Method, system, product and medium for detecting malicious activities of an application

Abstract

A method, computer system, and computer program product for detecting malicious activity with respect to an application hosted on a server are provided. The present invention may include collecting user activity data related to an application accessed remotely via a network, generating a graph based on the collected user activity data. Each node of the graph represents a set of user requests related to a location within the application received from a user, and each connection between the nodes represents a user-navigable path between locations within the application. The present invention may include storing the generated graph, monitoring subsequent user activity with respect to the application. The present invention may include detecting any user activity that does not match the stored graph.

Description

Technical Field

[0001] The present invention generally relates to the field of computing and, more particularly, to Internet security. Background Art

[0002] Communications routed via the Internet are vulnerable to interception between endpoints and servers, thereby exploiting weaknesses behind the application logic of applications hosted on the servers. Since these vulnerabilities are related to the application logic, common vulnerability scanners and protection techniques cannot detect such malicious activities.

[0003] Therefore, there is a need in the art to address the foregoing problems. Summary of the Invention

[0004] In a first aspect, the present invention provides a method for detecting malicious activities with respect to an application hosted on a server, the method comprising: collecting user activity data related to an application remotely accessed via a network, wherein the collected user activity data includes at least one set of user requests received from a user, and each set of the at least one set of received user requests is associated with a corresponding location within the application; generating a graph based on the collected user activity data, the generated graph including a plurality of nodes and a plurality of connections linking the plurality of nodes, wherein each node of the plurality of nodes represents a corresponding set of the at least one set of received user requests, and each connection of the plurality of connections represents a user-navigable path between a pair of corresponding locations within the application; storing the generated graph; monitoring subsequent user activities related to the application remotely accessed via the network; and detecting a mismatch between the subsequent user activities and the stored graph of the collected user activity data.

[0005] From another aspect, the present invention provides a computer system for detecting malicious activities regarding an application hosted on a server, including: one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage media, and program instructions stored on at least one of the one or more computer-readable tangible storage media for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method, the method including: collecting user activity data related to an application remotely accessed via a network, wherein the collected user activity data includes at least one set of user requests received from a user, and each set of the received at least one set of user requests is associated with a corresponding location within the application; generating a graph based on the collected user activity data, the generated graph including a plurality of nodes and a plurality of connections linking the nodes, wherein each of the plurality of nodes represents a corresponding one of the received at least one set of user requests, and each of the plurality of connections represents a user-navigable path between a pair of corresponding locations within the application; storing the generated graph; monitoring subsequent user activities related to the application remotely accessed via the network; and detecting a mismatch between the subsequent user activities and the stored graph of the collected user activity data.

[0006] From another aspect, the present invention provides a computer program product for detecting malicious activities regarding an application hosted on a server, the computer program product including a computer-readable storage medium, readable by a processing circuit and storing instructions for execution by the processing circuit to perform a method for performing the steps of the present invention.

[0007] From another aspect, the present invention provides a computer program stored on a computer-readable medium and loadable into the internal memory of a digital computer, including software code portions for performing the steps of the present invention when the program is run on the computer.

[0008] Embodiments of the present invention disclose a method, a computer system, and a computer program product for detecting malicious activities regarding an application hosted on a server. In a first aspect, the present invention may include a computer-implemented method, the method including: collecting user activity data related to an application remotely accessed via a network, generating a graph based on the collected user activity data, each node of the graph representing a set of user requests regarding a location within the application received from a user, and each connection between the nodes representing a user-navigable path between locations within the application, storing the generated graph, monitoring subsequent user activities regarding the application, and detecting any user activities that do not match the stored graph.

[0009] According to a second aspect, the present invention may include a data processing system including a processor configured to collect user activity data related to an application remotely accessed via a network, generate a graph based on the collected user activity data, where each node of the graph represents a set of user requests related to a location within the application received from the user, and each connection between the nodes represents a user-navigable path between locations within the application, store the generated graph, monitor subsequent user activity related to the application, and detect any user activity that does not match the stored graph.

