM>, where the application may be designed to access online services <NUM> and is created with the use of a software development kit (SDK), provided for example by the antivirus application developer (such as KASPERSKY and the Mobile Security SDK). In this case, the collection module <NUM> is a module of that application.

In one example, the collection module <NUM> gathers the fingerprints of devices <NUM> at the moments of time when the interaction of the user with the services <NUM> using said device <NUM> is taking place. Thus, the collection module <NUM> also collects information during periods of user interactions on device <NUM> with the services <NUM> during active sessions. In another example, the collection module <NUM> gathers said fingerprints of devices <NUM> at definite moments of time (for example, by a schedule, once a day on weekends, twice a day on work days). In yet another example, the collection module <NUM> gathers the mentioned fingerprints of devices <NUM> at definite intervals of time (such as every <NUM> hours).

In one example, the collection module <NUM> gathers the locations of the sessions of the user's interaction with the online services <NUM> using the devices <NUM>.

The data gathered by the collection module <NUM> about the device <NUM> is sent to the analysis module <NUM>. In one example, said digital fingerprints gathered by the collection module <NUM> about the device <NUM> are kept by the collection module <NUM> in a database <NUM>.

The analysis module <NUM> is executed (functions) on a remote server (or on a distributed system of servers) or as a cloud service.

The analysis module <NUM>, in some examples, identifies fingerprints of devices <NUM> that are similar to the given one using a similarity measure. The given fingerprint is the fingerprint of the device being used for the session with the online service <NUM>. Upon identifying similar fingerprints of the devices <NUM>, the analysis module <NUM> calculates the probability of the fingerprint belonging to the same device <NUM> as the given one. The probability that the fingerprint belongs to device <NUM> is compared to a threshold, and if the threshold is crossed/exceeded, the analysis module <NUM> concludes that the fingerprints are of the same device <NUM>.

Using the above-described measure of similarity, (the probability of a pair of fingerprints belonging to the chain of fingerprints of the same device <NUM>), the threshold for the selection of candidates consists in the following: the threshold is the minimal probability that the fingerprints selected by the analysis module <NUM> may exist in the same chain as the given fingerprint, that is, the fingerprint belongs to the same device <NUM>.

Thus, for a given fingerprint it is necessary to find similar fingerprints and arrange them in order of similarity. When calculating the measure of similarity, the problem arises of comparing the initial fingerprint to each of the fingerprints known at the given moment of time. The complexity of the algorithm for selection of candidates is proportional to the cardinality of the set of fingerprints (the cardinality of a set is a characteristic of incalculable/infinite sets known in the prior art). On the basis of statistical data from the working of the present disclosure, the set of fingerprints is numbered in a substantial amount (around <NUM> million fingerprints of devices <NUM>).

In order to limit the set of fingerprints considered, the analysis module <NUM> breaks up the fingerprints of devices <NUM> into groups by features. In one example, the measure of similarity between any given pair of fingerprints from different groups will be equal to zero. Thus, the selection of fingerprints is limited to the group in which the initial fingerprint occurs.

Generally, the device <NUM> cannot exist under the control of different types of OS and with different types of browsers at the same time, so that the analysis module <NUM> assigns the OS family and the browser family to the features of the groups.

Furthermore, it is not useful to compare a pair of fingerprints when a whole series of features is absent from one of the features being compared. Thus, for example, if a cross platform API for 3D graphics in a browser (WebGL) is not being used on the device <NUM>, the fingerprint for the device <NUM> will lack the set of features related to that API. In another example, the features related to that API may have zero value, but it is not expedient to use them in the calculations. Therefore, in a particular example, the analysis module <NUM> will add additional data to the features of the groups of fingerprints, such as a flag for use of WebGL.

Based on the above, in order to calculate the probability of a pair of fingerprints belonging to the same chain of fingerprints of the same device <NUM>, the analysis module <NUM> must:.

The fingerprint consists of a sizeable number of features (the practical implementation of the present disclosure uses more than <NUM> features) - binary features, category features, and sets (scripts, plug-ins, etc.). For each feature, the analysis module <NUM> can calculate the probability of its change during the evolution of the fingerprint of the device <NUM>. By the evolution of the fingerprint of the device is meant a chain of specific values of the fingerprint of the device <NUM> that is ordered in time. From the chain of fingerprints, possible pairs of fingerprints are extracted and used to calculate the probability.

In order to calculate the exact value of the joint probability, it is necessary to estimate the total joint probability of all changed features and furthermore take into account the probabilities of the change in specific values within each feature, that is, for example, to take into account the probability of a change in the specific screen resolution to a different specific value. The joint probability is the probability that the random events being considered (in the present disclosure, an event is the change in a specific feature of a fingerprint) will occur at the same time. For example, the probability that the browser version has changed and a new font has appeared at the same time. Such an approach significantly complicates the realization of the present disclosure and increases the complexity. Therefore, the analysis module <NUM> estimates the probabilities of change of the features without considering their specific values, that is, it considers the mere fact of the change.

