# US 11,451,532 B2 · Behavioral biometrics and machine learning to secure website logins

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,532 B2
- Document ID: US11451532B2
- Status: Granted
- Kind: B2
- Application number: 16/257,650
- Filed: 2019-01-25
- Published: 2020-07-30
- Granted: 2022-09-20
- Earliest claimed: 2019-01-25
- Assignees: Dell Products L.P.
- Applicants: Dell Products L. P.
- Inventors: Falaah Arif Khan; Sajin Kunhambu; Kalyan Chakravarthy Gangavaram
- Web page: https://patentgrep.com/patent/US11451532B2

## CPC

- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour}
- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- G06N 3/0499: Feedforward networks
- G06N 3/08: Learning methods
- G06N 3/09: Supervised learning
- G06N 20/00: Machine learning
- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- G06N 20/20: Ensemble learning
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- H04L 63/101: {Access control lists [ACL]}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A system that uses a client's behavioral biometrics—mouse dynamics, keystrokes, and mouse click patterns—to create a Machine Learning (ML) based customized security model for each client/user to secure website log-ins. The ML model can differentiate the user of interest from an impersonator—human or non-human (robot). The model collects relevant behavioral biometric data from the client when a new account is created by the client/user on a website or when the client initially logs-in to the website. The collected biometric data are used to train an ensemble of ML-based classifiers—a Multilayer Perceptron (MLP) classifier, a Support Vector Machine (SVM) classifier, and an Adaptive Boosting (AdaBoost) classifier—in the model. The trained versions of these classifiers are polled to give an optimal prediction in real-time (while the user is logging in). As a result, real-time fraud detection can be accomplished without impacting the log-in performance of the website.

## Claims

### Claim 1

A method comprising:
receiving, by a computing system, a user-specific first dataset for a first user when the first user performs a first log-in to a website, wherein the first dataset includes the following:
coordinates of a first pointing device at each time the first pointing device is moved by the first user during the first log-in,
timestamps associated with pressing and release of each key on a first data input device by the first user during the first log-in,
timestamps of all clicks of the first pointing device by the first user from beginning to end of the first log-in, and
a key-specific code of each key being pressed by the first user on the first data input device during the first log-in;
determining, by the computing system, a total log-in time for the first user based on the beginning and end of the first log-in;
training, by the computing system, a plurality of machine learning-based classifiers in a machine learning (ML) model based on the received user-specific first dataset and on the total log-in time for rejecting a log-in attempt to the website by a second user with log-in credentials of the first user by polling and aggregating each classification generated by each classifier, wherein the second user is different from the first user; and
repeating, by the computing system, said receiving and training until each classifier in the ML model attains a corresponding pre-defined level of performance against a given performance metric, wherein the performance metric is one or more of the following:
accuracy of a classifier;
precision of a classifier; and
recall of a classifier.

### Claim 2 (depends on 1)

The method of claim 1, wherein the second user is one of the following:
a human user; and
a non-human user.

### Claim 3 (depends on 1)

The method of claim 1, wherein the log-in credentials of the first user include:
a first user-specific user name; and
a first user-specific password.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
authorizing, using the trained ML model by the computing system, the first user to log-in to the website.

### Claim 5 (depends on 1)

The method of claim 1, wherein the plurality of machine learning-based classifiers includes the following:
a Multilayer Perceptron (MLP) based classifier;
a Support Vector Machine (SVM) based classifier; and
an Adaptive Boosting (AdaBoost) based classifier.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
further receiving, by the computing system, a user-specific second dataset for the second user when the second user performs a second log-in to the website using the log-in credentials of the first user, wherein the second dataset includes at least one of the following:
coordinates of a second pointing device at each time the second pointing device is moved by the second user during the second log-in,
timestamps associated with each key on a second data input device being pressed and released by the second user during the second log-in,
timestamps of all clicks of the second pointing device by the second user from beginning to end of the second log-in, and
a key-specific code of each key being pressed by the second user on the second data input device during the second log-in; and
further training, by the computing system, the plurality of machine learning-based classifiers in the ML model based on the received user-specific second dataset for rejecting the second log-in by the second user using a most-recently trained version of the ML model.

### Claim 7 (depends on 6)

The method of claim 6, wherein the key-specific code in the first dataset and the key-specific code in the second dataset each is a key-specific American Standard Code for Information Interchange (ASCII) code.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
assigning, by the computing system, one of a plurality of pre-determined classes to each corresponding coordinate of the first pointing device associated with the movement thereof;
further assigning, by the computing system, a key-specific category corresponding to the key-specific code; and
determining, by the computing system, at least one of the following attributes of the first pointing device:
a class-specific average speed of the first pointing device in “x” direction,
a class-specific average speed of the first pointing device in “y” direction,
a class-specific average speed of the first pointing device,
a class-specific average distance covered by the first pointing device, and
a class-specific percentage of movement by the first pointing device.

### Claim 9 (depends on 1)

The method of claim 1, further comprising:
creating, by the computing system, a group of users, wherein each user in the group is authorized to log-in to the website and provides behavioral biometric data having a pre-determined level of similarity with behavioral biometric data received from other users in the group;
defining, by the computing system, a group-specific set of features based on the behavioral biometric data received from the group of users;
training, by the computing system, the plurality of machine-learning based classifiers using the group-specific set of features;
extracting, by the computing system, a user-specific set of features for the first user from the received user-specific first dataset;
analyzing, by the computing system, the user-specific set of features for the first user using the plurality of classifiers trained on the group-specific set of features;
based on the analysis of the user-specific set of features, determining, by the computing system, that the first user belongs to the group of users; and
authorizing, by the computing system, the first user to log-in to the website.

