Emulator Detection via User Interaction Metadata Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing electronic fraud detection systems struggle to differentiate between genuine electronic devices and device emulators, as advanced emulators can mimic various parameters of electronic devices, making it difficult to detect fraudulent activities.

Innovation Solution

The system analyzes metadata from user interactions, such as touch forces, scrolling patterns, and keyboard interactions, to determine if a device is operating an emulator by comparing the data to historical models, allowing for the identification of distinct differences between direct and indirect inputs.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If configuration based indicators are used to detect emulators, then detection capability is improved, but emulator sophistication increases making detection increasingly difficult

Engineering Contradiction:
Improveemulator detection capabilityVSAvoiddetection difficulty
Core Design Contradiction:
Measurement precisionVSDifficulty of detecting and measuring

Solution Approach 1:

The patent transitions from detecting emulator characteristics in the configuration parameter space to analyzing user interaction patterns in the behavioral metadata space. By examining metadata dimensions such as touch dynamics, scrolling patterns, and input timing rather than static configuration parameters, the system detects emulators through a fundamentally different dimensional approach that bypasses emulator mimicry capabilities.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

Solution Approach 2:

The system changes the detection parameters from static configuration indicators (device models, OS versions, hardware identifiers) to dynamic behavioral parameters (touch force variations, scrolling velocity patterns, keyboard press timing). This parameter transformation allows detection of emulator-specific behavioral anomalies that cannot be replicated by configuration spoofing alone.

Inventive Principle:
Principle #35Parameter changes

2Adaptability or versatility

If emulator abilities improve to imitate device parameters, then emulator functionality is improved, but fraud detection reliability deteriorates

Engineering Contradiction:
Improveemulator functionalityVSAvoidfraud detection reliability
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The system implements feedback mechanisms by continuously monitoring user interaction patterns and comparing them against established behavioral profiles for genuine devices. The analysis of metadata feedback loops reveal inconsistencies between emulator-simulated interactions and authentic user behavior, maintaining detection reliability even as emulator functionality improves.

Inventive Principle:
Principle #23Feedback

Solution Approach 2:

The patent introduces metadata analysis as an intermediary detection layer between the device interface and the fraud detection system. This intermediary approach captures subtle behavioral characteristics of user interactions that serve as a mediator to identify emulator usage without directly confronting the emulator's parameter imitation capabilities.

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentUS11860998B2Emulator detection through user interactions
Publication Date: 2024.01.02 PAYPAL INC
  • US11860998B2 patent drawing
  • US11860998B2 patent drawing
  • US11860998B2 patent drawing

AI summary

Methods and systems are provided to determine when a first electronic device is emulating a second electronic device. The first electronic device may be operated through indirect inputs such as through a mouse and keyboard. The second electronic device may be operated through direct inputs such as inputs received through a touchscreen. Interaction data received from the first electronic device may be used to determine that the first electronic device is operating an emulator. Interaction data may include data associated with scrolling on the electronic device and such data may allow a determination that the electronic device received indirect inputs and, thus, is operating an emulator.