Machine-learning behavioral analysis to detect device theft and unauthorized device usage

摘要

The disclosure relates to machine-learning behavioral analysis to detect device theft and unauthorized device usage. In particular, during a training phase, an electronic device may generate a local user profile that represents observed user-specific behaviors according to a centroid sequence, wherein the local user profile may be classified into a baseline profile model that represents aggregate behaviors associated with various users over time. Accordingly, during an authentication phase, the electronic device may generate a current user profile model comprising a centroid sequence re-expressing user-specific behaviors observed over an authentication interval, wherein the current user profile model may be compared to plural baseline profile models to identify the baseline profile model closest to the current user profile model. As such, an operator change may be detected where the baseline profile model closest to the current user profile model differs from the baseline profile model in which the electronic device has membership.

主权项

1. A method for detecting unauthorized electronic device usage, comprising:
generating one or more training feature vectors that represent one or more user-specific behaviors observed on an electronic device over a predefined training period L; generating a local user profile model from the one or more training feature vectors, wherein the local user profile model re-expresses the one or more user-specific behaviors observed over the predefined training period L according to K centroids that indicate a temporal context associated therewith; transmitting, by the electronic device, the local user profile model to a server, wherein the server is configured to execute a clustering algorithm on the local user profile model transmitted from the electronic device and local user profile models transmitted from one or more other electronic devices to create plural baseline profile models; receiving, from the server, the plural baseline profile models and information indicating one of the plural baseline profile models in which the electronic device has membership; generating one or more feature vectors representing a temporal context associated with one or more user-specific behaviors observed on the electronic device, wherein the user-specific behaviors are observed from sensor data acquired on the electronic device; generating a current user profile model from the one or more feature vectors, wherein the current user profile model comprises a centroid sequence that re-expresses the temporal context associated with the one or more user-specific behaviors and a data grammar that defines one or more rules to represent patterns in the centroid sequence; comparing the current user profile model generated from the one or more feature vectors to the plural baseline profile models stored at the electronic device to identify one of the plural baseline profile models closest to the current user profile model; and detecting an operator change at the electronic device in response to determining that the baseline profile model closest to the current user profile model differs from the baseline profile model in which the electronic device has membership.