Banking Security Service Detecting Mass Hacking via Interaction Anomaly
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional hacker detection systems are insufficient in identifying mass hacker activities, particularly those carried out by automated means like bots, which can perform legitimate actions repeatedly, compromising user security in banking services.
Innovation Solution
A cloud-based security service that identifies attributes of user interactions, categorizes users into groups based on these attributes, calculates a degree of anomaly using TF-IDF values, and compares it with a threshold to detect mass hacking activities, distinguishing between legitimate and fraudulent actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional hacker detection systems are used, then individual hacking attempts can be detected, but mass hacker activities performed by automated bots cannot be effectively identified
Solution Approach 1:
The system segments user interactions into discrete actionable events (clicks, form submissions, navigation) and groups them into sequences. By analyzing patterns across multiple segmented interactions rather than treating each action in isolation, the system can identify mass hacking activities that individual detection systems miss.
Solution Approach 2:
The system creates a universal detection framework that handles both individual hacking attempts and mass hacker activities through a single anomaly detection mechanism. The interaction sequence analysis and anomaly scoring system works across diverse interaction types, making the detection system versatile against different hacking methodologies.
2Reliability
If digital fingerprinting is used to identify user devices, then device-level security can be maintained, but mass hacker activities from multiple devices cannot be detected
Solution Approach 1:
The system merges individual device-level fingerprinting data with aggregate interaction pattern analysis. By combining device identifiers with sequence of interaction data from multiple sources, the system can correlate activities across different devices and identify coordinated mass hacking campaigns that single-device systems cannot detect.
3Object-affected harmful factors
If security checks are performed on each interaction, then individual fraudulent actions can be blocked, but mass hacker activities can still proceed undetected
Solution Approach 1:
The system performs preliminary analysis by collecting and sequencing interaction data before making fraud determination decisions. Rather than blocking each interaction individually, the system accumulates interaction sequences and applies anomaly detection to identify mass hacking patterns, allowing legitimate transactions to proceed while blocking coordinated fraudulent activities.
Data Source
AI summary
An example of a method for detecting hacking activities includes identifying one or more attributes of each interaction in a sequence of interactions between one or more users and bank services during a predetermined time period. The one or more users are categorized into a plurality of groups based on the identified attributes. Each of the plurality of groups includes users performing the sequence of interactions with the bank services during the predetermined time period. A degree of anomaly is calculated for each of the plurality of groups based on a total number of users associated with a corresponding sequence of interactions and based on a number of users associated with the corresponding sequence of interactions during the predetermined time period. The calculated degree of anomaly is compared with a predetermined threshold. Hacking activity is identified, in response to determining that the calculated degree of anomaly exceeds the predetermined threshold.