Device, system, and method of detecting malicious automatic script and code injection

Patent metadata

Field	Value
Publication number	US-9547766-B2
Application number	US-201414325394-A
Country	US
Kind code	B2
Filing date	Jul 8, 2014
Priority date	Nov 29, 2010
Publication date	Jan 17, 2017
Grant date	Jan 17, 2017

Abstract

Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a possible attacker. The methods include monitoring of user-side input-unit interactions, in general and in response to an interference introduced to user-interface elements. The monitored interactions are used for detecting an attacker that utilizes a remote access channel; for detecting a malicious automatic script, as well as malicious code injection; to identify a particular hardware assembly; to perform user segmentation or user characterization; to enable a visual login process with implicit two-factor authentication; to enable stochastic cryptography; and to detect that multiple users are utilizing the same subscription account.

First claim

What is claimed is:

1. A method comprising:
determining whether a user, who utilizes a computing device to interact with a computerized service, (i) is a human user who operates an input unit of said computing device, or (ii) is an automatic script executed by a processor and which poses as a human user operating said input unit of said computing device;
wherein the determining comprises:
(a) at said computing device, monitoring client-side data that is actually entered manually through said input unit of said computing device;
(b) at a remote server of said computing device, receiving information that was transmitted by the computing device to said remote server, wherein said information comprises data that said computing device presents to said remote server as data that was entered manually through said input unit of said computing device;
(c) at said remote server of said computing device, further receiving from said computing device, indications of the manual operations that were actually performed by said human user through said input unit of said computing device, based on the monitoring of step (a);
(d) at said remote server, detecting a mismatch between:
(I) the indications of manual operations that were actually performed by said human user through said input unit, said indications received from the computing device in step (c)
and
(II) said information that was received from the computing device in step (b), which comprises data that said computing device presents to said remote server as data that was entered manually through said input unit of said computing device;

(e) based on the detected mismatch, determining that said automatic script was executed by said processor and posed as a human user operating said input unit of said computing device;
wherein step (d) comprises:
based on monitoring of the user-side input-unit interactions, detecting a number of keystrokes entered via a keyboard within a pre-defined time period during which the computing device transmitted data to said server of the computerized service;
determining a total number of keystrokes that a human is expected to manually enter in order to cause the computing device to transmit said data to said server of the computerized service;
based on matching between (A) the number of keystrokes entered via the keyboard, and (B) the total number of keystrokes that the human is expected to manually enter in order to cause the computing device to transmit said data to said server, determining whether the computing device is operated by automatic script executed by said processor.

2. The method of claim 1 , comprising:
based on monitoring of the user-side input-unit interactions, detecting absence of any user-side input-unit interactions within a pre-defined time period during which the computing device transmitted data to the server of the computerized service;
based on detecting absence of any user-side input-unit interactions within said pre-defined time period, determining that the computing device is operated by automatic script executed by said processor.

3. The method of claim 1 , comprising:
based on monitoring of the user-side input-unit interactions, determining that keystrokes entered via said keyboard, within a pre-defined time period during which the computing device transmitted data to said server of the computerized service, correspond to: (a) a first batch of keystrokes having a first keystrokes-length; and (b) a second batch of keystrokes having a second keystrokes-length;
determining that the data transmitted from the computing device to said server of the computerized service corresponds to: (A) a first string having a first string-length; and (B) a second string having a second string-length;
based on matching between the first keystrokes-length and the first string-length, determining whether the computing device is operated by automatic script executed by said processor.

4. The method of claim 1 , comprising:
based on monitoring of the user-side input-unit interactions, determining that keystrokes entered via said keyboard, within a pre-defined time period during which the computing device transmitted data to said server of the computerized service, correspond to: (a) a first batch of keystrokes having a first keystrokes-length; and (b) a second batch of keystrokes having a second keystrokes-length;
determining that the data transmitted from the computing device to said server of the computerized service corresponds to: (A) a first string having a first string-length; and (B) a second string having a second string-length;
wherein a total of the first and second keystrokes-length, is equal to a total of the first and second string lengths;
based on matching between the first keystrokes-length and the first string-length, determining whether the computing device is operated by automatic script executed by said processor.

5. The method of claim 1 , comprising:
monitoring time-intervals among user-side input-unit interactions;
based on said time-intervals among the user-side input-unit interactions being constant, determining that the computing device is operated by an automatic script executed by said processor.

6. The method of claim 1 , comprising:
monitoring time-intervals among user-side input-unit interactions;
modeling human user's time-intervals among the user-side input-unit interactions;
based on comparing between (A) said monitored time-intervals among the user-side input-unit interactions and (B) said modeled human user's time-intervals among the user-side input-unit interactions, determining whether the computing device is operated by an automatic script executed by said processor.

7. The method of claim 1 , comprising:
monitoring time-gaps among user-side input-unit interactions;
determining distribution of said time-gaps among the user-side input-unit interactions;
if said distribution corresponds to a pseudo-random distribution, then determining that the computing device is operated by automatic script executed by said processor.

8. The method of claim 1 , comprising:
monitoring time-gaps among user-side input-unit interactions;
storing in a database a user profile indicating that a particular human user typically types at a particular temporal pattern of typing when interacting with said computerizes service;
subsequently, determining whether a current temporal pattern of typing, reflected in a current usage session of said computing device for interacting with said computerized service, is different by at least a threshold percentage from said particular temporal pattern of typing stored in said user profile;
based on said determining, further determining whether the computing device is operated by automatic script executed by said processor.

9. The method of claim 1 , comprising:
monitoring time-gaps among user-side input-unit interactions;
storing in a database a user profile indicating that a particular human user typically types a particular sequence of multiple characters in a specific temporal pattern;
subsequently, monitoring keystrokes of current user-side input-unit interactions;
determining whether the current user-side input-unit interactions, comprise typing of said particular sequence of multiple characters, but do not comprise rapid typing of said particular sequence of multiple characters;
based on said determining, further determining whether the computing device is operated by automatic script executed by said processor.

10. The method of claim 1 , comprising:
comparing (A) meta-data about user-side input-unit interactions, with (B) meta-data about the data sent electronically from said computing device to said server of said computerized

Assignees

• Biocatch Ltd

Inventors

• Turgeman Avi
• Dekel Edo
• Novick Itai
• Lehmann Yaron
• Kadyshevitch Lev

Classifications

• G06F21/316

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• H04W12/06

  Authentication · CPC title

• G06F21/31

  User authentication · CPC title

• G06F2221/2133

  Verifying human interaction, e.g., Captcha · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title