US 12,244,619 B2
Apparatuses and methods for detecting suspicious activities through monitored online behaviors
Maisam Shahid Wasti, Union City, CA (US); Sai Sharath Japa, Carrollton, TX (US); Ana Armenta, San Jose, CA (US); and Prince Paulraj, Coppell, TX (US)
Assigned to AT&T Intellectual Property I, L.P., Atlanta, GA (US)
Filed by AT&T Intellectual Property I, L.P., Atlanta, GA (US)
Filed on Sep. 21, 2021, as Appl. No. 17/480,170.
Prior Publication US 2023/0092557 A1, Mar. 23, 2023
Int. Cl. H04L 29/06 (2006.01); G06Q 20/40 (2012.01); H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [G06Q 20/4016 (2013.01); H04L 63/083 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A device, comprising:
a processing system including a processor; and
a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, the operations comprising:
monitoring a first plurality of activities undertaken by a user via a communication device, wherein the first plurality of activities is represented by first indicators of specific actions having been taken and second indicators of a lack of activity, the specific actions having been taken including first selections made in a web browser environment and second selections made within an application, and the lack of activity including a lack of third selections having been made;
generating, based on the monitoring, respective first data for each activity of the first plurality of activities that indicates an amount of time that is spent on the activity;
generating a score for each activity of the first plurality of activities based on at least the first data, resulting in a plurality of scores, wherein each score of the plurality of scores is representative of a degree that the activity associated with the score is suspicious, and wherein each score of the plurality of scores includes a confidence factor that indicates a confidence in a probability of whether the activity is improper; and
identifying, based on the generating of the score for each activity of the first plurality of activities, an action to take when at least one score included in the plurality of scores exceeds a threshold, wherein the action comprises: decreasing a data rate of the communication device and referring the user to the police.