Method and system for automatic detection of eavesdropping of an account based on identifiers and conditions

摘要

A system and method for detecting whether a user account has been compromised. A server computer determines, for a client device, a first identifier associated with the client device. The server computer analyzes an activity log associated with an account of a user to determine if an eavesdropping condition has been met during a given duration. The analysis includes: 1) determining that an eavesdropping activity has occurred during the given duration and determining that no normal activity has occurred during the given duration for the first identifier; 2) determining a second identifier associated with a second device used to access the user account; and 3) determining that a normal activity associated with the second identifier has occurred during the given duration.

主权项

1. A method comprising:
determining, by a server computer for a client device, a first identifier associated with the client device; analyzing, by the server computer, an activity log associated with an account of a user to determine if an eavesdropping condition has been met during a given duration, the analysis comprising:
determining that an eavesdropping activity has occurred during the given duration and determining that no normal activity has occurred during the given duration for the first identifier;determining a second identifier associated with a second device used to access the user account; anddetermining that a normal activity associated with the second identifier has occurred during the given duration; and when the eavesdropping condition has been met, marking, by the server computer, the account as compromised; communicating, by the server computer, a result of the analysis.