[0010] According to a third aspect, the present invention may include a computer program product for controlling a data processing system including a processor. The computer program product includes a computer-readable storage medium having program instructions embodied thereon, and the program instructions are executable by a computer to cause the processor to: collect user activity data related to an application remotely accessed via a network, generate a graph based on the collected user activity data, where each node of the graph represents a set of user requests related to a location within the application received from the user, and each connection between the nodes represents a user-navigable path between locations within the application, store the generated graph, monitor subsequent user activity related to the application, and detect any user activity that does not match the stored graph. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] These and other objects, features, and advantages of the present invention will become apparent from the following detailed description of exemplary embodiments in conjunction with the accompanying drawings. The various features of the drawings are not drawn to scale as the illustrations are for clarity to assist those skilled in the art in understanding the present invention in conjunction with the detailed description. In the drawings:

[0012] Figure 1 A schematic diagram showing a user device accessing an application through a network computer environment according to at least one embodiment is shown;

[0013] Figure 2 is a schematic diagram showing the components of the device depicted in Figure 1 according to at least one embodiment;

[0014] Figure 3 A schematic diagram showing a graph of nodes and connections according to at least one embodiment is shown;

[0015] Figure 4 A flowchart of operations showing a process for performing a security check on an interaction with an application according to at least one embodiment is shown;

[0016] Figure 5 A schematic diagram showing an application and a graph according to at least one embodiment; and

[0017] Figure 6 is a schematic diagram showing according to an embodiment of the present disclosureFigure 2 Schematic diagram of the device depicted in Detailed implementation mode

[0018] Detailed embodiments of the claimed structures and methods are disclosed herein; however, it is understood that the disclosed embodiments are merely illustrative of the claimed structures and methods that may be embodied in various forms. However, the present invention may be implemented in many different forms and should not be construed as limited to the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided so that this disclosure will be thorough and complete and will fully convey the scope of the present invention to those skilled in the art. Well-known features and techniques may be omitted from the description to avoid unnecessarily obscuring the presented embodiments. The exemplary embodiments described below provide a system, method, and program product for detecting malicious activities regarding an application hosted on a server.

[0019] Referring to Figure 1 , an exemplary networked computer environment according to one embodiment is shown.

[0020] The networked computer environment may include a user device 10 that may be connected to a remote server 12 via a network 14. Communication between the device 10 and the server 12 may be through a security device 8. The device 8 may include a stand-alone device, but may also be implemented as a software component that may be installed on the server 12. As Figure 1 shown, in one embodiment, the user device 10 may include a mobile device (e.g., a smart phone), and the remote server 12 may run a mobile application 16 to which the user device 10 may be connected via the network 14. The network 14 may include wireless components, such as 4G, and wired components, such as the Internet. The user device 10 may be connected to a 4G network, and the 4G network provider may be connected to the Internet, thereby allowing the user of the user device 10 to access the Internet and applications delivered via the Internet through the user device 10. Although the user device 10 may include a smart phone, any suitable connected device, such as a computer connected via a wired network, may access the application 16 on the server 12.

[0021] In one embodiment, the user device 10 may access a mobile application such as the application 16 through an Internet browser running on the user device 10. In another embodiment, the user device 10 may access the application 16 through a dedicated application installed on the user device 10, where the dedicated application may be directly connected to the application 16. In Figure 1In the example shown, a user may use the user's smartphone 10 to access a remote banking application 16, which may provide various online banking services to the user via the application 16 running on the user's smartphone 10. For example, the user may log in to the user's bank account via the application 16 running on the user's smartphone 10 and perform operations related to the user's bank account, such as checking the current bank balance and performing bank transfers.

[0022] It will be appreciated that the secure delivery of the various services associated with the mobile application 16 to the user's smartphone 10 may be of high priority to the mobile application 16. The ability of the application 16 to perform, for example, bank transfers between the user's bank accounts may mean that such applications 16 may become targets of malicious and criminal activities. Many different techniques may be used to attempt to interfere with such an application 16. Communications routed over the Internet may always be vulnerable to interception and manipulation to change the content of the communication, or be used to form the basis for an attack on the application 16.

[0023] Now referring to Figure 2 FIG. [FIGURE NUMBER], a schematic diagram of the components of a device 8 according to at least one embodiment is shown.

