Method, device, and system of differentiating between a cyber-attacker and a legitimate user

Patent metadata

Field	Value
Publication number	US-10834590-B2
Application number	US-201815885819-A
Country	US
Kind code	B2
Filing date	Feb 1, 2018
Priority date	Nov 29, 2010
Publication date	Nov 10, 2020
Grant date	Nov 10, 2020

Abstract

Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. A user utilizes a desktop computer, a laptop computer, a smartphone, a tablet, or other electronic device, to interact with a banking website or application, a retailer website or application, or other computerized service. Input-unit interactions are monitored, logged, and analyzed. Based on several types of analysis of the input-unit interactions, a score is generated to reflect fraud-relatedness or attack-relatedness of the input-unit interactions. Based on the score, the system estimates or determines whether the user is an attacker, and initiates attach-mitigation operations or fraud-mitigation operations.

First claim

What is claimed is:

1. A process comprising:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry and for in-page navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular typing rhythm of said user in said usage session; and if said particular typing rhythm matches one or more typing rhythms that are pre-defined as typing rhythms of attackers, then increasing said attack-relatedness score of said usage session;
wherein steps (b1) and (b2) analyze a batch of input-unit interactions which includes interactions that were performed across multiple fillable forms that were filled by said user;
wherein steps (b1) and (b2) analyze a batch of input-unit interactions which includes interactions across multiple web-pages that belong to a single usage session of said user;

(c) if said attack-relatedness score is greater than a particular threshold value, then: determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations.

2. The process of claim 1 ,
wherein steps (b1) through (b2) further analyze a batch of input-unit interactions which includes interactions that were performed within a single fillable form.

3. The process of claim 1 ,
wherein steps (b1) through (b2) analyze said batch of input-unit interactions which are interactions of a new user (I) that is not logged-in to said computerized service and (II) that is accessing said computerized service for his first time and (III) that is not associated with any pre-defined user profile derived from prior visits of said user.

4. The process of claim 1 ,
wherein steps (b1) through (b2) analyze said batch of input-unit interactions which are interactions of a user that already passed a CAPTCHA challenge and already proved to the computerized service that he is a human and not a machine.

5. The process of claim 1 ,
wherein steps (b1) through (b2) analyze said batch of input-unit interactions which are interactions of an already logged-in user that had successfully authenticated himself to the computerized service; wherein the process comprises determining that said user is an attacker even though he had successfully authenticated himself to the computerized service.

6. A non-transitory storage medium having stored thereon instructions that, when executed by one or more hardware processors, cause the one or more hardware processors to perform a method comprising:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry and for in-page navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular typing rhythm of said user in said usage session; and if said particular typing rhythm matches one or more typing rhythms that are pre-defined as typing rhythms of attackers, then increasing said attack-relatedness score of said usage session;
wherein steps (b1) and (b2) analyze a batch of input-unit interactions which includes interactions that were performed across multiple fillable forms that were filled by said user;
wherein steps (b1) and (b2) analyze a batch of input-unit interactions which includes interactions across multiple web-pages that belong to a single usage session of said user;

(c) if said attack-relatedness score is greater than a particular threshold value, then: determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations.

7. A system comprising:
one or more hardware processors, that are configured to perform:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry and for in-page navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular typing rhythm of said user in said usage session; and if said particular typing rhythm matches one or more typing rhythms that are pre-defined as typing rhythms of attackers, then increasing said attack-relatedness score of said usage session;
wherein steps (b1) and (b2) analyze a batch of input-unit interactions which includes interactions that were performed across multiple fillable forms that were filled by said user;
wherein steps (b1) and (b2) analyze a batch of input-unit interactions which includes interactions across multiple web-pages that belong to a single usage session of said user;
(c) if said attack-relatedness score is greater than a particular threshold value, then: determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations.

Assignees

• Biocatch Ltd

Inventors

• Turgeman Avi
• Kedem Oren
• Rivner Uri

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• H04M1/72403

  with means for local support of applications that increase the functionality · CPC title

• G06F21/83

  input devices, e.g. keyboards, mice or controllers thereof · CPC title

• G06F21/316

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title