Fraud detection system and method

Abstract

One aspect of the disclosure pertains to a fraud detection system configured to detect fraudulent user behaviour on views, such as web pages or mobile app views, during a user session of a user device with an online system presenting the views to the user device. The fraud detection system comprises at least a first generic fraud detection trained sensor model relating to a first type of user action on the views and a second generic fraud detection trained sensor model relating to a second type of user action on the views of the plurality of views. The fraud detection system is further configured to obtain and process first user action data from the user device corresponding to the first type of user action and second user action data corresponding to the second type of user action. The fraud detection system may also comprise a first aggregator configured to provide at least one aggregated first sensor datum from the processed first user action data for a sub-session of a plurality of sub-sessions of the user session for input into the first generic fraud detection trained sensor model. The fraud detection system may also comprise a second aggregator configured to provide at least one aggregated second sensor datum from the processed second user action data for the sub-session of the plurality of sub-sessions of the user session for input into the second generic fraud detection trained sensor model.

Description

[0001] Fraud detection system and method

[0002] TECHNICAL FIELD

[0003] The present disclosure relates to fraud detection system, a fraud detection method, a computer program product for this method and an online system configured for use with the fraud detection system. In particular, the present disclosure relates to a fraud detection system configured to detect anomalous user behaviour on views, such as webpages or app views on pc or mobile devices respectively during a user session of a user device with an online system presenting the views to the user device.

[0004] BACKGROUND

[0005] Fraud is a broad and evolving field encompassing various types of deceptive activities that can have significant negative impacts on both individuals and organizations. Several forms of fraud can be distinguished, such as boiler room fraud, identity theft, dating fraud, and social media fraud. All forms of fraud can result in significant financial losses for individuals and businesses, including stolen funds, legal expenses, and costs associated with resolving the fraud. Fraud incidents can disrupt an organization's operations and lead to additional expenses in terms of security measures, investigations, and compliance efforts.

[0006] To combat these various forms of fraud, individuals and organizations need to be vigilant, employ security measures, and stay informed about evolving fraud tactics. Prevention, detection, and response strategies are essential to mitigate the impact of fraud on both personal and organizational levels.

[0007] Traditional methods to detect fraud have relied on statistical techniques or rule-based systems. However, these conventional approaches have inherent limitations in effectively identifying new or evolving fraud patterns. These methods are vulnerable to evasion by sophisticated fraudsters, often resulting in delayed fraud detection, where the fraudulent activity was only identified after the transaction had taken place. In some cases, for example, banks were unable to detect fraudulent activities until clients reported them.

[0008] To address the shortcomings of traditional methods, biometric identification methods emerged, utilizing features like iris scans, fingerprints, and gestures. While these methods are more reliable, they were impractical and time-consuming, as individuals required specialized devices to perform identification, making the process tedious and costly. Furthermore, the biometric identification data are very sensitive both in terms of their usage and storage, given the stringent regulations outlined in the General Data Protection Regulation (GDPR) and the designed laws to protect customer rights and privacy.

[0009] Recognizing the need for a more efficient and accurate solution, the concept of behavioural analytics derived from user profiles have been introduced, where individual profile models are created based on user behaviour, such as typing speed, key press and release times, key hold times, or a combination of these factors. However, this method faces challenges, as it requires substantial data for each user to develop accurate and reliable user profiles. Waiting for sufficient data per user before creating their profile models can introduce impractical delays. Even after obtaining an individual profile model, it remains susceptible to inaccuracies due to deviations in user behaviour resulting from different user-activities or conditions (e.g., eating, driving, moving, or typing with one hand). Such deviations can be wrongly interpreted as fraudulent activities. Furthermore, the process of identifying users based on their individual models and fetching these models separately for each user is time-consuming and could lead to significant time overhead and unnecessary costs.

[0010] Kyle O. Bailey et al disclose in the article “User Identification and authentication using multi-modal behavioral biometrics”, Computers and Security, Elsevier Science Publishers, vol. 43, 25 March 2014, pages 77-89 (DOI: 10.1016 / J.COSE.2014.03.005) a behavioral biometric system that fuses user data from keyboard, mouse, and Graphical User Interface (GUI) interactions to obtain an authentication decision based on the user’s computer activity while requiring less user interaction to train the system. Identification is the process of determining who the user is, while authentication is used to confirm the validity of that identity. An ensemble based decision level architecture is disclosed wherein each modality (keyboard, mouse, GUI) is classified individually with the result of those classifications sent to a final classifier that produces a decision. Sliding windows samples of 10 minutes are completed, wherein each window sample contains all of the keystroke, mouse and GUID features with a two minute sampling interval.

[0011] CN 110808995 discloses a security protection wherein behavioral data are acquired generated by a target auxiliary device in response to a user operation. Characteristic data are determined based on the behavioural data to characterize behavioral characteristics of the target auxiliary device. The characteristic data are fed into a predetermined prediction model to obtain a corresponding prediction result and, based on the prediction result, it is determined whether the subject of the user operation is a robot.

[0012] CN 111625789 discloses a user identification method based on multi-core learning and fusion of mouse and keyboard behavioral features. The method includes the steps of obtaining two types of human-computer interaction data of keyboard and mouse and performing feature extraction on keyboard and mouse features. The method further includes performing feature mapping based on multicore learning algorithm and the use of a classifier to model and perform user identification.

[0013] SUMMARY

[0014] The present disclosure provides for a balance between accurate and fast detection of fraud while requiring little to no burden for the user with the user device during a user session with an online system.

[0015] To that end, one aspect of the disclosure pertains to a fraud detection system configured to detect fraudulent user behaviour on views, such as web pages or mobile app views, during a user session of a user device with an online system presenting the views to the user device. The fraud detection system comprises at least a first generic fraud detection trained sensor model relating to a first type of user action on the views and a second generic fraud detection trained sensor model relating to a second type of user action on the views of the plurality of views. The fraud detection system is further configured to obtain and process first user action data for a view of the views from the user device corresponding to the first type of user action and second user action data for the view of the views corresponding to the second type of user action. The fraud detection system may also comprise a first aggregator configured to provide at least one aggregated first sensor datum from the processed first user action data for the view corresponding to a sub-session of a plurality of sub-sessions of the user session for input into the first generic fraud detection trained sensor model. The fraud detection system may also comprise a second aggregator configured to provide at least one aggregated second sensor datum from the processed second user action data for the view corresponding to the sub-session of the plurality of subsessions of the user session for input into the second generic fraud detection trained sensor model. The aggregated sensor data are aggregated sensor features calculated from over a sub-session to provide for input into a generic fraud detection trained model.

[0016] Another aspect of the disclosure relates to a fraud detection method in a fraud detection system for detecting fraudulent user behaviour on views, such as web pages or mobile app views, during a user session of a user device with an online system presenting the views to the user device. The fraud detection system comprises at least a first generic fraud detection trained sensor model relating to a first type of user action on the views and a second generic fraud detection trained sensor model relating to a second type of user action on the views of the plurality of views. One step of the method involves obtaining and processing first user action data from the user device corresponding to the first type of user action and second user action data corresponding to the second type of user action.

[0017] The method may further include the steps of providing at least one aggregated first sensor datum from the processed first user action data for each of a plurality of sub-sessions of the user session for input into the first generic fraud detection trained sensor model. The method may also include the step of providing at least one aggregated second sensor datum from the processed second user action data for each of the plurality of sub-sessions of the user session for input into the second generic fraud detection trained sensor model. The aggregated sensor feature is calculated over the sub-session, i.e. user action data obtained and processed during the sub-session is aggregated for input into the corresponding generic fraud detection trained model.

