Device, system, and method of differentiating among users based on detection of hardware components

Patent metadata

Field	Value
Publication number	US-2017193526-A1
Application number	US-201715456608-A
Country	US
Kind code	A1
Filing date	Mar 13, 2017
Priority date	Nov 29, 2010
Publication date	Jul 6, 2017
Grant date	—

Abstract

Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, detecting a possible attacker, and flagging a particular financial transaction or a particular retail transaction as being possibly-fraudulent. The methods include monitoring of user-side input-unit interactions, in general and in response to an interference introduced to user-interface elements. The monitored interactions are analyzed, and enable extraction of hardware-specific features of a computer mouse, a touchpad, a touch-screen, a keyboard, or other input unit. In some methods, detection of different mouse polling rates or different mouse DPI values, across two different usage sessions in the same financial account, enables the method to detect a possibly-fraudulent transaction.

First claim

What is claimed is:

1 . A method comprising:
(A) during a first usage session of a user with a particular computerized financial service, wherein the user utilizes a computing device and a mouse to interact with said particular computerized financial service, monitoring mouse data received from said mouse utilized by said user; and determining for said first usage session of said user a first mouse polling rate which indicates the number of times per second that said mouse reports its position to said computing device during said first usage session; (B) during a second, different, usage session with said particular computerized financial service, monitoring mouse data received from said mouse; and determining for said second usage session a second mouse polling rate which indicates the number of times per second that said mouse reports its position to said computing device during said second usage session; (C) detecting that the first mouse polling rate of the first usage session with said particular computerized financial service, is different from the second mouse polling rate of the second usage session with said particular computerized financial service; (D) based on steps (B) and (C), determining that said particular financial account was accessed by a first type of computer-mouse during the first usage session, and was accessed by a second, different, type of computer-mouse during the second usage session; (E) based on the determining of step (D), flagging a particular financial transaction of a particular user of said particular computerized financial service as possibly-fraudulent.

2 . The method of claim 1 , wherein the operations of steps (A) through (E) are performed without access to Operating System information that indicate which computer-mouse is being utilized in any particular usage session.

3 . The method of claim 1 , wherein the operations of steps (A) through (E) are performed by a remote server that is located remotely from said computer mice, wherein the remote server does not have access to user-side Operating System identification of a computer-mouse being used.

4 . The method of claim 1 , wherein the operations of steps (A) through (E) are performed by a Web browser module which does not have access to user-side Operating System identification of a computer-mouse being used.

5 . The method of claim 1 , wherein the determining of step (D) is performed even though a user-side Operating System reports that a same type of computer-mouse was utilized in both the first usage session and the second usage session.

6 . The method of claim 1 , wherein the determining of step (D) is further based on, at least, (I) an average distance-length of mouse-strokes that were performed during the first usage session, and (II) an average distance-length of mouse-strokes that were performed during the second usage session.

7 . The method of claim 1 , wherein the determining of step (D) is further based on, at least, (I) a longest distance-length of mouse-strokes that were performed during the first usage session, and (II) a longest distance-length of mouse-strokes that were performed during the second usage session.

8 . The method of claim 1 , wherein the determining of step (D) is further based on, at least, (I) a shortest distance-length of mouse-strokes that were performed during the first usage session, and (II) a shortest distance-length of mouse-strokes that were performed during the second usage session.

9 . The method of claim 1 , wherein the determining of step (D) is further based on, at least, (I) an average level-of-linearity of mouse-strokes that were performed during the first usage session, and (II) an average level-of-linearity of mouse-strokes that were performed during the second usage session.

10 . The method of claim 1 , wherein the determining of step (D) is further based on, at least, (I) an average level-of-curvature of mouse-strokes that were performed during the first usage session, and (II) an average level-of-curvature of mouse-strokes that were performed during the second usage session.

11 . The method of claim 1 , wherein the determining of step (D) is further based on, at least, (I) a detected Dots-Per-Inch (DPI) resolution of the computer-mouse utilized in the first usage session, and (II) a detected Dots-Per-Inch (DPI) resolution of the computer-mouse utilized in the second usage session.

12 . The method of claim 1 , wherein steps (A) through (D) are based exclusively on identification of hardware-specific characteristics of the computer-mice being utilized during the first and second usage sessions, and wherein steps (A) through (D) exclude utilization of user-specific behavioral biometric data for differentiating among two different types of computer-mice being utilized.

13 . The method of claim 1 , wherein the determining of step (D) is performed by: (i) detecting that the first usage session utilized a computer-mouse having a polling rate which is a first value selected from the group consisting of: 100 Hz, 125 Hz, 250 Hz, 500 Hz, and 1,000 Hz; (ii) detecting that the second usage session utilized a computer-mouse having a polling rate which is a second, different, value selected from said group.

14 . A method comprising:
(A) during a first usage session of a user with a particular computerized financial service, wherein the user utilizes a computing device and a mouse to interact with said particular computerized financial service, monitoring mouse data received from said mouse utilized by said user; and determining for said first usage session of said user a first mouse Dots Per Inch (DPI) hardware-based characteristic of said mouse which indicates the number of on-screen pixels that a mouse-cursor moves when the user moves said mouse by one inch during said first usage session with said particular computerized financial service; (B) during a second, different, usage session with said particular computerized financial service, monitoring mouse data received from said mouse; and determining for said second usage session a second mouse Dots Per Inch (DPI) hardware-based characteristic of said mouse which indicates the number of on-screen pixels that a mouse-cursor moves when the user moves said mouse by one inch during said second usage session with said particular computerized financial service; (C) detecting that the first mouse DPI hardware-based characteristic of the first usage session with said particular computerized financial service, is different from the second mouse DPI hardware-based characteristic of the second usage session with said particular computerized financial service; (D) based on steps (B) and (C), determining that said particular financial account was accessed by a first type of computer-mouse during the first usage session, and was accessed by a second, different, type of computer-mouse during the second usage session; (E) based on the determining of step (D), flagging a particular financial transaction of a particular user of said particular computerized financial service as possibly-fraudulent.

15 . A process comprising:
(A) monitoring computer-mouse interactions in a particular financial account of a particular user of a computerized financial service, over multiple usage sessions; (B) analyzing computer-mouse interactions of a first usage session of said particular financial account, and detecting that a longest mouse-stroke during said first usage session is longer than a pre-defined threshold value; (C) analyzing computer-mouse interactions of a second, different, usage session of said particular financial account, and det

Assignees

• Biocatch Ltd

Inventors

• Turgeman Avi
• Novick Itai

Classifications

• G06Q30/0185 Primary

  Product, service or business identity fraud · CPC title

• G06Q20/401

  Transaction verification · CPC title

• H04W12/63

  Location-dependent; Proximity-dependent · CPC title

• G06F2221/2133

  Verifying human interaction, e.g., Captcha · CPC title

• H04W12/06

  Authentication · CPC title