Detecting unexpected behavior

Abstract

Disclosed are various embodiments for detecting unexpected behavior. A path associated with a user is tracked. It is determined whether the path corresponds to at least one intent grouping that in turn corresponds to an expected behavior. Unexpected behavior is identified when the path does not correspond to at least one intent grouping.

1 . (canceled) 
     
     
         2 . A method comprising:
 generating, by at least one computing device, at least one intent grouping associated with at least one historical path followed by a plurality of users by comparing statistical measures of the at least one historical path, the at least one historical path being associated with a topology of a site;   tracking, by the at least one computing device, at least one path followed by a user, the at least one path corresponding to at least one of a content request and a location;   identifying, by the at least one computing device, at least one subsequent step associated with the at least one intent grouping;   determining, by the at least one computing device, that a subsequent step associated with the at least one path deviates from the at least one subsequent step;   identifying, by the at least one computing device, the at least one path as being associated with an unexpected behavior; and   in response to identifying the at least one path as being associated with an unexpected behavior, generating, by the at least one computing device, at least one of a remedial measure and a preventative measure.   
     
     
         3 . The method of  claim 2 , wherein the at least one of the remedial measure and the preventative measure is at least one of raising a fraud risk measure associated with a user corresponding to the at least one path, diverting content requests associated with the at least one path to at least one alternative computing device, or initiating additional monitoring of the at least one path. 
     
     
         4 . The method of  claim 2 , wherein comparing statistical measures of the at least one historical path comprises calculating, by the at least one computing device, a percentage of common content requests associated with the at least one historical path. 
     
     
         5 . The method of  claim 2 , further comprising identifying, by the at least one computing device, a starting point associated with the at least one path. 
     
     
         6 . The method of  claim 2 , wherein the at least one historical path comprises content request information and wherein the subsequent step comprises at least one of a hyperlink, visiting a product detail page, or completing a purchasing checkout workflow. 
     
     
         7 . A system, comprising:
 at least one computing device; and   a plurality of computer instructions executable by the at least one computing device, wherein the plurality of computer instructions cause the at least one computing device to at least:
 generate at least one intent grouping associated with at least one historical path followed by a plurality of users by comparing statistical measures of the least one historical path, the at least one historical path being associated with a topology of a site; 
 track at least one path followed by a user, the at least one path corresponding to at least one of a content request and a location; 
 determine whether the at least one path does not correspond to the at least one intent grouping; 
 identify the at least one path as being associated with an unexpected behavior; and 
 in response to identifying the at least one path as being associated with an unexpected behavior, generate at least one of a remedial measure and a preventative measure. 
   
     
     
         8 . The system of  claim 7 , wherein comparing statistical measures of the at least one historical path comprises calculating a percentage of similar locations visited along the at least one historical path by the plurality of users. 
     
     
         9 . The system of  claim 7 , wherein comparing statistical measures of the at least one historical path comprises comparing a time that each of the plurality of users spends at a particular location associated with the at least one historical path. 
     
     
         10 . The system of  claim 7 , wherein the plurality of computer instructions further causes the at least one computing device to at least:
 identify a plurality of paths corresponding to the at least one path; and   determine that a statistically unlikely percentage of users corresponding to the plurality of paths deviate from the at least one intent grouping.   
     
     
         11 . The system of  claim 7 , wherein the plurality of computer instructions further causes the at least one computing device to at least:
 identify a starting point associated with the at least one path;   identify at least one subsequent step associated with the at least one intent grouping;   timestamp the at least one subsequent step associated with the at least one intent grouping; and   identify the at least one path as being associated with the unexpected behavior based at least in part upon the timestamp.   
     
     
         12 . The system of  claim 7 , wherein the plurality of computer instructions further causes the at least one computing device to at least raise a fraud risk measure associated with the user. 
     
     
         13 . The system of  claim 7 , wherein the plurality of computer instructions further causes the at least one computing device to at least prevent the user from attempting a transaction. 
     
     
         14 . The system of  claim 7 , wherein the at least one path corresponds to an attempt by the user to defraud an electronic commerce site. 
     
     
         15 . A method, comprising:
 tracking, in at least one computing device, at least one path followed by a device;   identifying, in the at least one computing device, at least one step associated with at least one intent grouping, the at least one intent grouping corresponding to an expected behavior and being associated with a plurality of historical paths followed by a plurality of other devices, the plurality of historical paths being based at least in part upon a statistical measure of path similarity and being associated with a topology of a site;   determining, in the at least one computing device, that the at least one path does not correspond to the at least one intent grouping by comparing a step associated with the at least one path to the at least one step associated with the at least one intent grouping; and   identifying, in the at least one computing device, an unexpected behavior in response to determining that the at least one path does not correspond to the at least one intent grouping.   
     
     
         16 . The method of  claim 15 , wherein the at least one intent grouping comprises at least one grouping based at least in part upon a percentage of common content requests associated with the plurality of historical paths. 
     
     
         17 . The method of  claim 15 , further comprising generating, in the at least one computing device, at least one of a remedial measure and a preventative measure in response to identifying the unexpected behavior. 
     
     
         18 . The method of  claim 17 , wherein generating the preventative measure comprises generating, in the at least one computing device, an alert that causes activity of a user associated with the device to be monitored. 
     
     
         19 . The method of  claim 15 , further comprising diverting, in the at least one computing device, content requests associated with the at least one path to at least one alternative computing device. 
     
     
         20 . The method of  claim 15 , wherein the expected behavior corresponds to a plurality of expected behaviors associated with an electronic commerce site. 
     
     
         21 . The method of  claim 14 , further comprising:
 identifying, in the at least one computing device, a starting point associated with the at least one path; and   timestamping, in the at least one computing device, the step associated with the at least one path.