[0018] Yet another aspect of the disclosure involves a computer program or suite of computer programs comprising one or more software code portions configured, when run on one or more computer systems, to perform this method.

[0019] A further aspect of the disclosure pertains to user device for use with the fraud detection system as disclosed herein or for use in the method as disclosed herein.

[0020] Another aspect of the disclosure involves an online system configured for use with the fraud detection system as disclosed herein, wherein the online system is configured to provide at least one of user action data and view change indications to the fraud detection system. This configuration may be obtained by software comprised in or injected into the online system.

[0021] A further aspect of the disclosure amounts a combination of at least a fraud detection system and an online system as disclosed herein. The combination may be obtained through integration of the systems or as communicatively connected systems.

[0022] The first generic fraud detection trained sensor model and second generic fraud detection trained sensor model are separate machine learning models trained to distinguish between two types of classes, viz. genuine versus compromised sub-sessions based on their characteristics. The use of multiple sensor-specific models for different types of user action data (e.g. keystroke data, mouse / touch data, navigation data) corresponding to different types of user actions by a user on view presented to the user enables the fraud detection system to have a model focussed on particular types of user action thereby improving the model’s accuracy. It should be appreciated that the models operate on the basis of user action data received for a view instead of for a particular document or an input field of a webpage, such as a web form, that normally only analyses user action data for that particular document or input field that may be insufficient and, hence, inaccurate.

[0023] The issues with the behavioural analytics on user profile level as described above are reduced or eliminated, since the machine learning models use a generic approach focused on detecting deviations from genuine user behaviour to identify distinct behaviour associated with fraudsters rather than relying on specific user models requiring substantial historical data from a particular user.

[0024] The accuracy of fraud detection is further improved through using specific aggregated sensor features which are used as input into a corresponding one the sensor-specific models instead of the raw user action data, such as keystroke data, mouse / touch data and / or navigation data obtained from the user device. The aggregated sensor data specific to each machine learning model have also been used to train the separate models per user action type forthe purpose of fraud detection. During a sub-session the user action data are collected for processing to provide the at least one aggregated first sensor datum and at least one aggregated second sensor datum for input into the respective generic fraud detection trained sensor models. The views corresponding to the sub-sessions during the user session also enables a fast assessment of the user behaviour during the user session to enable rapid fraud detection.

[0025] Thus, an expanded generic approach is disclosed to effectively detect fraud in new sessions from any user with high accuracy, even without specific historical data for that user. In this approach, the session is split into multiple sub-sessions. These sub-sessions may be created based on the information (for example, mouse and keystrokes) throughout the user interaction with the online system.

[0026] This approach provides more insight on the micro level of user activities which provides a more accurate fraud detection model. Furthermore, sub-sessions are applied on each type of user action (for example for keyboard strokes, mouse / touch, and navigation) separately rather than analysing all user action data together. By dividing the analysis of user action data based on their type and generating aggregated features, user type behaviour is modelled and analysed separately thereby boosting the accuracy per model.

[0027] In summary, the presently proposed fraud detection system defines a particular manner to process the user action data. User action data are gathered per sensor on a view-by-view basis, corresponding to a sub-session, and are processed to obtain sensor specific features and aggregated as aggregated features for a particular view of a sequence of views for input into the fraud detection trained generic sensor specific models.

[0028] It should be appreciated that the fraud detection system and online system may constitute a single system, a co-located system, a distributed system etc. In one example, the online system and fraud detection system are distributed and connected through one or more networks. The user device may be communicatively connected solely with the online system, for example over the one or more networks, which are possibly the same network or networks used for communication between the online system and fraud detection system to perform the fraud detection disclosed herein.

[0029] The processing of the raw first and second user action data may comprise the preparation of the user action data for input into the first and second aggregator, respectively. However, in one embodiment, the processing of the user action data may comprise feature engineering wherein the processor is configured to process the user action data by calculating first sensor input features from the user action data corresponding to the first type of user action for input into the first aggregator and second sensor input features from the user action data corresponding to the second type of user action for input into the second aggregator. The calculation of the sensor specific input features may provide more information (correlations, dependencies, etc.) specific to the type of user action about the user behaviour in comparison with feeding the raw user action data.

[0030] The termination of a sub-session, and, possibly, start of a new sub-session may be trigged by a user action, such as a user action on the presented view. In one embodiment, the fraud detection system may be configured to terminate a sub-session during the user session upon receiving a view change indication, for example a transition to a new web page or a new mobile app view during the user session. The processed user action data, such as the first and second sensor input features, during this now terminated sub-session may then be used for providing the at least one aggregated first and second sensor datum for input into the respective generic fraud detection trained sensor models. The next subsession may start when user action data for the next view are obtained (or immediately when the new view is presented). The user action data obtained during the new sub-session may then be used for providing the at least one aggregated first and second sensor datum for the new sub-session.

[0031] In order to obtain aggregated sensor data, i.e. aggregated sensor features, of sufficient quality, the amount of user action data (e.g. the number of keystrokes, mouse / touch inputs and / or navigation actions) must be sufficient. In one embodiment, the fraud detection system may be configured to provide the at least one first aggregated sensor feature for a current sub-session of the plurality of sub-sessions based in part on first user action data received during at least one previous sub-session. The embodiment enables the fraud detection system to borrow previously obtained user action data for a specific type of user action during one or more previous sub-sessions, if any, to provide the at least one aggregated sensor feature of sufficient quality for that model. As an example, mouse action by the user during a sub-session may be insufficient to provide a sufficient number of mouse action data to calculate an aggregated mouse sensor datum as input for the mouse action specific model, so that mouse action data from one or more previous sub-sessions may be borrowed to calculate the aggregated mouse sensor datum. The fraud detection system may therefore be configured to store, at least temporarily, user action data from previous sub-sessions so that the user action data remain available for one or more future sub-session(s).

[0032] It should be appreciated that, alternatively or in addition, the fraud detection system may store the processed user action data, such as the sensor input features mentioned above, for the purpose of using this data to complete an input dataset for aggregation in the user action specific aggregators. Since the fraud detection system applies separate models for each type of user action data, an insufficient amount user action data (and / or processed user action data, such as sensor input features) may be available to apply one or more of the models. In one embodiment, the fraud detection system may be configured to provide the at least one second aggregated sensor datum for the current subsession based only on the second user action data obtained during the current sub-session. In other words, while for a given sub-session, insufficient user action data may have been obtained to provide one aggregated sensor datum for one corresponding sensor-specific model, the same sub-session may have sufficient user action data to provide another one of the aggregated sensor datum for another one of the sensor-specific models. As an example, while there is a lack of mouse action data as described above for a given sub-session, there may be a sufficient number of keystroke data to calculate the aggregated keystroke datum for the same sub-session for the keystroke action specific model.

[0033] In one embodiment, the fraud detection system may be configured to apply at least one first threshold to determine whether the first user action data of at least one previous sub-session should be obtained as described above. The first threshold provides a setting to define the sufficient amount of user action data to provide an adequate aggregated sensor datum for a given sub-session. The first threshold may be defined for a specific type of user action (for example, one threshold may be set for keystroke data and another, possibly different, one for the mouse / touch data). The first threshold may have been determined to enable the provision of a first aggregated sensor datum of sufficient quality. For example, the first threshold for mouse action may be set to at least three mouse movements during a sub-session (which may not be achieved, because the user has used a tab-key one or more time to move a cursor, for example). In this case, the fraud detection system may determine that user action data from one or more previous sub-sessions, if any, should be borrowed to calculate the first aggregated sensor datum of sufficient quality.