[0024] In one embodiment, the device 8 may include three components: an activity monitoring component 18, a modeling engine component 20, and a security monitoring component 22. These three components may be run by a processor 24 of the device 8. In Figure 2 FIG. [FIGURE NUMBER], the activity monitoring component 18, the modeling engine component 20, and the security monitoring component 22 are depicted as separate components for illustrative purposes and to explain different functions. According to one embodiment, these three components may be implemented as part of one or the same integrated software or hardware element that can deliver security functions. The activity monitoring component 18, the modeling engine component 20, and the security monitoring component 22 may be designed to provide security for the application 16 and detect and prevent malicious and criminal activities associated with the application 16.

[0025] According to one embodiment, the activity monitoring component 18 may collect user activity logs to provide data for a behavior modeling process. Then, the modeling engine component 20 may use the data collected by the activity monitoring component 18 to generate a graph that can model the user's behavior. Next, the security monitoring component 22 may monitor subsequent user Internet activities to detect whether any user Internet activities may violate the generated model. The modeling engine component 20 may generate the user behavior model as a graph, where each node of the graph may correspond to an activity regarding a location within the application 16, and each connection between the nodes may represent a user-navigable path between locations within the application 16. In one embodiment, a location within the application 16 may be a state of the application 16 (e.g., a specific page).

[0026] As described above, the three components of device 8 (e.g., activity monitoring component 18, modeling engine component 20, and security monitoring component 22) can be implemented to generate a graph representative of normal user behavior relative to application 16, and then any user behavior that does not match the generated graph can be detected. The graph can be constructed from a dataset that includes a normalized version of the cumulative interactions that a user can have with application 16 over a long enough period of time, and the activities can be collected by activity monitoring component 18. It is expected that the weight of any malicious users of application 16 in the harvested dataset can be negligible because the vast majority of users of application 16 are likely to be legitimate users.

[0027] Modeling engine component 20 can then use the dataset collected by activity monitoring component 18 to generate a graph. In at least one embodiment, neither activity monitoring component 18 nor modeling engine component 20 interferes with the normal operation of application 16. Activity monitoring component 18 and modeling engine component 20 are transparent to application 16 that can perform normal operations without executing the two components 18 and 20.

[0028] According to one embodiment, a user using user device 10 can browse a web application or a mobile application 16, wherein whenever the user navigates a function, several requests can be sent from user device 10 to server 12 almost simultaneously. Continuing with the previous example, when a user uses smartphone 10 to make a payment through an online banking application 16, some requests, such as token verification requests, images on related pages, style sheets, and account balance information, may be sent to application server 12. In one embodiment, the request cluster can be a pseudo-atomic request. Activity monitoring component 18 can capture pseudo-atomic requests related to the current location of the user within application 16.

[0029] Then, modeling engine component 20 can use the collected historical data to analyze user traffic and model user behavior as a graph-based data structure. Once the user traffic is modeled, security monitoring component 22 can monitor and analyze subsequent user traffic based on the generated model.

[0030] Now referring to Figure 3 , a schematic diagram showing an example of a graph 26 according to at least one embodiment is shown.

[0031] In one embodiment, graph 26 can include one or more nodes 28 and one or more connections 30. Each connection 30 can connect two nodes 28 and can be a unidirectional connection or a bidirectional connection. In Figure 3 , a visual representation of graph 26 is depicted. However, the data underlying graph 26 can be represented in many other ways. Figure 3 A table 32 is also shown, which depicts various requests that can be clustered together. Although Figure 3The illustrated graph 26 includes only four nodes 28, but in one embodiment, graph 26 may include any number of nodes 28 and connections 30 associated with application 16.

[0032] Continuing with the previous example, with respect to the online banking application 16, node A may represent the home page of application 16, node B may represent the "current balance" function, and node C may represent the "transfer funds" function. Thus, Figure 3 the structure of the illustrated graph 26 may indicate that after the home page (e.g., node A), the user may directly navigate to the "transfer funds" page (e.g., node C), or may first navigate to the "current balance" page (e.g., node B). The connections 30 may represent the navigation options available to the user when navigating application 16.

[0033] Now referring to Figure 4 , an operational flowchart of an exemplary computer-implemented method for performing a security check on an interaction with application 16 according to at least one embodiment is depicted.

[0034] In step S4.1, user activity data related to the remote application is collected. The activity monitoring component 18 may collect or harvest user activity data related to application 16 remotely accessed via network 14. In one embodiment, the activity monitoring component 18 may collect the user's interaction with application 16 over a defined time period (e.g., 24 hours). The data collected may include a user activity log, which may contain requests made from user device 10 to the server 12 hosting application 16.

