Device, system, and method of differentiating over multiple accounts between legitimate user and cyber-attacker

Patent metadata

Field	Value
Publication number	US-2016307191-A1
Application number	US-201615193057-A
Country	US
Kind code	A1
Filing date	Jun 26, 2016
Priority date	Nov 29, 2010
Publication date	Oct 20, 2016
Grant date	—

Abstract

Devices, systems, and methods of user authentication, as well as automatic differentiation between a legitimate user and a cyber-attacker. A system detects that two different accounts of the same computerized service, were accessed by a single computing device over a short period of time. The system may employ various techniques in order to determine automatically whether a legitimate user accessed the two different account, such as, a husband accessing his own bank account and shortly after that accessing also his wife's bank account, or a payroll company accessing bank accounts of two clients for payroll management purposes. Conversely, the system is able to detect that the same user exhibited the same pattern of interactions when operating the two accounts, a pattern of interactions that does not frequently appear in the general population of legitimate users, thereby indicating that the single user is a cyber-attacker.

First claim

What is claimed is:

1 . A method comprising:
(a) detecting that within a pre-defined period of time, a single user is attempting to access, via a single computing device, two or more different accounts of a computerized service;
wherein the two or more different accounts comprise at least: a first account that belongs to a first account-owner, and a second account that belongs to a second account-owner;
(b) generating a linkage score value that indicates a strength of a real-life linkage between the first account owner and the second account-owner; (c) based on the generated linkage score value that indicates the strength of real-life linkage between the first account owner and the second account-owner, determining whether said single user is either (I) a legitimate human user that is genuinely associated with each one of said two or more accounts, or (II) a cyber-attacker that is illegitimately attempting to access multiple accounts.

2 . The method of claim 1 , wherein the determining of step (c) is performed by generating a fraud-probability score, which indicates a probability that said single user is a cyber-attacker.

3 . The method of claim 1 , wherein the determining of step (c) is performed by generating a binary-type indication which indicates either: (I) a determination that said single user is a legitimate human user that is genuinely associated with each one of said two or more accounts, or (II) a determination that said single user is a cyber-attacker that is illegitimately attempting to access multiple accounts.

4 . The method of claim 1 , wherein,
if the generated linkage score value that indicates the strength of real-life linkage between the first account owner and the second account-owner, is greater than a pre-defined threshold value, then determining that said single user is a legitimate human user that is genuinely associated with each one of said two or more accounts; if the generated linkage score value that indicates the strength of real-life linkage between the first account owner and the second account-owner, is smaller than said pre-defined threshold value, then determining that said single user is a cyber-attacker that is illegitimately attempting to access multiple accounts.

5 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner have different first-names and also have the same family-name; (B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

6 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner have different first-names; and further determining that the family-name of the first account-owner comprises (i) the family name of the second account-owner, and also (ii) an additional string; (B) based on the two determining operations of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

7 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner are associated with the same real-life address; (B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

8 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner were previously accessed by two legitimate users from a same, single, Internet Protocol (IP) address; (B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

9 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner were previously accessed by two legitimate users from a same, single, electronic device; (B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

10 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner are associated with the same single employer; (B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

11 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner are associated with the same single corporate entity; (B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

12 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) by querying a database that stores data about real-life relationship between people, determining that there exists a family relationship between the first account-owner and the second account-owner even though the first and account-owner and the second account-owner do not have the same last-name; (B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

13 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) by querying a database that stores data about real-life relationship between people, determining that the first account-owner is a spouse of the second account-owner; (B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

14 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) by querying a database that stores data about real-life relationship between people, determining that the first account-owner is a parent of the second account-owner; (B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

15 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) by querying a database that stores data about corporate relationship among corporate entities, determining that: the first account-owner, who is a first corporate entity, is affiliated by a corporate relationship with the second account-owner, who is a second corporate entity; (B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

16 . The method of claim 1 , wherein the determining of step (c) comprises:
(A) by querying a database that stores data about corporate relationship among corporate entities, determining that: the first account-owner, who is a first corporate entity, is a subsidiary of the second account-owner, who is a second corporate entity; (B) based on the determining of step (

Assignees

• Biocatch Ltd

Inventors

• Turgeman Avi
• Kedem Oren

Classifications

• G06Q20/382 Primary

  insuring higher security of transaction · CPC title

• G06Q20/40

  Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists · CPC title

• H04L2463/102

  applying security measure for e-commerce · CPC title

• H04L2463/144

  Detection or countermeasures against botnets · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title