[0034] In one embodiment, the fraud detection system may be configured to apply at least one second threshold to determine whether the at least one first aggregated sensor datum should be provided for the first model. This second threshold provides a setting to define whether it is useful to apply a sensor specific model for a sub-session. The second threshold may be defined for a specific sensor (for example, one threshold may be set for keystrokes and another, possibly different, one for the mouse data). For example, if no mouse motion is detected, i.e. no mouse sensor data have been received during a sub-session, it is inefficient and / or unnecessary to run the mouse-specific model for this subsession (for example, by borrowing all mouse data from a previous sub-session and run the mousespecific model again). The output of the mouse-specific model, in this example, of the previous subsession may be used instead for the current sub-session. The second threshold may generally be set to a lower value, in logical terms, than the first threshold.

[0035] In one embodiment, the fraud detection system may be configured to provide a detection result for the sub-session by combining at least a first output of the first generic fraud detection trained sensor model relating to the first type of user action on a view and a second output the second generic fraud detection trained sensor model relating to the second type of user action on the view. The embodiment facilitates using distinct sensor-specific models while having a single detection result for every subsession, for example, for every view. For a more enhanced fraud detection system, it is possible to include more types of user action to be considered in the disclosed fraud detection process. The user action data may include keystroke data, mouse / touch data, navigation data etc. In one embodiment, the receiver of the fraud detection system may be configured to obtain and process third user action data corresponding to a third type of user action. The fraud detection system may further comprise a third generic fraud detection trained sensor model relating to a third type of user action on the view of the views. The fraud detection system may further comprise a third aggregator configured to provide at least one aggregated third sensor datum from the processed third user action data for the sub-session of the plurality of sub-sessions of the user session for input into the third generic fraud detection trained sensor model.

[0036] In one embodiment, the fraud detection system is configured to provide a detection result for the sub-session by combining at least a first output of the first generic fraud detection trained sensor model relating to the first type of user action on a view, a second output of the second generic fraud detection trained sensor model relating to the second type of user action on the view and a third output of the third generic fraud detection trained sensor model relating to the third type of user action on the view. The embodiment facilitates using distinct sensor-specific models while having a single detection result for every sub-session.

[0037] In one embodiment, the fraud detection system may be configured to terminate or trigger termination, for example by sending an alert to the online system, of the user session of the user device with the online system dependent on the detection result. The detection result may be an overall score that is assessed against a fraud threshold or fraud criterion. As a result of the division of the user session into sub-sessions, the termination or trigger thereof may be initiated on a sub-session time scale. It should be noted that, in addition or instead of terminating and / or triggering termination of the user session, the detection result may be communicated to the online system, be stored for future use, such as enhanced scrutiny on future actions of the user, etc.

[0038] In one embodiment, the fraud detection system may be configured such that the user action data relating to the first type of user action relates to one of keystroke data, mouse / touch input data and navigation data of the user device and the user action data relating to the second type of user action relates to another one of keystroke data, mouse / touch input data and navigation data. Optionally, if present, the third user action data relating to the third type of user action relates to a third one of keystroke data, at mouse / touch input data and navigation data of the user device. The embodiment provides for a fraud detection system assessing at least keystrokes, mouse / touch data and navigation data from the user device to detect fraudulent behaviour.

[0039] In one embodiment, the fraud detection system may be configured such that at least one of the at least one first aggregated sensor datum and the at least one second aggregated sensor datum is an aggregated sensor datum in the frequency domain, such as at least one of entropy and energy of the first user action data or sensor related features and the second user action data or sensor related features. The frequency domain provides for better noise- and other disturbance resistance for the model.

[0040] In one embodiment, the fraud detection system may be configured such that at least one of the at least one first aggregated sensor datum and the at least one second aggregated sensor datum is an aggregated sensor datum in the time domain, such as at least one of variance, skewness, kurtosis and percentile of the first user action data or sensor related features and the second user action data or sensor related features. The time domain analysis provides for an adequate tracking of user behaviour over time, i.e. during the sub-session and / or during the user session.

[0041] As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, a method or a computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a "circuit," "module" or "system." Functions described in this disclosure may be implemented as an algorithm executed by a processor / microprocessor of a computer. Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied, e.g., stored, thereon.

[0042] Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a computer readable storage medium may include, but are not limited to, the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fibre, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of the present invention, a computer readable storage medium may be any tangible medium that can contain, or store, a program for use by or in connection with an instruction execution system, apparatus, or device.

[0043] A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0044] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber, cable, RF, etc., or any suitable combination of the foregoing. Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object-oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the person's computer, partly on the person's computer, as a stand-alone software package, partly on the person's computer and partly on a remote computer, or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the person's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0045] Aspects of the present invention are described below with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor, in particular a microprocessor or a central processing unit (CPU), of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer, other programmable data processing apparatus, or other devices create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0046] These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function / act specified in the flowchart and / or block diagram block or blocks.

[0047] The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0048] The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

[0049] Moreover, a computer program for carrying out the methods described herein, as well as a non- transitory computer readable storage-medium storing the computer program are provided. Elements and aspects discussed for or in relation with a particular embodiment may be suitably combined with elements and aspects of other embodiments, unless explicitly stated otherwise. Embodiments of the present invention will be further illustrated with reference to the attached drawings, which schematically will show embodiments according to the invention. It will be understood that the present invention is not in any way restricted to these specific embodiments.

[0050] BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Aspects of the invention will be explained in greater detail by reference to exemplary embodiments shown in the drawings, in which:

[0052] FIG. 1 is an exemplary embodiment of a communication system comprising a user device, an online system and a fraud detection system;

[0053] FIG. 2 is an exemplary embodiment of a fraud detection system for use in the communication system of FIG. 1 ;

[0054] FIGS. 3A and 3B provide practical examples of feature engineering to obtain aggregated sensor input features for input into machine learning models;

[0055] FIGS. 3C-3E show diagrams indicating relevant features for keyboard, mouse and navigation sensor respectively;

[0056] FIG. 4 is an exemplary embodiment of a user session of a user device with an online system showing sub-sessions of the user session;

[0057] FIG. 5 is an exemplary embodiment of using user action data or sensor input features from previous sub-session(s) for obtaining a detection result;

[0058] FIG. 6 is an exemplary embodiment of combining outputs of distinct models for different types of user actions for a view to obtain an overall detection result for a sub-session;

[0059] FIG. 7 is another exemplary embodiment of combining outputs of distinct models for different types of user actions for a view to obtain an overall detection result for a sub-session; and

[0060] FIG. 8 depicts an example of a processing system according to an embodiment of a user device, online system or fraud detection system or a part thereof.

[0061] DETAILED DESCRIPTION OF THE DRAWINGS

[0062] FIG. 1 depicts a communication system 100 comprising a fraud detection system 200 configured to analyse user action data from a user of a user device 300 communicating with an online system 400. Online system 400 may comprise an online bank system, retail system, government system etc. Communications may occur over one or more networks, indicated as NW in general. It should be appreciated that fraud detection system 200, or components thereof, may be integrated in another system, such as in online system 400. Also, components of fraud detection system 200 may be distributed over the network(s) NW as may the (component of) online system 400.

[0063] Dashed arrow A indicates bidirectional communications between user device 300 and online system 400 during a user session. The communications may include online system 400 presenting views V, such as web pages or mobile app views, to user device 300. In addition, user action data UAD, such as keystroke data K, mouse / touch data MT (mouse data if the user device enables a mouse pointer; touch data if user device 300 is a touch sensitive device or both if the user device enables both), navigation data N (for example, moving from one input field to another), also referred to as sensors, and may be received at the online system 400..

