Malware Detection via Transaction History Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods in communication devices are limited in identifying account takeovers (ATO) involving multiple users, as they primarily focus on single-user transactions and lack consideration of historical user behavior, making them ineffective in detecting secondary user involvement through malware programs that automate payments.
Innovation Solution
A system and method that analyze a user's transaction history to determine the posterior probability of account takeover by modeling user and secondary user transactions using probabilistic analysis, employing Hawkes and Poisson processes to identify anomalies in transaction patterns, and using machine learning to predict and prevent ATOs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional malware detection methods focus on single-user transactions, then the detection process is simple, but the ability to identify account takeovers involving multiple users is limited
Solution Approach 1:
The patent segments the transaction analysis by introducing a windowing mechanism that divides the transaction stream into discrete time windows. Each window is analyzed separately to detect anomalies, allowing the system to handle multiple users effectively while maintaining manageable complexity through localized analysis rather than processing the entire transaction history at once.
Solution Approach 2:
The patent adds a temporal dimension to the detection system by analyzing transactions across multiple time windows and comparing patterns over time. This dimensional approach enables the system to distinguish between single-user and multi-user account takeovers by detecting changes in transaction patterns that conventional single-point methods would miss.
2Measurement precision
If malware detection systems analyze comprehensive transaction history, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary actions by pre-defining time windows and establishing baseline transaction patterns for each window before actual detection occurs. This preparation work is done in advance, allowing the system to quickly compare new transactions against pre-established patterns without requiring extensive real-time computation, thus reducing processing time while maintaining high detection accuracy.
Solution Approach 2:
The patent applies partial action by focusing analysis only on specific time windows where anomalies are detected, rather than continuously analyzing the entire transaction history. When no anomalies are present, the system can skip detailed analysis of certain periods, reducing overall processing time while maintaining detection effectiveness through targeted examination of suspicious periods.
3Reliability
If probabilistic analysis methods are used to model user transactions, then the ability to identify anomalies improves, but the computational complexity increases
Solution Approach 1:
The patent manages modeling complexity by changing parameters from continuous probabilistic distributions to discrete time-window-based metrics. Instead of maintaining complex continuous probability models, the system transforms the problem into analyzing discrete transaction counts and patterns within defined windows, significantly reducing computational complexity while preserving detection reliability through the windowing approach.
Data Source
AI summary
Aspects of the present disclosure involve a system and method for malware detection. The system and method introduce a probabilistic model that can observe user transaction data over a predetermined window of time. Then, using posterior probability, the system can determine whether multiple users where present during the window observed.