[0035] Then, in step S4.2, a graph is generated from the collected data. The modeling engine component 20 may generate graph 26 (see Figure 3 ) from the collected user activity data. Each node 28 of graph 26 (see Figure 3 ) may represent a set of user requests received from user device 10 related to a location within application 16. Additionally, each connection 30 between nodes 28 of graph 26 (see Figure 3 ) may represent a user-navigable path between locations within application 16. In one embodiment, the modeling engine component 20 may cluster the set of user requests received from user device 10 (as a result of the user's interaction with application 16) into pseudo-atomic requests, and then may generate a node 28 for each such cluster of pseudo-atomic requests.

[0036] Next, in step S4.3, the generated graph is stored. The processor 24 of device 8, which may perform a security check on the interaction with application 16, may locally store the generated graph 26 so that the generated graph 26 may be continuously accessed as needed / when needed. According to one embodiment, the generated graph 26 may be locally stored within device 8.

[0037] Then, in step S4.4, user activities are monitored within the application. The security monitoring component 22 can monitor subsequent user activities regarding the application 16. In one embodiment, when the application 16 continues to be used and accessed by requests to the server 12 that hosts the application 16, the security monitoring component 22 can continuously monitor user activities associated with the application 16.

[0038] Next, in step S4.5, user activities that do not match the graph are detected. The security monitoring component 22 (see Figure 2 ) can detect any user activities that do not match the stored graph 26 (see Figure 3 ). According to one embodiment, the security monitoring component 22 can detect user activities such as a cluster of requests that may not be sent to the server 12 simultaneously, requests from different clusters that may be sent to the server 12 simultaneously, and any abnormal navigation paths that may be found in the graph 26. In response to detecting any malicious activity, the security monitoring component 22 can generate an alert and can pause the detected requests for the application 16. In another embodiment, the security monitoring component 22 can trigger an alert for monitoring. When malicious activity is detected, the normal operation of the application 16 can be stopped, and the security of the application 16 can be enhanced.

[0039] Continuing the previous example, when a received set of user requests does not match any node 28 (see Figure 3 ) of the generated graph 26 (see Figure 3 ), user activities can be detected. Specifically, user requests that may form pseudo-atomic requests may not match requests that may form any cluster defined by the nodes 28. This may indicate a malicious attempt to access the application 16, and thus, the requests may be rejected. In one embodiment, all normally received requests can match the requests of the nodes 28 in the graph 26. Thus, any tampering with normal user requests or the creation of forged user requests can be detected.

[0040] According to one embodiment, if the user activity corresponds to navigation between two nodes 28 that are not directly connected by the connection 30, the user activity can be detected. In the application 16, the potential number of connections 30 between the nodes 28 may be very large. However, most nodes 28 can only be connected to a few other nodes 28. Thus, if the user activity indicates navigation between locations in the application 16 that are not connected on the graph 26, the user activity can trigger an alert.

[0041] Once the alarm is triggered, the security method can automatically take actions, for example, by stopping the application 16's response to the suspicious activity, aborting access to the user account, and sending an email alert to the administrator of the application 16. In all other aspects, the application 16 can continue to operate normally, and each component of the security process can continue to perform the corresponding component tasks. The security monitoring component 22 can continue to monitor all user activities regarding the application 16.

[0042] Now refer to Figure 5 , which depicts a schematic diagram of the application 16 including the location 34 according to at least one embodiment.

[0043] The location 34 can include a logical location within the application 16, at which the output on the user device 10 can be presented to the user and / or one or more specific actions can be performed using the user device 10. For example, the landing page or the home page of the web application 16 can be the first location 34 within the application 16.

[0044] The application 16 can also include a navigable route 36 within the application 16, which can represent the path that a user can travel downward (e.g., in a logical sense) when navigating the application 16. For example, if the user selects to access the "current balance" page from the home page, the user may have to navigate to a new location 34 within the application 16. The modeling engine component 20 can generate a graph 26 including nodes 28 and connections 30, which can correspond to the locations 34 and the route 36 of the application 16. The modeling engine component 20 can operate based on the output of the activity monitoring component 18 and may not directly access the application 16. In this way, the modeling engine component 20 may not access the application logic of the application 16 during the process of generating the graph 26.