[0064] Communications between fraud detection system 200 and online system 400 are shown by depicted arrows B1 and B2 for reasons of clarity. While the communications are shown separately, the communication may also be bidirectional. Online system 400 provides the user action data UAD to the fraud detection system 200, but may also provide other information, such as view change indications (for example, when a user moves from one web page to another). It should be noted that online system 400 may only send a selection of the user action data UAD to fraud detection system 200.

[0065] Fraud detection system 200 comprises a data collection unit 210, a data analysis unit 220 and a detection result unit 230. Fraud detection system 200 is configured to detect fraudulent user behaviour on views V during a user session of user device 300 with online system 400 presenting the views V to the user device 300. User device 300 and / or online system 400 may comprise software to collect the required data, such as user action data UAD and / or view change indications. This software may be injected into the website or mobile app that the online system 400 presents to the user device 300, as shown by module 410. Online system 400 may also contain a database 420 for storing user action data to provide these to fraud detection system 200 from time to time or upon request from fraud detection system 200. The data may be labelled in classes fraud vs. compliant behaviour and may be used for training the models in fraud detection system 200 as shown in more detail in FIG. 2.

[0066] Data collection unit 210 obtains user action data from the online system 400 and possibly also view change indications as will be described in further detail with reference to FIGS. 4 and 5. It should be noted that fraud detection system 200 may receive these data from other entities, such as directly from user device 300 or other intermediate systems. Data collection unit 210 may also pre-process the user action data as shown in FIG. 2.

[0067] Data analysis unit 220 may comprise a first generic fraud detection trained sensor model M1 relating to a first type of user action on the views, for example key strokes of the user on user device 300 for which the fraud detection system 200 receives key stroke data K as shown in FIG. 2. Data analysis unit 220 further comprises a second generic fraud detection trained sensor model M2 relating to a second type of user action on the views, for example mouse movement or touches from a user on user device 300 for which the fraud detection system 200 receives mouse and / or touch data MT, hereinafter mouse / touch data MT, as shown in FIG. 2.

[0068] In order to enhance fraud detection, the models M1 , M2 are provided with aggregated sensor features, using a first aggregator AG1 and a second aggregator AG2 configured to provide, respectively, at least one aggregated first sensor datum from the processed first user action data for a sub-session of the user session for input into the first generic fraud detection trained sensor model M1 , and at least one aggregated second sensor datum from the processed second user action data for the sub-session of the user session for input into the second generic fraud detection trained sensor model M2.

[0069] The first generic fraud detection trained sensor model M1 and second generic fraud detection trained sensor model M2 are separate machine learning models trained to distinguish between two types of classes, viz. genuine versus compromised sub-sessions based on their characteristics. The use of multiple sensor-specific models M1 , M2 for different types of user action data (e.g. for two of keystroke data K, mouse / touch data MT, navigation data N) corresponding to different types of user actions by a user during a sub-session enables the fraud detection system 200 to have a model focussed on particular types of user action thereby improving the model’s accuracy.

[0070] The accuracy of fraud detection is further improved through using specific aggregated sensor data provided for input into a corresponding one the sensor-specific models M1 , M2 instead of the raw user action data, such as keystroke data K, mouse / touch data MT and / or navigation data N of the user device 300 provided to the fraud detection system 200. The aggregated sensor data specific to each machine learning model have also been used to train the separate sensor-specific models. During a sub-session the user action data are collected for processing to provide the at least one aggregated first sensor datum and at least one aggregated second sensor datum for input into the respective generic fraud detection trained sensor models. The creation of sub-sessions during the user session also enables a fast assessment of the user behaviour during the user session to enable rapid fraud detection.

[0071] Detection result unit 230 combines the outputs of the separate models M1 , M2 into one single detection result for the sub-session. The result may be communicated to online system 400 shown by arrow B2. The communication may include a command or alert to online system 400 to terminate the user session between user device 300 and online system 400.

[0072] FIG. 2 is a more detailed embodiment of fraud detection system 200 and method for use thereof, wherein keystrokes, mouse / touch actions and navigation actions are analysed.

[0073] The fraud detection system 200 comprises a communication interface 201 for receiving user action data UAD, here user action data K, MT, N, and, possibly, view change indications VCI indicating that user device 300 has been presented a new view V on its screen.

[0074] User action data K, MT, N are received at communication interface 201 in communication B1 and fed to data collection unit 210 comprising a database 211 for storing the user action data and data collector 212 that may perform some pre-processing to the user action data UAD if necessary.

[0075] In the embodiment of FIG. 2, data analysis unit 220 comprises units for feature engineering to obtain appropriate inputs for generic sensor-specific models M1 , M2 and M3. Data analysis unit 220 provides a sensor feature calculator 221 K, 221 MT and 221 N for each type of user action data K, MT, N configured to calculate sensor input features for each type of user action. The calculation of the sensor specific input features provides more information (correlations, dependencies, etc.) specific to the type of user action about the user behaviour in comparison to the raw user action data as output by the user device 300.

[0076] The sensor input features obtained for each type of user action are subsequently input into aggregators AG1 , AG2 and AG3 to provide a first aggregated input datum AGK relating to the keyboard user action on user device 300 for model M1 , a second aggregated input datum AGMT relating to the mouse / touch user action on user device 300 into model M2 and a third aggregated input datum AGN relating to navigation user action on user device 300 for model M3 for a specific sub-session. Aggregators AG1 , AG2, AG3 calculate an aggregated feature for a specific sub-session based on calculated features from sensor feature calculators 221 K, 221 MT, 221 N, respectively, obtained during the sub-session. Data analysis unit 220 comprises a database 222 wherein sensor specific input features and / or aggregated input data may be stored. Database 222 may also store models M1 , M2 and M3.

[0077] Different machine learning models can be trained for models M1 , M2, M3 to distinguish between two types of classes: compliant versus compromised sub-sessions based on their characteristics. These models include Deep learning, Logistic Regression, Gradient Boosting Tree, Random Forest, and Support Vector Machine. Some other models are to group sub-sessions based on their characteristics into different clusters, without a predefined class type, such as K-Nearest Neighbors, DBSCAN, Spectral clustering, etc.

[0078] Data analysis unit 220 further comprises a sub-session controller 223 configured to perform tasks relating to sub-session processes. For example, sub-session controller 223 may determine start and / or termination of a sub-session, thereby controlling timing of the fraud detection system 200. Sub-session controller 223 may receive with communication B1 view change indication VCI representing changes of a view (e.g. changing of a web page or changing of a mobile app view) at the user device 300. Subsession controller 223 may, for example, trigger aggregators AG1 , AG2, AG3 to provide the aggregated data AGK, AGMT and AGN to the respective separate models M1 , M2 and M3 or trigger sensor feature calculators 221 K, 221 MT, 221 N to use the user action data from database 211 to obtain sensor input features for aggregators AGK, AGMT and AGN to calculate of the aggregated features for the subsession. Sub-session controller 223 may also be configured to ensure that a sufficient amount of data (user action data and / or sensor specific features) is available for a sub-session as will be described in further detail with reference to FIG. 5.

[0079] In more detail, the feature engineering as shown in FIG. 2 is divided into two stages in data analysis unit 220. The first stage involves the computation of sensor-specific behavioral features, computed for the three types of user action (keystroke K, mouse / touch MT, and navigation N) separately using sensor feature calculators 221 K, 221 MT and 221 N, examples of which are shown in in table 1.