For an exact calculation of the joint probability, it is necessary to calculate the joint probabilities for all possible groups of features, which is computationally impossible given the substantial number of features (as noted above, the practical implementation of the present disclosure uses more than <NUM> features).

Since the number of different observable groups of features in the practical implementation of the present disclosure is on the order of several hundreds of thousands, which is substantially less than the theoretically possible number, in the general example the analysis module <NUM> assesses the probability of a change in a specific group of features by the frequency of its occurrence in the data on the fingerprints as gathered by the collection module <NUM>.

The analysis module <NUM> assesses the upper limit of the joint probability of a change in the group of features by the minimal joint probability of a pair of features from all possible pairs formed on the basis of the group. For example, <NUM> features of the fingerprint have changed: A, B and C. Having calculated the joint probabilities P(A,B), P(A,C), P(B,C), the analysis module <NUM> selects, as the upper limit, the minimal joint probability given that P(A,B,C) <= min(P(A,B), P(A,C), P(B, C).

Based on this approach to the assessing of the probability, the analysis module <NUM> first calculates, for each group of fingerprints, the matrix of joint pairwise probabilities of the features (for example, a matrix of dimensions <NUM>*<NUM>). When evaluating a pair of fingerprints, knowing the vector of changed features, the analysis module <NUM> selects the rows and columns, from the full matrix, corresponding to the vector of changed features, and identifies the minimal element in the resulting matrix.

It should be noted that we shall use in the remainder of the text constructions of the kind: <MAT>.

These constructions are known as "set-builder notation" and in the general case they mean that a set "X" is specified, which includes all elements "x" for which the "condition" is fulfilled.

The analysis module <NUM> calculates the difference vector of two fingerprints of devices <NUM>: <MAT>.

Using the vector so calculated, the analysis module <NUM> calculates the probability of fingerprints of devices <NUM> belonging to an adjacent pair: <MAT>.

Based on the probability so calculated, the analysis module <NUM> makes a selection of candidates: <MAT>.

The obtained results are used by systems and methods known in the prior art for a more accurate comparison of the fingerprints of devices <NUM>. It is important to understand here that in the comparison the fingerprint of the device <NUM> is compared not with all known fingerprints, but only with candidates selected as a result of the working of the present disclosure, which significantly increases the performance of the systems of the online service <NUM> and allows the online services <NUM> to be provided to the user in real time or with a minimal delay.

In the general case, the results are dispatched by the analysis module <NUM> to the security systems of the online services <NUM> for further analysis and decision making as to the current action of the user with the use of the device <NUM>, as identified by the collection module <NUM> (for example, whether the action from the device <NUM> is fraudulent), and tracking of the user's action (for example, in order to block the transaction if fraud activity is identified).

<FIG> illustrates a flow diagram of the method for selecting candidates for comparing the fingerprints of the devices of a user.

In step <NUM>, the digital fingerprint of a device <NUM> is collected using the collection module <NUM>. In one example, the digital fingerprint contains at least one characteristic of the device <NUM>, collected at the moment of time of the interaction of the user with online services <NUM> using the device <NUM>.

In step <NUM>, with the aid of an analysis module <NUM>, a group of fingerprints is determined, in which the mentioned fingerprint occurs. In one example, the fingerprints are broken down by the analysis module <NUM> into groups according to features such that the measure of similarity between any given pair of fingerprints from different groups is equal to zero. The measure of similarity is the probability of a pair of fingerprints belonging to the chain of fingerprints of the same device <NUM>.

In step <NUM>, the analysis module <NUM> calculates vectors for features which have changed in that fingerprint and all the fingerprints of the group. In one example, the analysis module <NUM> calculates a matrix of joint pairwise probabilities of features to determine which features have changed. Subsequently, the analysis module <NUM> identifies the columns and rows corresponding to a vector of altered features from the mentioned matrix of joint probabilities.

In step <NUM>, the analysis module <NUM> is used to calculate the probability of that fingerprint and each fingerprint of the group belonging to the same chain. In one example, the analysis module <NUM> identifies the minimal element in the calculated matrix of joint probabilities of the features.

In step <NUM>, the analysis module <NUM> is used to identify the fingerprints of devices in the group whose probability of belonging to the same chain as the mentioned fingerprint is above a threshold value.

In step <NUM>, the analysis module <NUM> compares the calculated digital fingerprint of the one or more devices with the fingerprints of devices in the set of candidates.

In step <NUM>, the analysis module <NUM> determines that the one or more devices correspond to one of the devices identified in the set of candidates when the comparison results in a match of specified criteria higher than a specified threshold. The analysis module <NUM> then permits the user actions, otherwise if the comparison does not result in a match higher than a specified threshold, the analysis module <NUM> tracks the user actions with the online service as fraudulent activity.

