Detecting deviations from typical user behavior

Abstract

Detecting deviations from typical user behavior, including: identifying a geographic location of a device that is associated with a user; determining device activity associated with the user; and detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.

What is claimed is: 
     
         1 . A method of detecting deviations from typical user behavior, the method comprising:
 determining device activity associated with the user; and   detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.   
     
     
         2 . The method of  claim 1  further comprising, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert. 
     
     
         3 . The method of  claim 1  further comprising generating the profile associated with the user. 
     
     
         4 . The method of  claim 1  wherein determining device activity associated with the user further comprises:
 identifying one or more applications accessed by the device; and 
 identifying application behavior for the one or more applications. 
 
     
     
         5 . The method of  claim 1  further comprising generating a user-specific polygraph, the user-specific polygraph including a location of the device and the device activity associated with the user. 
     
     
         6 . The method of  claim 5  wherein the user-specific polygraph includes one or more alerts. 
     
     
         7 . The method of  claim 1  wherein device activity associated with the user is continuously monitored for deviation from normal activity. 
     
     
         8 . The method of  claim 1  wherein the device activity associated with the user and the profile associated with the user include temporal information. 
     
     
         9 . The method of  claim 1  further comprising identifying a location of a device that is associated with a user. 
     
     
         10 . A system for detecting deviations from typical user behavior, the system including computer program instructions that, when executed, cause the system to carry out the steps of:
 identifying a location of a device that is associated with a user;   determining device activity associated with the user; and   detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.   
     
     
         11 . The system of  claim 10  further comprising computer program instructions that, when executed, cause the system to carry out the step of, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert. 
     
     
         12 . The system of  claim 10  further comprising computer program instructions that, when executed, cause the system to carry out the step of generating the profile associated with the user. 
     
     
         13 . The system of  claim 10  wherein determining device activity associated with the user further comprises:
 identifying one or more applications accessed by the device; and 
 identifying application behavior for the one or more applications. 
 
     
     
         14 . The system of  claim 10  further comprising computer program instructions that, when executed, cause the system to carry out the step of generating a user-specific polygraph, the user-specific polygraph including the location of the device and the device activity associated with the user. 
     
     
         15 . The system of  claim 14  wherein the user-specific polygraph includes one or more alerts. 
     
     
         16 . The system of  claim 10  wherein device activity associated with the user is continuously monitored for deviation from normal activity. 
     
     
         17 . The system of  claim 10  wherein the device activity associated with the user and the profile associated with the user include temporal information. 
     
     
         18 . A computer program product for detecting deviations from typical user behavior, the computer program product disposed on a computer readable medium, the computer program product including computer program instructions that, when executed, carry out the steps of:
 identifying a location of a device that is associated with a user;   determining device activity associated with the user; and   detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.   
     
     
         19 . The computer program product of  claim 18  further comprising computer program instructions that, when executed, carry out the step of, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert. 
     
     
         20 . The computer program product of  claim 18  further comprising computer program instructions that, when executed, carry out the step of generating a user-specific polygraph, the user-specific polygraph including the location of the device and the device activity associated with the user.