[0080] Table 1 Sensor-specific behavioural features

[0081] In the second stage, aggregated features are obtained using aggregators AG1 , AG2 and AG3 calculated from corresponding sensor-specific features for a sub-session as illustrated in table 2. The aggregated features can be classified into time domain and frequency domain features. The time domain features comprise statistical measures, such as mean, median, variance, skewness, kurtosis, and percentiles. The frequency domain features relate to the sensor signal values with respect to its frequency. A signal can be converted from the time domain to the frequency domain using mathematical transformations like the Fourier transform. Data engineered from this type are for instance the power spectral density and entropy. The aggregated features are calculated per sensor for each sub-session. Table 2: Aggregated features

[0082] FIGS. 3A and 3B show some actual data for the diverse stages of feature engineering for three sub-sessions.

[0083] In FIG. 3A user action data of a particular user session (user sessionjd) are shown, in this case for the keystroke sensor. The keystroke data K include key release time and key press time. Sensor input features are calculated from these data, for example hold_time, prev_press-to-press times and prev_release-to-press times. Sub-session identifiers are also included.

[0084] FIG. 3B shows some of the aggregated keyboard sensor feature values for each sub-session. The sensor input features are aggregated on sub-session basis and statistical features, such as 3rdquantile, 98thpercentile, skewness and kurtosis in this example of FIG. 3B, are calculated.

[0085] Detection result unit 230 may include a combiner unit 231 to provide a detection result for the sub-session by combining at least a first output of the first generic fraud detection trained sensor model M1 relating to the first type of user action, here keyboard action on user device 300 for a sub-session, a second output of the second generic fraud detection trained sensor model M2 relating to the second type of user action, here mouse / touch action, for the sub-session and a third output of the third generic fraud detection trained sensor model M3 relating to the third type of user action, here navigation action, for the sub-session. This facilitates using distinct sensor-specific models while having a single detection result for every sub-session. An embodiment of this combination process will be further described with reference to FIG. 6. The detection results and / or the outputs of each trained model M1 , M2, M3, per sub-session for a particular user device may be stored in database 232.

[0086] In the embodiment of FIG. 2, detection result unit 230 may be configured to terminate or trigger termination by means of alert AL of the user session between user device 300 and online system 400, as is shown by communication B2(AL) if the output of combiner 231 detects the user of user device 300 as a fraudster.

[0087] The fraud detection system 200 comprises a training module 240, as shown in FIG. 2, using input from online system 400 (shown by the dashed arrow) enabling the models M1 , M2 and M3 to distinguish between compliant and fraudulent behaviour based on historical data of fraudulent and compliant behaviour. Training module 240 may use data collection unit 210 to obtain data from database 420 of online system 400 that is subsequently input into data analysis unit 220 to obtained labelled sensor specific features and / or labelled aggregated sensor features and may be stored in database 222. The outcomes of the training process are three separately trained models M1 , M2 and M3, viz. a generic model per sensor (keystroke, mouse / touch, and navigation). These three generic models have been built based on the overall fraudsters’ behavior and are used to detect fraudulent behavior for new user sessions.

[0088] For example, the transformed data described above may be used to train a gradient boosting tree model. The used model is described on the website of XGBoost (https: / / xgboost.ai). The original dataset was significantly imbalanced, with genuine cases far outnumbering fraudulent ones. To address this, subsampling has been applied to the training and testing datasets, ensuring a fixed proportion of genuine to fraudulent cases. This approach resulted in unbiased generic fraud detection trained sensor models. Separate sensor models M1 , M2, M3 were trained for each sensor type: keystroke, navigation, and mouse. The dataset used fortraining consisted of 5000 unique users with around 15K sub-sessions. The data was split into 80% for training and 20% for testing where the proportion of fraud cases in the training and testing sets was 48% for mouse, 41 % for keystroke, and 36% for navigation.

[0089] The trained models were saved in a database and are utilized by the fraud detection system 200 for scoring any new, unseen sub-sessions. Each sensor-specific fraud detection model was fine-tuned to achieve optimal performance by setting its hyperparameters as outlined below:

[0090] Table 3: XGBoost hyperparameters per sensor

[0091] In table 3, the maximum depth indicates the maximum depth of a tree, controlling the number of splits in each decision tree. The minimum child weight indicates the minimum sum of instance weights in a child node. The subsample columns refers to the fraction of training data randomly sampled to grow each tree and the colsample column to the fraction of features randomly sampled to grow each tree. The learning rate indicates the step size used to update the weights in the boosting process. The primary goal of the trained fraud detection models is to achieve high accuracy in detecting both genuine and fraudulent sub-sessions. To this end, the Equal Error Rate, EER, metric is used which is a key performance metric for binary classifiers. The EER identifies the decision boundary (threshold) where the False Acceptance Rate, FAR, is equal to the False Rejection Rate, FRR. FAR is defined as the proportion of fraudulent sub-sessions incorrectly classified as genuine and FRR is defined as the proportion of genuine sub-sessions incorrectly classified as fraudulent. The EER values and corresponding thresholds for each sensor type are provided in the table below:

[0092] Table 4: EER and EER threshold per sensor

[0093] The trained models were further evaluated on an actual unseen dataset for three months where the cases of fraudulent sub-sessions were significantly fewer than those of genuine sub-sessions. The proportions of fraudulent cases compared to genuine ones for the keystroke, mouse, and navigation models were 0.029%, 0.027%, and 0.025%, respectively.

[0094] The evaluation results, including Precision, Recall, and F1 -score, are presented in the table below:

[0095] Table 5: Evaluation results

[0096] In table 5, Precision indicates the accuracy of positive prediction, i.e. the proportion of correctly detected frauds (true positives) out of all cases predicted as fraud (true positive + false positives). The column Recall indicates the ability to detect all actual fraud cases. Recall is the proportion of correctly detecting frauds (true positive) out of all actual fraud cases (true positives + false negatives). The F1 score is the harmonic mean of precision and recall. It balances the two metrics (Precision and Recall) and is useful when there is uneven class distribution (e.g. fraud cases are rare)

[0097] FIGS. 3C-3E shows the top ten most important aggregated features by total gain per sensor, i.e. keyboard (FIG. 3C), mouse (FIG. 3D) and navigation (FIG. 3E). The total gain refers to a method for evaluating how much each feature contributes to the predictive power of the model, based on the improvement in the model’s performance attributed to that feature. The names along the vertical axis refer to the sensor features since an aggregated features are is aggregated version for a sensor feature. For example, Fig. 3C, illustrates the top ten most important aggregated features that have been used in training the keystroke model. The features are sorted in descending order based on their normalized total gain scores. The most important feature is the prev_release_to_release_q3, has a total gain score of 6.71 %, indicating that it contributed 6.71 % to the model’s prediction, and this pattern continues to the other features. Together, the top ten most important keystroke features account for approximately 45% of the model’s predictive power.

[0098] In one embodiment, the fraud detection system 200 and online system 400 may operate as follows.

[0099] A user connects to a mobile / web banking system 400 via his user device 300, such as a personal computer, laptop, or other mobile device (smart phone, tablet computer). The user explores the web site or the mobile banking application via an I / O interface on his device, which may be a mouse, keyboard, touch, or a combination of them. For security and verification purposes, all the user actions via the I / O interface are communicated through the network NW to the banking system 400.

[0100] Data collection unit 210 receives user action data for keystroke, mouse / touch, and navigation via a software development kit and saves these data into a database 211. Sub-sessions are used to generate sophisticated features and then saved into a database 222. The data analysis unit 220 obtains, per type of user action, two inputs, the sub-session advanced features from aggregators AG1 , AG2 and AG3 and the pretrained models M1 , M2, M3 to detect whether the sub-session exhibits fraudulent behavior or is considered compliant by assigning a risk score using detection result unit 230.