### Claim 10

A computing system comprising:
a memory storing program instructions; and
a processing unit coupled to the memory and operable to execute the program instructions, which, when executed by the processing unit, cause the computing system to:
receive a user-specific first dataset for a first user when the first user performs a first log-in to a website, wherein the first dataset includes the following:
coordinates of a first pointing device at each time the first pointing device is moved by the first user during the first log-in,
timestamps associated with pressing and release of each key on a first data input device by the first user during the first log-in,
timestamps of all clicks of the first pointing device by the first user from beginning to end of the first log-in, and
a key-specific code of each key being pressed by the first user on the first data input device during the first log-in;
determine, by the computing system, a total log-in time for the first user based on the beginning and end of the first log-in;
train a plurality of machine learning-based classifiers in a machine learning (ML) model based on the received user-specific first dataset and on the total log-in time for rejecting a log-in attempt to the website by a second user with log-in credentials of the first user by polling and aggregating each classification generated by each classifier, wherein the second user is different from the first user; and
repeat said receiving and training until each classifier in the ML model attains a corresponding pre-defined level of performance against one or more of the following performance metrics:
accuracy of a classifier;
precision of a classifier; and
recall of a classifier.

### Claim 11 (depends on 10)

The computing system of claim 10, wherein the plurality of machine learning-based classifiers includes the following:
a Multilayer Perceptron (MLP) based classifier;
a Support Vector Machine (SVM) based classifier; and
an Adaptive Boosting (AdaBoost) based classifier.

### Claim 12 (depends on 10)

The computing system of claim 10, wherein the program instructions, upon execution by the processing unit, cause the computing system to:
further receive a user-specific second dataset for the second user when the second user performs a second log-in to the website using the log-in credentials of the first user, wherein the second dataset includes at least one of the following:
coordinates of a second pointing device at each time the second pointing device is moved by the second user during the second log-in,
timestamps associated with each key on a second data input device being pressed and released by the second user during the second log-in,
timestamps of all clicks of the second pointing device by the second user from beginning to end of the second log-in, and
a key-specific code of each key being pressed by the second user on the second data input device during the second log-in; and
further train the plurality of machine learning-based classifiers in the ML model based on the received user-specific second dataset for rejecting the second log-in by the second user using a most-recently trained version of the ML model.

### Claim 13 (depends on 10)

The computing system of claim 10, wherein the program instructions, upon execution by the processing unit, cause the computing system to:
assign one of a plurality of pre-determined classes to each corresponding coordinate of the first pointing device associated with the movement thereof;
further assign a key-specific category corresponding to the key-specific code; and
determine at least one of the following attributes of the first pointing device:
a class-specific average speed of the first pointing device in “x” direction,
a class-specific average speed of the first pointing device in “y” direction,
a class-specific average speed of the first pointing device,
a class-specific average distance covered by the first pointing device, and
a class-specific percentage of movement by the first pointing device.

### Claim 14 (depends on 10)

The computing system of claim 10, wherein the first dataset is collected over a period of time that is determined based on monitoring a variability of a data-entry pattern associated with the first pointing device and the first data input device of the first user.

### Claim 15

A computer program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed by a computing system to implement a method comprising:
receiving a user-specific dataset for a first user when the first user performs a log-in to a website, wherein the dataset includes the following:
coordinates of a pointing device at each time the pointing device is moved by the first user during the log-in,
timestamps associated with pressing and release of each key on a data input device by the first user during the log-in,
timestamps of all clicks of the pointing device by the first user from beginning to end of the log-in, and
a key-specific American Standard Code for Information Interchange (ASCII) code of each key being pressed by the first user on the data input device during the log-in;
determining, by the computing system, a total log-in time for the first user based on the beginning and end of the first log-in;
training a plurality of machine learning-based classifiers in a machine learning (ML) model based on the received user-specific dataset and on the total log-in time for rejecting a log-in attempt to the website by a second user with log-in credentials of the first user by polling and aggregating each classification generated by each classifier, wherein the second user is different from the first user; and
repeating said receiving and training until each classifier in the ML model attains a corresponding pre-defined level of performance against one or more of the following performance metrics:
accuracy of a classifier;
precision of a classifier; and
recall of a classifier.

### Claim 16 (depends on 15)

The computer program product of claim 15, wherein the plurality of machine learning-based classifiers includes the following:
a Multilayer Perceptron (MLP) based classifier;
a Support Vector Machine (SVM) based classifier; and
an Adaptive Boosting (AdaBoost) based classifier.

### Claim 17 (depends on 15)

The computer program product of claim 15, wherein the method further comprises:
assigning one of a plurality of pre-determined classes to each corresponding coordinate of the pointing device associated with the movement thereof;
further assigning a key-specific category corresponding to the key-specific ASCII code; and
determining at least one of the following attributes of the pointing device:
a class-specific average speed of the pointing device in “x” direction,
a class-specific average speed of the pointing device in “y” direction,
a class-specific average speed of the pointing device,
a class-specific average distance covered by the pointing device, and
a class-specific percentage of movement by the pointing device.