Lexisnexis Risk Solutions Fl Inc.

Mikael Åhlén

Per Burström

Philip Lindblad

Tony Libell

Julian Breitling

A method for determining whether a secure transaction between a user computing device and a server, connected via a network, is controlled remotely via a remote access tool. The method includes, during the secure transaction, actively perturbing and/or probing the network to change the conditions in the network. During perturbing of the network, data relating to user interactions with a user interface associated with the user computing device is collected and compared to reference data relating to user interactions carried out prior to the secure transaction or prior to perturbing of the network. Based on the comparison, a probability that the secure transaction is carried out via a remote access tool is computed and is compared to a predefined threshold. If the threshold is exceeded, the secure transaction is terminated.

Detection of use of a remote access tool for secure transactions

The systems and methods are provided that can enable the detection of certain modes of online interactions carried out by a user's computing device, for example, when an online app or webpage of an enterprise is accessed by the user's computing device. Certain exemplary implementations may utilize collector code that resides in the app or webpage opened by users accessing the enterprise service to measure and collect timing data to detect whether the user's computing device or associated browsing session is subjected to modes of manipulation such as the user browser's privacy mode being engaged, malware interacting with the browsing session, and/or some type of aggregator interacting with the browsing session. Such modes of manipulation can impact the utility and accuracy of certain forms of behavioral biometric algorithms, particularly those that utilize users' typing, timing, keystroke dwell, etc.

Systems and methods for detecting browser mode

Systems and methods are provided for improving behavioral biometrics scoring accuracy. A method includes receiving streamed behavioral biometrics data and associated contextual data, determining a first trust score by evaluating the streamed behavioral biometric data, and if the first trust score is below a first predetermined value, separating the streamed behavioral biometrics data into contextualized bins corresponding to the contextual data to produce binned data. The contextualized bins can include a target identifier such as a data field; or a data type field, an area of a browser window, a task, and/or a physical activity. Responsive to a first threshold amount of accrued binned data, the method can include evaluating the binned data to determine a second trust score that is context-aware and sending an alert to the enterprise server responsive to the second trust score being below a second predetermined value.

Growing community of inventors

Västerås, Sweden

Mikael Åhlén