[0101] FIG. 4 is an exemplary embodiment of a user session US of a user device 300 with an online system 400 during which a sequence of views V1-V5 is presented on the user device 300. Views V1- V5 may comprise different web pages presented to a user device 300, such as a personal computer, a laptop computer or a tablet computer, during user session US. Views V1-V5 may, alternatively, correspond to mobile application views, presented on a mobile device 300, such as a smart phone or tablet computer. The sequence of views V1-V5 may be determined by the online system 400 for a particular interaction with the user device 300 during the user session US.

[0102] During the user session US, the user device 300 proceeds through the sequence of views V1 , V2, V3, V4 and V5. View V1 may, for example be an introduction or logon view to the online system 400, view V2 a status view for the user (e.g. the current financial position of the user’s bank account(s)), views V3 and V4 may be views wherein the user inputs data for a certain instruction to the online system 400 (e.g. money transfer) and view V5 a confirmation view (e.g. view presenting the instructions of the user as recorded by the online system 400 to be confirmed by the user on this view). Each time a new view is presented on the user device 300, the fraud detection system 200 may detect that a previous sub-session is terminated, and a new sub-session begins, for example by receiving a view change indication VCI, as shown in the exemplary embodiment of FIG. 2. Hence, in the embodiment of FIG. 4, each view V presented on the user device 300, or the start of user action on that view, corresponds to a sub-session SS in the fraud detection system 200. The sub-sessions SS1 , SS2, SS3, SS4 and SS5 are indicated in FIG. 4 and the dotted lines indicate the boundaries between these sub-sessions as an example. The first sub-session SS1 starts when the first view V1 is presented to the user device 300 or when the user starts a user action on the view V1 .

[0103] The sub-session embodiment is user activity-driven and enables calculation of multiple fraud scores and detection results based on a user’s interactions with the online system 400. During the user session US, it may be evaluated continuously if the user session becomes compromised at some point during the online session. Consequently, the sub-session embodiment enables tracking user activities throughout the user session US. Throughout the user session, keystrokes, mouse / touch events and other events may be collected as the user performs actions on the view. At the end of the actions on the view, when the user changes to another page, for example, the sub-session is terminated. An aggregated sensor feature for each sensor may then be calculated for input into the generic fraud detection trained sensor models.

[0104] In order to obtain aggregated sensor features of sufficient quality for input into the sensor-specific models M1 , M2, M3, the amount of user action data (e.g. the number of keystrokes, mouse / touch inputs and / or navigation actions) must be sufficient. FIG. 5 is a schematic illustration of how this can be achieved for the embodiment of FIG. 1 with two sensors, for example keystrokes represented by key stroke data K and mouse / touch actions represented by mouse / touch data MT. The skilled person will appreciate that a corresponding approach applies to the embodiment of FIG. 2.

[0105] The fraud detection system 200 may be configured to calculate at least one first aggregated sensor feature for mouse / touch actions for a current sub-session SS3, for example, of the plurality of sub-sessions SS1-SS5 based in part on mouse / touch action data MT, for example, received during at least one previous sub-session SS2 and / or SS1 . The embodiment enables the fraud detection system 200 to borrow previously obtained user action data for a specific type of user action during one or more previous sub-sessions to calculate the at least one aggregated sensor feature of sufficient quality for that generic sensor-specific model. As an example, mouse / touch action by the user on user device 300 during sub-session SS3 may be insufficient to provide a sufficient number of mouse / touch data MT to calculate an aggregated mouse sensor feature AGMT as input for the mouse / touch action specific generic model M2, so that mouse / touch data MT from one or more previous sub-sessions SS2, SS1 may be borrowed to calculate the aggregated mouse sensor feature AGMT. The fraud detection system 200 may therefore be configured to store, at least temporarily, user action data from previous subsessions, SS2 and / or SS1 in this example, so that the mouse / touch action data MT remain available for one or more future sub-session(s), such as current sub-session SS3.

[0106] In the embodiment of FIG. 2, database 211 may store the user action data and sub-session controller 223 may determine whether sufficient user action data are available based on comparison with a threshold, as will be explained below. The fraud detection system 200 may, alternatively or in addition, store the processed user action data, such as the sensor input features mentioned above, in database 222 for the purpose of using this data of one or more previous sub-sessions SS to complete an input dataset for aggregation in the user action specific aggregators for a particular current subsession.

[0107] Since the fraud detection system 200 applies separate sensor-specific generic models M1 , M2, M3 for each type of user action data UAD, an insufficient amount user action data may be available to apply one or more of the models, such as for the mouse / touch data MT described above for sub-session SS3. The fraud detection system 200 may be configured to calculate the at least one second aggregated sensor feature, for example AGK, for the current sub-session SS3 based only on the keystroke data K obtained during the current sub-session SS3. In other words, while for a given sub-session SS3, insufficient user action data, here mouse / touch action data MT, may have been obtained to calculate one aggregated sensor feature, here AGMT, for one corresponding sensor-specific model, here model M2, the same sub-session SS3 may have sufficient user action data to calculate another one of the aggregated sensor feature for another one of the sensor-specific models, such as keystroke data K related model M1. As an example, while there is a lack of mouse action data MT as described above for sub-session SS3, there may be a sufficient number of keystroke data K to calculate the aggregated keystroke feature AGK for the same sub-session SS3 for the keystroke action specific model M1 .

[0108] As a numeric example, FIG. 5 indicates the number of keystroke action data K and the number of mouse / touch action data MT in the circles in the lower-left part of each of the views V1 -V5 as collected for user actions on user device 300 for each of these views V1-V5. For example, for view V1 , fraud detection system 200 collects 13 samples of keystroke action data K and 7 samples of mouse / touch action data MT. Likewise, for view V2 15 samples of keystroke action data K and 12 samples of mouse / touch action data MT are collected, etc. In the embodiment of FIG. 2, these user action data UAD may be stored in database 211 for each sub-session SS.

[0109] The fraud detection system 200 may be configured to apply at least one first threshold to determine whether the user action data UAD of at least one previous sub-session SS should be obtained as described above. The first threshold provides a setting to define the sufficient amount of user action data UAD for a given sub-session SS. The first threshold may be defined for a specific type of user action (for example, one threshold may be set for keystroke data K and another, possibly different, one for the mouse / touch data MT). The first threshold may be determined to enable the calculation of an aggregated sensor feature such as AGMT, of sufficient quality.

[0110] In the example of FIG. 5, it is shown that the fraud detection system 200 receives 4 samples of mouse / touch data MT for view V3 (sub-session SS3). For this embodiment, the threshold for the amount of keystroke data K may be set to 10 and the threshold for the amount of mouse / touch data MT may be set to 8. Since the number of samples of mouse / touch data MT for sub-session SS3 is beneath the set threshold for mouse / touch data for view V3, fraud detection system 200 (for example using sub-session controller 223) may take at least four samples of mouse / touch action data MT stored in database 211 for the previous view V2 (sub-session SS2) before starting to calculate the aggregated mouse / touch feature AGMT for view V3 (possibly after generating sensor specific features using 221 MT as described with reference to FIG. 2). It is noted that, for the same view V3 (sub-session SS3), the number of samples for keystroke data K (here: 12) meets the set threshold for keystroke data, so that the aggregated keystroke feature AGK is calculated only based on keystroke data K (possibly after generating sensor specific features using 221 K as described with reference to FIG. 2) collected for view V3 itself.

[0111] Furthermore, it is shown that the number of mouse / touch action data MT in view V1 (sub-session SS1) is also below the threshold of 8 set for mouse / touch action data MT. Since there are no previous sub-sessions SS prior to sub-session SS1 , the aggregated mouse / touch feature AGMT is provided using the number of mouse / touch action data samples below the threshold. The inventors have considered that such cases would mainly occur when starting the user session US, while fraud is typically observed deeper into the user session US, i.e. after a first number of views has passed.

