Abstract: A method includes generating a static model for classifying transactions of a designated type, the static model being trained using predefined input data corresponding to a first set of features generic to transactions of the designated type, and generating a dynamic model for classifying transactions of the designated type, the dynamic model being trained using dynamic input data corresponding to a second set of features specific to subsets of transactions of the designated type. The method also includes combining the static and dynamic models to generate a combined model, detecting transactions of the designated type between client devices and an enterprise system, and utilizing the combined model to classify a given detected transaction between a given client device and the enterprise system as potentially malicious or benign. The method further includes modifying processing of the given detected transaction responsive to classifying the given detected transaction as potentially malicious.

Abstract: A method includes generating a static model for classifying transactions of a designated type, the static model being trained using predefined input data corresponding to a first set of features generic to transactions of the designated type, and generating a dynamic model for classifying transactions of the designated type, the dynamic model being trained using dynamic input data corresponding to a second set of features specific to subsets of transactions of the designated type. The method also includes combining the static and dynamic models to generate a combined model, detecting transactions of the designated type between client devices and an enterprise system, and utilizing the combined model to classify a given detected transaction between a given client device and the enterprise system as potentially malicious or benign. The method further includes modifying processing of the given detected transaction responsive to classifying the given detected transaction as potentially malicious.

Abstract: There is disclosed a technique for use in authentication. The technique comprises receiving an authentication request. The technique also comprises evaluating an attribute associated with the implementation of the authentication request. The attribute is evaluated with respect to at least one available authentication method. The technique also comprises selecting an available authentication method suitable for use in authentication based on the said evaluation.

Abstract: A technique detects mobile device emulation. The technique involves identifying, by processing circuitry, a user apparatus for mobile device emulation detection. The technique further involves collecting, by the processing circuitry, motion sensor data from the identified user apparatus (e.g., samples of accelerometer attributes, gyroscopic attributes, gravity attributes, etc. over multiple time periods). The technique further involves performing, by the processing circuitry, a motion sensor data analysis operation based on the collected motion sensor data. A result of the motion sensor data analysis operation indicates whether the identified user apparatus is a physical mobile device or an emulated mobile device.

Abstract: There is disclosed a technique for use in authentication. The technique comprises selecting an authentication challenge when an authentication request is deemed risky. An attack threat determined to be associated with the authentication request acts as a decision factor in the selection of the authentication challenge such that a biometric challenge is selected in the event that the attack threat describes a stolen device and an out-of-band challenge is selected in the event that the attack threat describes a stolen identification credential.

Abstract: A technique of performing knowledge based authentication (KBA) involves collecting activity data and time data based on operation of a mobile device, the activity data identifying an activity performed by the mobile device, and the time data identifying a time of the activity. The technique further involves generating a KBA question based on the activity data and the time data. The technique further involves providing the KBA question to a user to authenticate the user. Such a technique is capable of being performed by a remote server which communicates with the mobile device over time (e.g., in response to certain events, periodically, combinations thereof, etc.). Accordingly, the remote server is able to accumulate activity and time data which is not stored permanently (or perhaps even at all) by the mobile device, and then generate KBA questions based on that data.

Abstract: A technique performs user authentication. The technique involves generating a first usage pattern from a first set of mobile device communications performed during a first period of time. The technique further involves generating a second usage pattern from a second set of mobile device communications performed during a second period of time. The technique further involves performing a comparison between the first and second usage patterns to determine whether a human provider of the first usage pattern and a human provider of the second usage pattern are the same person. Accordingly, a malicious person who steals a mobile device or operates a mock mobile device would nevertheless be identified as different from the legitimate user because the malicious person does not behave the same way as the legitimate user (e.g., does not have the same phone call behavior, does not have the same text messaging behavior, etc.).