ACTIVITY SIGNATURES AND ACTIVITY REPLAY DETECTION

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for generating activity signatures and detecting activity replays. In one aspect, a method includes accessing activity data first and second activity sequences; generating a first activity sequence signature from the first activity sequence, and generating, for each second activity sequence, a respective second activity sequence signature from the second activity sequence; for each second activity sequence, determining a similarity measure that is a measure of similarity of the first activity sequence to the second activity sequence from the signatures; for each second activity sequence having a similarity measure that meets a threshold, determining that a security violation occurred during the second user session of the second activity sequence; and for each second activity sequence having a similarity measure that does not meet the threshold, determining that a security violation did not occur during the second user session.