[0112] In one embodiment, the fraud detection system 200 may be configured to apply at least one second threshold to determine whether an aggregated sensor feature should be provided at all, i.e. whether or not the trained model should be applied for that sensor. This second threshold provides a setting to define whether it is useful to apply a sensor specific model for a particular sub-session SS. The second threshold may be defined for a specific sensor (for example, one threshold may be set for keystroke data K and another, possibly different, one for the mouse / touch action data MT).

[0113] For example, in FIG. 5, the number of keystroke action data K for view V5 (sub-session SS5) is only 1. If the minimum threshold is set to 2 for keystroke data K, the fraud detection system 200 may decide to not provide the aggregated keystroke feature AGK for this sub-session SS5 to model M1 so that no result for this specific sensor model M1 is obtained for sub-session SS5. The detection results, as will now be discussed with reference to FIG. 6, may then be based on the aggregated keystroke feature AGK fed to model M1 for the previous view V4 (i.e. sub-session SS4)

[0114] FIG. 6 is an exemplary embodiment of combining outputs of distinct models M1 , M2 and M3 in FIG. 2 for different types of user actions for a view to obtain an overall detection result for a sub-session SS. As explained with reference to FIG. 2, the fraud detection system 200 may include a combiner unit 231 to provide a detection result for the sub-session SS by combining at least a first output of the first generic fraud detection trained sensor model M1 relating to the first type of user action, here keystroke action on user device 300 during a sub-session, a second output of the second generic fraud detection trained sensor model M2 relating to the second type of user action, here mouse / touch action, during the sub-session and a third output of the third generic fraud detection trained sensor model M3 relating to the third type of user action, here navigation action, during the sub-session.

[0115] FIG. 6 shows that the output of each model M1 , M2 and M3 provides a user-action specific score that is combined into a total score. The inputs to the generic trained models are the aggregated features of user action. These features are used to enable the models to compute a sensor specific score. In other words, risk scores are generated separately for each one of the three models M1 , M2, M3, one per sensor, based on how likely the characteristics of the sub-session per sensor indicates a compromised sub-session. The three scores are then merged into a total score. Multiple approaches can be used such as the simple averaging, weighted mean, or using a machine learning model, such as a stacking classifier or using another machine learning model. The final conclusion for the subsession results in a detection result which may terminate or trigger termination of the user session US. Database 232 may be used to store the results and / or the predicted scores.

[0116] For example, as shown in FIG. 7 illustrates the real time scoring steps. The process begins with processing of navigation, mouse and keystroke sensor data, where the features for the incoming subsession are prepared for keystroke, mouse, and navigation trained models. These features are then input into the corresponding trained models. Each model generates a probability score that indicates how likely the current sub-session is fraudulent. The next step involves comparing the probability scores against the EER threshold for each model. If the probability score exceeds the EER threshold, the subsession is labeled as fraudulent (label = 1). If the probability score is below the EER threshold, the subsession is labeled as genuine (label = 0). Each sub-session may have three decision scores, one for each sensor: keystroke, mouse, and navigation. If all three decision scores are labeled as 1 , the subsession is highly likely to be compromised. Conversely, if fewer than three sensors produce a fraudulent label, the sub-session is considered genuine. For determining the overall score, the maximum overall scoring method is used. For example, if there are three sub-sessions before a transaction, the maximum score among these three sub-sessions is taken as the final score. This approach resulted in an achieved detection rate of 41.43%.

[0117] The disclosed approach focuses on finding footprints of fraudsters in online applications. Real historical transactional data are acquired from the online system (e.g., a bank). The data has been generated, but not limited, to users’ exploration and usage of views associated with the online system comprising keystrokes, mouse / touch dynamics, and navigation details. The user sessions are prelabeled as fraud or non-fraud.

[0118] The primary focus in this approach revolves around behavioral biometrics of fraudsters’ patterns throughout their user session on micro level rather than focusing on the individual user’s behavioral biometric patterns and deviations. Each user session may be divided into multiple sub-sessions based on the user activities. These activities related to, but not limited, keystrokes, mouse / touch dynamics, and navigation patterns. The purpose behind creating these sub-sessions is to gather more insight related to the fraudster’s behavior and to identify the fraudulent activity at the earliest stage of a user session.

[0119] For each sub-session, the sensor raw data (keystroke, mouse / touch, navigation data) has been utilized to derive advanced aggregated sensor features, for example in time and frequency domains. This sensors data and sensor-related features are collected and engineered separately per sensor to train one generic model per sensor.

[0120] The generic fraud detection approach may comprise two stages for each sensor. The first stage is the training phase, where a binary classifier model is trained to distinguish between fraudsters and non-fraudsters at the sub-session level using sophisticated features. The second stage is the fraud detection phase, where features are generated from previously unseen session data, either from a new user or an existing user. The trained models are then employed to determine whether these subsessions exhibit signs of a fraud or not.

[0121] FIG. 8 depicts a block diagram illustrating an exemplary processing system according to a disclosed embodiment, e.g. a (part of a) fraud detection system 200, user device 300 and / or online system 400 as described above for use in the fraud detection method as described above. As shown in FIG. 8, the processing system 80 may include at least one processor 81 coupled to memory elements 82 through a system bus 83. As such, the processing system may store program code within memory elements 82. Further, the processor 81 may execute the program code accessed from the memory elements 82 via a system bus 83. In one aspect, the processing system may be implemented as a computer system that is suitable for storing and / or executing program code. It should be appreciated, however, that the processing system 80 may be implemented in the form of any system including a processor and a memory that is capable of performing the functions described within this specification.

[0122] The memory elements 82 may include one or more physical memory devices such as, for example, local memory 84 and one or more bulk storage devices 85. The local memory may refer to random access memory or other non-persistent memory device(s) generally used during actual execution of the program code. A bulk storage device may be implemented as a hard drive or other persistent data storage device. The processing system 80 may also include one or more cache memories (not shown) that provide temporary storage of at least some program code in order to reduce the number of times program code must be retrieved from the bulk storage device 85 during execution.

[0123] Input / output (I / O) devices depicted as an input device 86 and an output device 87 optionally can be coupled to the processing system. Examples of input devices may include, but are not limited to, a space access keyboard, a pointing device such as a mouse, or the like. Examples of output devices may include, but are not limited to, a monitor or a display, speakers, or the like. Input and / or output devices may be coupled to the processing system either directly or through intervening I / O controllers.

[0124] In an embodiment, the input and the output devices may be implemented as a combined input / output device (illustrated in FIG. 8 with a dashed line surrounding the input device 86 and the output device 87). An example of such a combined device is a touch sensitive display, also sometimes referred to as a “touch screen display” or simply “touch screen” that may be provided with the UE. In such an embodiment, input to the device may be provided by a movement of a physical object, such as e.g. a stylus or a finger of a person, on or near the touch screen display.

[0125] A network adapter 88 may also be coupled to the processing system to enable it to become coupled to other systems, computer systems, remote network devices, and / or remote storage devices through intervening private or public networks. The network adapter may comprise a data receiver for receiving data that is transmitted by said systems, devices and / or networks to the processing system 80, and a data transmitter for transmitting data from the processing system 80 to said systems, devices and / or networks. Modems, cable modems, and Ethernet cards are examples of different types of network adapter that may be used with the processing system 80.

