Device, method, and system of detecting remote access users and differentiating among users

Patent metadata

Field	Value
Publication number	US-9690915-B2
Application number	US-201514736287-A
Country	US
Kind code	B2
Filing date	Jun 11, 2015
Priority date	Nov 29, 2010
Publication date	Jun 27, 2017
Grant date	Jun 27, 2017

Abstract

Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, detecting a possible cyber-attacker, detecting a remote access user, and detecting an automated script or malware. The methods include monitoring of user-side input-unit interactions, in general and in response to an interference introduced to user-interface elements. The monitored interactions are used for detecting an attacker that utilizes a remote access channel; for detecting a malicious automatic script, as well as malicious code injection; to identify a particular hardware assembly; to perform user segmentation or user characterization; to enable a visual login process with implicit two-factor authentication; to enable stochastic cryptography; and to detect that multiple users are utilizing the same subscription account.

First claim

What is claimed is:

1. A method comprising:
determining whether a user, who utilizes a computing device to interact with a computerized service, (i) is a human user that is co-located physically near said computing device, or (ii) is a human user that is located remotely from said computing device and controlling remotely said computer device via a remote access channel;
wherein the determining comprises:
(a) monitoring interactions of the user with an input unit;
(b) based on said monitoring, determining whether said user (i) is a human user that is co-located physically at said computing device, or (ii) is a human user that is located remotely from said computing device and controlling remotely said computing device via said remote access channel.

2. The method of claim 1 , comprising:
sampling multiple interactions of said user with said input unit;
based on a frequency of said sampling, determining whether said user is (i) co-located physically at said computing device, or (ii) is located remotely from said computing device and controlling remotely said computing device via said remote access channel.

3. The method of claim 1 , comprising:
sampling multiple interactions of said user with said input unit;
based on a level-of-noise in said sampling, determining whether said user is (i) co-located physically at said computing device, or (ii) is located remotely from said computing device and controlling remotely said computing device via said remote access channel.

4. The method of claim 1 , comprising:
sampling multiple interactions of said user with said input unit;
based on a Signal to Noise Ratio (SNR) value that characterizes the sample interactions with said input unit, determining whether said user is (i) co-located physically at said computing device, or (ii) is located remotely from said computing device and controlling remotely said computing device via said remote access channel.

5. The method of claim 1 , comprising:
sampling multiple interactions of said user with a computer mouse;
if said sampling indicates generally-rough movement of the computer mouse, then, determining that said user is located remotely from said computing device and controlling remotely said computing device via said remote access channel.

6. The method of claim 1 , comprising:
sampling multiple interactions of said user with a computer mouse;
if said sampling indicates generally-linear movement of the computer mouse, then, determining that said user is located remotely from said computing device and controlling remotely said computing device via said remote access channel.

7. The method of claim 1 , comprising:
sampling multiple interactions of said user with a computer mouse;
if said sampling indicates disturbed interaction between mouse movement and mouse click events, then, determining that said user is located remotely from said computing device and controlling remotely said computing device via said remote access channel.

8. The method of claim 1 , comprising:
sampling multiple interactions of said user with a computer keyboard;
if said sampling indicates disturbed typing fluency, then, determining that said user is located remotely from said computing device and controlling remotely said computing device via said remote access channel.

9. The method of claim 1 , comprising:
sampling multiple interactions of said user with said input unit;
determining a temporal pattern of said multiple interactions of said user with said input unit;
if the temporal pattern of said multiple interactions matches a particular pre-defined temporal pattern, then, determining that said user is located remotely from said computing device and controlling remotely said computing device via said remote access channel;
if the temporal pattern of said multiple interactions does not match said particular pre-defined temporal pattern, then, determining that said user is co-located physically near said computing device.

10. The method of claim 1 , comprising:
sampling multiple interactions of said user with said input unit;
determining a temporal pattern of said multiple interactions of said user with said input unit;
if a temporal pattern of said multiple interactions matches a first pre-defined temporal pattern that characterizes remote access, then, determining that said user is located remotely from said computing device and controlling remotely said computing device via said remote access channel;
if the temporal pattern of said multiple interactions matches a second pre-defined temporal pattern that characterizes non-remote access, then, determining that said user is co-located physically near said computing device;
if the temporal pattern of said multiple interactions is does not match the first pre-defined temporal pattern and does not match the second pre-defined temporal pattern, then, determining that said sampling is inconclusive with regard to detecting whether the user is a remote user or a non-remote user.

11. The method of claim 1 , comprising:
sampling multiple interactions of said user with said input unit;
if a frequency of said multiple interactions is smaller than a particular pre-defined threshold, then, determining that said user is located remotely from said computing device and controlling remotely said computing device via said remote access channel;
if the frequency of said multiple interactions is equal to or greater than said particular pre-defined threshold, then, determining that said user is co-located physically near said computing device.

12. The method of claim 1 , comprising:
sampling multiple interactions of said user with said input unit;
if a frequency of said multiple interactions is smaller than a first pre-defined threshold, then, determining that said user is located remotely from said computing device and controlling remotely said computing device via said remote access channel;
if the frequency of said multiple interactions is equal to or greater than a second pre-defined threshold, which is greater than the first pre-defined threshold, then, determining that said user is co-located physically near said computing device;
if the frequency of said multiple interactions is equal to or greater than the first pre-defined threshold, and if the frequency of said multiple interactions is equal to or smaller than the second pre-defined threshold, then, determining that said sampling is inconclusive with regard to detecting whether the user is a remote user or a non-remote user.

13. The method of claim 1 , comprising:
sampling user interactions with an input unit of said computing device;
based on said sampling, determining that said user is utilizing a first set of hardware components which is capable of sampling the input unit at a first frequency;
subsequently, (A) sampling additional, subsequent user interactions; (B) determining that a second, different, frequency characterizes said subsequent sampling; (C) determining that a second, different, set of hardware components is being used; (D) determining that a non-authorized person is accessing said computerized service.

14. The method of claim 1 , wherein said computing device comprises at least a touch-screen and a motion sensor; wherein the method comprises:
sampling user interactions with said input unit of said computing device;
analyzing temporal relationship between touch events and motion sensor events, of sampled user interactions via said input unit of said computing device;
based on analysis of temporal relationship between touch events and motion sensor events, of sampled user interactions via said input unit of said

Assignees

• Biocatch Ltd

Inventors

• Turgeman Avi
• Novick Itai

Classifications

• H04L63/126

  the source of the received data · CPC title

• G06F2221/2133

  Verifying human interaction, e.g., Captcha · CPC title

• G01R29/26

  Measuring noise figure; Measuring signal-to-noise ratio · CPC title

• G06F21/316 Primary

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title