US 10,404,729 B2Granted

Device, method, and system of generating fraud-alerts for cyber-attacks

AssigneeBiocatch Ltd.

InventorAvi Turgeman

Life of this patent

Estimating the term…

Loading patent…

Abstract

Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. An end-user device (a desktop computer, a laptop computer, a smartphone, a tablet, or the like) interacts and communicates with a server of a computerized server (a banking website, an electronic commerce website, or the like). The interactions are monitored, tracked and logged. User Interface (UI) interferences are intentionally introduced to the communication session; and the server tracks the response or the reaction of the end-user to such communication interferences. The system determines whether the user is a legitimate human user; or a cyber-attacker posing as the legitimate human user. The system displays gauges indicating cyber fraud scores or cyber-attack threat-levels. The system extrapolates from observed fraud incidents and utilizes a rules engine to automatically search for similar fraud events and to automatically detect fraud events or cyber-attackers.

Claims11

Dependent claims

A method comprising:

(a) monitoring user interactions of a user, who utilizes a computing device to interact with a computerized service during a usage session;
(b) for each particular type of data entry method that the user utilizes during said usage session:
(b1) determining a current number of occurrences of utilization of said particular type of data entry method during said usage session, and generating output corresponding to said current number of occurrences during said usage session;
(b2) determining a ratio between (A) said current number of occurrences of utilization of said particular type of data entry method during said usage session, and (B) an average number of occurrences of utilization of said particular type of data entry method during previous usage sessions of said user;
and generating output corresponding to said ratio;
(b3) based on (i) said current number of occurrences, and (ii) said average number of occurrences during previous usage sessions of said user, determining whether said user is an authorized user or a cyber-attacker;
wherein the determining of step (b3) is performed by:
(A) determining that in the current usage session of said user, K percent of interactions with a particular user-interface element are performed via a computer mouse;
(B) determining that in previous usage sessions of said user, M percent of interactions with said particular user-interface element were performed via the computer mouse;
(C) determining that K is different than M by at least N percent, wherein N is a pre-defined threshold number of percent-points;
(D) based on the determining of step (C), determining that the current usage session is attributed to a cyber-attacker and not to the authorized user.

8 more elements

A method comprising:

(a) monitoring user interactions of a user, who utilizes a computing device to interact with a computerized service during a usage session;
(b) for each particular type of data entry method that the user utilizes during said usage session:
(b1) determining a current number of occurrences of utilization of said particular type of data entry method during said usage session, and generating output corresponding to said current number of occurrences during said usage session;
(b2) determining a ratio between (A) said current number of occurrences of utilization of said particular type of data entry method during said usage session, and (B) an average number of occurrences of utilization of said particular type of data entry method during previous usage sessions of said user;
and generating output corresponding to said ratio;
(b3) based on (i) said current number of occurrences, and (ii) said average number of occurrences during previous usage sessions of said user, determining whether said user is an authorized user or a cyber-attacker;
wherein the determining of step (b3) is performed by:
(A) defining a first data-entry method that users can utilize to engage with a particular user-interface element;
(B) defining a second, different, data-entry method that users can utilize to engage with said particular user-interface element;
(C) for a particular usage session of said user, which is being reviewed for possible fraud, comparing between:
(I) a number of times that said user utilized the first data-entry method to engage with said particular user-interface element during said particular usage session being reviewed, and (II) a number of times that said user utilized the second data-entry method to engage with said particular user-interface element during said particular usage session being reviewed.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/369,106Filed 5 Dec 2016 · continuation in part
Priority: 29 Nov 2010
Published: US 2017/0085587 A123 Mar 2017
Granted: 3 Sep 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification16 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
G06F 3/03543
With detection of two-dimensional [2D] relative movements between the device, or an operating part thereof, and a plane or surface, e.g. 2D…
G06F 3/03547
With detection of two-dimensional [2D] relative movements between the device, or an operating part thereof, and a plane or surface, e.g. 2D…
G06F 3/041
Arrangements for converting the position or the displacement of a member into a coded form: digitisers, e.g. for touch screens or touch pads,…

Family

Application61/417,479Us provisional application · filed 29 Nov 2010
PCT/IL2011/000907Parent of this continuation-in-part · filed 29 Nov 2011
Application13/922,271Parent of this continuation · filed 20 Jun 2013
Application61/843,915Us provisional application · filed 9 Jul 2013
Application61/973,855Us provisional application · filed 2 Apr 2014
Application14/320,653Parent of this continuation-in-part · filed 1 Jul 2014
Application14/320,656Parent of this continuation-in-part · filed 1 Jul 2014
Application14/325,393Parent of this continuation-in-part · filed 8 Jul 2014
Application14/325,394Parent of this continuation-in-part · filed 8 Jul 2014
Application14/325,395Parent of this continuation-in-part · filed 8 Jul 2014
Application14/325,396Parent of this continuation-in-part · filed 8 Jul 2014
Application14/325,397Parent of this continuation-in-part · filed 8 Jul 2014
Application14/325,398Parent of this continuation-in-part · filed 8 Jul 2014
Application14/566,723Parent of this continuation-in-part · filed 11 Dec 2014
Application14/675,765Parent of this continuation-in-part · filed 1 Apr 2015
US 2017/0085587 A1Pre-grant publication · published 23 Mar 2017
US 9,552,470 B2Parent of this continuation-in-part
US 9,071,969 B2Parent of this continuation-in-part
US 8,938,787 B2Parent of this continuation
Application14/566,723Parent of this continuation
Application13/877,676Parent of this continuation-in-part
US 9,069,942 B2Parent of this continuation-in-part
Application13/922,271Parent of this continuation-in-part
US 9,275,337 B2Parent of this continuation-in-part
US 9,665,703 B2Parent of this continuation-in-part
US 9,531,733 B2Parent of this continuation-in-part
US 9,547,766 B2Parent of this continuation-in-part
US 9,621,567 B2Parent of this continuation-in-part
US 9,450,971 B2Parent of this continuation-in-part
US 9,477,826 B2Parent of this continuation-in-part
US 2013/0239195 A1Published application
US 2013/0288647 A1Published application
US 2014/0317028 A1Published application
US 2014/0317726 A1Published application
US 2014/0317744 A1Published application
US 2014/0325223 A1Published application
US 2014/0325645 A1Published application
US 2014/0325646 A1Published application
US 2014/0325682 A1Published application
US 2014/0344927 A1Published application
US 2015/0094030 A1Published application
US 2015/0213246 A1Published application
US 10,404,729 B2This patent

From the US filing history. Foreign family members aren’t listed.