[0126] As pictured in FIG. 8, the memory elements 82 may store an application 89. In various embodiments, the application 89 may be stored in the local memory 84, the one or more bulk storage devices 85, or apart from the local memory and the bulk storage devices. It should be appreciated that the processing system 80 may further execute an operating system (not shown in FIG. 8) that can facilitate execution of the application 89. The application 89, being implemented in the form of executable program code, can be executed by the processing system 80, e.g., by the processor 81. Responsive to executing the application, the processing system 80 may be configured to perform one or more operations or method steps described herein.

[0127] In one aspect of the present invention, one or more components of the base station selection support system and / or user device for use with such a base station selection support system, as disclosed herein may represent processing system 80 as described herein.

[0128] Various embodiments of the invention may be implemented as a program product for use with a computer system, where the program(s) of the program product define functions of the embodiments (including the methods described herein). In one embodiment, the program(s) can be contained on a variety of non-transitory computer-readable storage media, where, as used herein, the expression “non- transitory computer readable storage media” comprises all computer-readable media, with the sole exception being a transitory, propagating signal. In another embodiment, the program(s) can be contained on a variety of transitory computer-readable storage media. Illustrative computer-readable storage media include, but are not limited to: (i) non-writable storage media (e.g., read-only memory devices within a computer such as CD-ROM disks readable by a CD-ROM drive, ROM chips or any type of solid-state non-volatile semiconductor memory) on which information is permanently stored; and (ii) writable storage media (e.g., flash memory, floppy disks within a diskette drive or hard-disk drive or any type of solid-state random-access semiconductor memory) on which alterable information is stored. The computer program may be run on the processor 81 described herein.

[0129] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0130] The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of embodiments of the present invention has been presented for purposes of illustration but is not intended to be exhaustive or limited to the implementations in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the claims. The embodiments were chosen and described in order to best explain the principles and some practical applications of the present invention, and to enable others of ordinary skill in the art to understand the present invention for various embodiments with various modifications as are suited to the particular use contemplated.

Claims

CLAIMS1 . A fraud detection system configured to detect fraudulent user behaviour on views during a user session of a user device with an online system presenting the views to the user device, wherein the fraud detection system comprises at least a first generic fraud detection trained sensor model relating to a first type of user action on the views; a second generic fraud detection trained sensor model relating to a second type of user action on the views; wherein the fraud detection system is further configured to obtain and process first user action data from the user device corresponding to the first type of user action for a view of the views and second user action data corresponding to the second type of user action for the view of the views; a first aggregator is configured to provide at least one aggregated first sensor datum from the processed first user action data for the view corresponding to a sub-session of a plurality of sub-sessions of the user session for input into the first generic fraud detection trained sensor model, and a second aggregator is configured to provide at least one aggregated second sensor datum from the processed second user action data for the view corresponding to the subsession of the plurality of sub-sessions of the user session for input into the second generic fraud detection trained sensor model.

2. The fraud detection system according to claim 1 , wherein the fraud detection system is configured to process the user action data by calculating first sensor input features from the user action data corresponding to the first type of user action for input into the first aggregator and second sensor input features from the user action data corresponding to the second type of user action for input into the second aggregator.

3. The fraud detection system according to claim 1 , wherein the fraud detection system is configured to terminate the sub-session upon receiving a view change indication.

4. The fraud detection system according to one or more of the preceding claims, wherein the fraud detection system is configured to calculate the at least one first aggregated sensor datum for a current sub-session of the plurality of sub-sessions using in the first user action data obtained during at least one previous sub-session.

5. The fraud detection system according to claim 4, wherein the fraud detection system is configured to calculate the at least one second aggregated sensor datum for the current subsession of the plurality of sub-sessions using only the second user action data obtained during the current sub-session.

6. The fraud detection system according to one or more of the preceding claims, wherein the fraud detection system is configured to apply at least one of: at least one first threshold to determine whether first user action data of the at least one previous sub-session according to claim 4 should be used to provide the first aggregated sensor datum, wherein, optionally, the first threshold is specific for the type of user action; and at least one second threshold to determine whether the at least one first aggregated sensor datum should be provided, wherein, optionally, the second threshold is specific for the type of user action.

7. The fraud detection system according to one or more of the preceding claims, wherein the fraud detection system is configured to provide a detection result for the sub-session by combining at least a first output of the first generic fraud detection trained sensor model relating to the first type of user action on a view and a second output of the second generic fraud detection trained sensor model relating to the second type of user action on the view.

8. The fraud detection system according to one or more of the preceding claims, wherein the fraud detection system is configured to obtain and process third user action data corresponding to a third type of user action, and wherein the fraud detection system further comprises a third generic fraud detection trained sensor model relating to a third type of user action on the view of the views; a third aggregator configured to provide at least one aggregated third sensor datum from the processed third user action data for the sub-session of the plurality of sub-sessions of the user session for input into the third generic fraud detection trained sensor model.

9. The fraud detection system according to claim 8, wherein the fraud detection system is configured to provide a detection result for the sub-session by combining at least a first output of the first generic fraud detection trained sensor model relating to the first type of user action on a view, a second output of the second generic fraud detection trained sensor model relating to the second type of user action on the view and a third output of the third generic fraud detection trained sensor model relating to the third type of user action on the view.

10. The fraud detection system according to claims 7 or 9, wherein the fraud detection system is configured to terminate or trigger termination of the user session of the user device with the online system dependent on the detection result.11 . The fraud detection system according to one or more of the preceding claims, wherein the user action data relating to the first type of user action relates to one of keystroke data, mouse / touch input data and navigation data of the user device and the user action data relating to the second type of user action relates to another one of keystroke data, mouse / touch input data and navigation data, wherein, optionally in case of claim 8, the third user action data relating to the third type of user action relates to a third one of keystroke data, at mouse / touch input data and navigation data of the user device.

12. The fraud detection system according to one or more of the preceding claims, wherein at least one of the at least one first aggregated sensor datum and the at least one second aggregated sensor datum is an aggregated sensor datum in the frequency domain, such as at least one of entropy and energy of the user action data corresponding to at least the first and second type of user action.

13. The fraud detection system according to one or more of the preceding claims, wherein at least one of the at least one first aggregated sensor datum and the at least one second aggregated sensor datum is an aggregated sensor datum in the time domain, such as at least one of variance, skewness, kurtosis and percentile of the user action data corresponding to at least the first and second type of user action.

14. A fraud detection method in a fraud detection system for detecting fraudulent user behaviour on views during a user session of a user device with an online system presenting the views to the user device, wherein the fraud detection system comprises at least a first generic fraud detection trained sensor model relating to a first type of user action on a view of the views; a second generic fraud detection trained sensor model relating to a second type of user action on the view of the views; wherein method comprises the steps of obtaining and processing first user action data from the user device corresponding to the first type of user action and second user action data corresponding to the second type of user action; providing at least one aggregated first sensor datum from the processed first user action data for the view corresponding to a sub-session of a plurality of sub-sessions of the user session for input into the first generic fraud detection trained sensor model, andproviding at least one aggregated second sensor datum from the processed second user action data for the view corresponding to the sub-session of the plurality of sub-sessions of the user session for input into the second generic fraud detection trained sensor model.

15. The method according to claim 13, further comprising the steps of operating the fraud detection system as defined in one or more of the claim 2-13.

16. A computer program product or suite of computer programs comprising one or more software code portions configured to, when run on one or more computer systems, to perform the steps of the method according to claim 14 or 15.

17. An online system configured for use with the fraud detection system as defined in one or more of the claims 1 -13 or in the method as defined in one or more of the claims 14 and 15, wherein the online system is configured to receive the first user action data and second user action data from the user device and to send the first user action data and second user action data, or samples or derivatives thereof, to the fraud detection system.