[0045] In one embodiment, the modeling engine component 20 can determine the weighted average of the user activities at each location 34 in the application 16 and generate a node 28 for a specific location 34 in the graph 26 according to the weighted average of the user activities. The modeling engine component 20 can determine the weighted average of the user activities related to the user activities with respect to a specific location 34 (and the corresponding node 28). It can be expected that the vast majority of users of the application 16 can be legitimate users. Therefore, the weight of malicious users in the dataset can be negligible. In this way, the behavior of malicious users may not be incorporated into the graph 26, which may represent the normal behavior of normal users with respect to the application 16. The graph 26 can contain multiple nodes 28, which can represent the normal user activities at the locations 34 within the application 16.

[0046] According to one embodiment, the modeling engine component 20 may remove from the collected user activity data any data requests that can be generated independently of the user's interaction with the application 16. In this way, the modeling engine component 20 may filter out common requests that can be sent to the server 12 independently of user activity. The modeling engine component 20 may provide that the graph 26 may encode only the pseudo-atomic requests that result from the user's direct interaction with the application 16. Any background activity that may occur between the user device 10 and the application 16 on the server 12 and that is not the result of a direct user operation may not be included in the graph 26.

[0047] Now referring Figure 6 , a schematic diagram of a device 8 including a data processing system according to an embodiment of the present disclosure is shown.

[0048] The device 8 may include a processor 24 configured to control the operation of the device 8. The processor 24 of the device 8 may be connected to a local storage device 38 (e.g., for storing the generated graph 26) and a local interface 40. A computer-readable storage medium (“CD-ROM”) 42 may be provided for storing a computer program product that may be used to control the processor 24 to operate the device 8. The processor 24 may execute instructions from the computer program product to operate the device 8. The processor 24 having the modeling engine component 20 (see Figure 2 ) may generate the graph 26. Then, the processor 24 may store the generated graph 26 in the local storage device 38.

[0049] At any possible level of combination of technical details, the present invention may be a system, a method, and / or a computer program product. The computer program product may include a computer-readable storage medium having thereon computer-readable program instructions for causing a processor to implement various aspects of the present invention.

[0050] A computer-readable storage medium can be a tangible device that can hold and store instructions for use by an instruction execution device. A computer-readable storage medium may be, for example—but not limited to—an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanically encoded device, such as a punched card or raised structures in grooves having instructions stored thereon, and any suitable combination of the foregoing. The computer-readable storage medium as used herein is not construed as being a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated through a waveguide or other transmission medium (e.g., an optical pulse through an optical fiber cable), or an electrical signal transmitted through a wire.

[0051] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to respective computing / processing devices, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include a copper transmission cable, an optical fiber transmission, a wireless transmission, a router, a firewall, a switch, a gateway computer, and / or an edge server. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in each computing / processing device.

[0052] The computer program instructions for carrying out the operations of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine - related instructions, microcode, firmware instructions, state - setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages, including object - oriented programming languages such as Smalltalk, C++, etc., and procedural programming languages such as the "C" language or similar programming languages. The computer - readable program instructions may be executed entirely on the user's computer, partially on the user's computer, executed as a stand - alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or it may be connected to an external computer (e.g., via an Internet service provider through the Internet). In some embodiments, by using the state information of the computer - readable program instructions to customize an electronic circuit, such as a programmable logic circuit, a field - programmable gate array (FPGA), or a programmable logic array (PLA), the electronic circuit can execute the computer - readable program instructions to implement various aspects of the present invention.

[0053] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer - readable program instructions.

[0054] These computer - readable program instructions may be provided to a processor of a general - purpose computer, a special - purpose computer, or other programmable data - processing apparatus to produce a machine, such that the instructions, when executed by the processor of the computer or other programmable data - processing apparatus, create a means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer - readable program instructions may also be stored in a computer - readable storage medium, which causes a computer, a programmable data - processing apparatus, and / or other devices to operate in a particular manner, so that the computer - readable medium storing the instructions comprises a manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0055] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other devices to produce a computer-implemented process such that the instructions executed on the computer, other programmable data processing apparatus, or other devices implement the functions / acts specified in one or more boxes of the flowchart and / or block diagram.