<FIG> is a block diagram illustrating a computer system <NUM> on which examples of systems and methods of selecting candidates for comparison of fingerprints of devices may be implemented. It should be noted that the computer system <NUM> can correspond to any components of the system <NUM> described earlier. The computer system <NUM> can be in the form of multiple computing devices, or in the form of a single computing device, for example, a desktop computer, a notebook computer, a laptop computer, a mobile computing device, a smart phone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

As shown, the computer system <NUM> includes a central processing unit (CPU) <NUM>, a system memory <NUM>, and a system bus <NUM> connecting the various system components, including the memory associated with the central processing unit <NUM>. The system bus <NUM> may comprise a bus memory or bus memory controller, a peripheral bus, and a local bus that is able to interact with any other bus architecture. Examples of the buses may include PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I2C, and other suitable interconnects. The central processing unit <NUM> (also referred to as a processor) can include a single or multiple sets of processors having single or multiple cores. The processor <NUM> may execute one or more computer-executable codes implementing the techniques of the present disclosure. The system memory <NUM> may be any memory for storing data used herein and/or computer programs that are executable by the processor <NUM>. The system memory <NUM> may include volatile memory such as a random access memory (RAM) <NUM> and non-volatile memory such as a read only memory (ROM) <NUM>, flash memory, etc., or any combination thereof. The basic input/output system (BIOS) <NUM> may store the basic procedures for transfer of information between elements of the computer system <NUM>, such as those at the time of loading the operating system with the use of the ROM <NUM>.

The computer readable storage medium can be a tangible device that can retain and store program code in the form of instructions or data structures that can be accessed by a processor of a computing device, such as the computer system <NUM>.

Computer readable program instructions for carrying out operations of the present disclosure may be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language, and conventional procedural programming languages. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a LAN or WAN, or the connection may be made to an external computer (for example, through the Internet). In some examples, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

In various aspects, the systems and methods described in the present disclosure can be addressed in terms of modules. The term "module" as used herein refers to a real-world device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or FPGA, for example, or as a combination of hardware and software, such as by a microprocessor system and a set of instructions to implement the module's functionality, which (while being executed) transform the microprocessor system into a special-purpose device. A module may also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software. In certain implementations, at least a portion, and in some cases, all, of a module may be executed on the processor of a computer system (such as the one described in greater detail in <FIG>, above). Accordingly, each module may be realized in a variety of suitable configurations, and should not be limited to any particular implementation exemplified herein.

Furthermore, it is to be understood that the phraseology or terminology used herein is for the purpose of description and not of restriction, such that the terminology or phraseology of the present specification is to be interpreted by the skilled in the art in light of the teachings and guidance presented herein, in combination with the knowledge of the skilled in the relevant art(s). Moreover, it is not intended for any term in the specification or claims to be ascribed an uncommon or special meaning unless explicitly set forth as such.

Claim 1:
A method of identifying fraudulent activity from a user device using a chain of device digital fingerprints, the method comprising:
calculating a digital fingerprint of a device (<NUM>) belonging to a user accessing an online service (<NUM>), wherein the calculated digital fingerprint is associated with one time instance indicating when the user accessed the online service:
determining, from a multitude of all known fingerprints of devices, a group of digital fingerprints in which the calculated digital fingerprint of the device (<NUM>) belonging to the user is present, wherein a measure of similarity between any given pair of fingerprints from different groups is equal to zero;
calculating vectors of features for changed features of the digital fingerprint of the device (<NUM>) belonging to the user and of each digital fingerprint within the determined group of digital fingerprints, an analysis module (<NUM>) being configured for calculating a matrix of joint pairwise probabilities of changed features of each digital fingerprint and for identifying columns and rows respectively corresponding to a vector of changed features from the matrix of joint pairwise probabilities;
using the calculated vectors of features, calculating a probability that the calculated digital fingerprint of the device (<NUM>) belonging to the user and each digital fingerprint within the determined group belong to a same chain of digital fingerprints, wherein the chain of digital fingerprints comprises a chronologically ordered sequence of digital fingerprint values associated with the device (<NUM>);
identifying digital fingerprints of a set of candidate devices from the digital fingerprints of the group whose probability of belonging to the same chain of digital fingerprints exceeds a threshold value;
comparing the calculated digital fingerprint of the device (<NUM>) with the digital fingerprints of devices in the set of candidates;
determining that the device (<NUM>) corresponds to one of the devices identified in the set of candidates when the comparison results in a match higher than a specified threshold;
in response to determining that the device (<NUM>) corresponds to one of the devices in the set of candidates, permitting user interactions with the online service (<NUM>), and
in response to determining that the device (<NUM>) does not correspond to one of the devices in the set of candidates, tracking the user interactions with the online service as fraudulent activity.