Abstract: A computing system obtains data for a transaction pertaining to access to an application. The transaction data includes a machine identifier of a machine that is associated with the transaction. The computing system determines a percentile that is assigned to the machine identifier of the transaction based on cross-user transaction data for a plurality of transactions associated with a plurality of users. The percentile represents a number of machine identifiers from the cross-user transaction data that satisfy a count threshold that is associated with the machine identifier. The computing system modifies a user-level risk evaluation of the transaction based on the percentile assigned to the machine identifier and determines whether to intervene in the transaction based on the modified risk evaluation.

Abstract: Techniques are disclosed for detecting online fraud initiated by a host infected with a malicious software application that would otherwise remain undetected by many current fraud detection systems, e.g., for detecting man-in-the-browser Trojans. A fraud detection system operates in conjunction with an IPS system to identify online transactions that have a high probability of being fraudulent or initiated by a legitimate, but compromised host.