[0056] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, a segment of code, or a portion of an instruction, and the module, segment of code, or portion of an instruction contains one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two consecutive blocks may in fact be executed substantially in parallel, or they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block of the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or acts, or by a combination of dedicated hardware and computer instructions.

[0057] The embodiments of the present invention have been described above. The above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The choice of terms used herein is intended to best explain the principles of the embodiments, the practical application, or the technical improvement of the technology in the market, or to enable other ordinary skilled persons in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting malicious activities regarding an application hosted on a server, the method comprising: Collecting user activity data related to an application remotely accessed via a network, wherein the collected user activity data includes at least one set of user requests received from a user, and each set of the at least one set of received user requests is associated with a corresponding location within the application; Generating a graph based on the collected user activity data, the generated graph including a plurality of nodes and a plurality of connections linking the plurality of nodes, wherein each of the plurality of nodes represents a corresponding one of the at least one set of received user requests, and each of the plurality of connections represents a user-navigable path between a pair of corresponding locations within the application; Storing the generated graph; Monitoring subsequent user activities related to the application remotely accessed via the network; and Detecting a mismatch between the subsequent user activities and the stored graph of the collected user activity data to identify the subsequent user activities as malicious activities; wherein detecting a mismatch between the subsequent user activities and the stored graph further includes: detecting subsequent user activities corresponding to a navigation between a pair of nodes not linked by one of the plurality of connections among the plurality of nodes; In response to the subsequent user activities indicating navigation between locations not connected on the graph within the application, determining the subsequent user activities as malicious activities.

2. The method according to claim 1, wherein detecting that the subsequent user activity does not match the stored graph further comprises: Detecting that a subsequently received set of user requests does not match any of the plurality of nodes of the stored graph.

3. The method according to claim 1 or 2, further comprising: Determining a weighted average of user activities for each corresponding location within the application; And Generating a corresponding node among the plurality of nodes for each corresponding location based on the weighted average of user activities.

4. The method according to claim 1 or 2, further comprising deleting data requests generated independent of the interaction between the user and the application from the collected user activity data.

5. A computer system for detecting malicious activities regarding an application hosted on a server, comprising: One or more processors, one or more computer-readable memories, one or more computer-readable tangible storage media, and program instructions stored on at least one of the one or more computer-readable tangible storage media for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method, including: Collecting user activity data related to an application remotely accessed via a network, wherein the collected user activity data includes at least one set of user requests received from a user, and each set of the at least one set of received user requests is associated with a corresponding location within the application; Generating a graph based on the collected user activity data, the generated graph including a plurality of nodes and a plurality of connections linking the plurality of nodes, wherein each of the plurality of nodes represents a corresponding one of the at least one set of received user requests, and each of the plurality of connections represents a user-navigable path between a pair of corresponding locations within the application; Storing the generated graph; Monitoring subsequent user activities related to the application remotely accessed via the network; and Detect that a subsequent user activity does not match the stored graph of the collected user activity data to determine the subsequent user activity as a malicious activity; Wherein detecting that a subsequent user activity does not match the stored graph further includes: detecting a subsequent user activity corresponding to navigation between a pair of nodes that are not linked by one of a plurality of connections among a plurality of nodes; In response to the subsequent user activity indicating navigation between positions that are not connected on the graph in the application, determine the subsequent user activity as a malicious activity.

6. The computer system according to claim 5, wherein detecting that a subsequent user activity does not match the stored graph further comprises: Detect that a subsequent received set of user requests does not match any of the plurality of nodes of the stored graph.

7. The computer system according to claim 5 or 6, further comprising: Determine a weighted average of user activities at each corresponding position within the application; And Generate a corresponding node among the plurality of nodes for each corresponding position according to the weighted average of user activities.

8. The computer system according to claim 5 or 6, further comprising deleting data requests generated independently of the interaction between the user and the application from the collected user activity data.

9. A computer program product for detecting malicious activities regarding an application hosted on a server, the computer program product comprising: Instructions for a processing circuit to execute to perform the method according to any one of claims 1 to 4.

10. A computer-readable medium having stored thereon a computer program, including software code portions, which when the computer program runs on a computer, cause the computer to execute the method according to any one of claims 1 to 4.

Images