A system with improved performance in detection of malicious activity in a communication network by generating and transmitting digital invalid vouchers into said communication network, comprising:
- a malicious activity detection server having a first network interface connecting the malicious activity detection server to a communication network, wherein said malicious activity detection server comprises at least one hardware processing unit and a data depository storing analysis code and for storing at least one invalid voucher:
- at least one web server having a second network interface connecting said at least one web server to said communication network, wherein said at least one web server host at least one application providing online transactions;
- and
- at least one validation server having a third network interface connecting said at least one validation server to said communication network;
- wherein said malicious activity detection server is configured to receive from said at least one web server, over said communication network credentials of a user sending a request from a client terminal via said communication network to said at least one web server, said request is for obtaining a digital voucher having a certain value using said credentials of said user and wherein said malicious activity detection server is further configured to receive from said at least one validation server, via said communication network, data denoting a context of said credentials;
- wherein said malicious activity detection server is configured to analyze said data denoting the context of the credentials by executing said analysis code which uses machine learning algorithm trained on data known to be associated with malicious activity, to determine by said analysis a risk of malicious use of the credentials and to dynamically generate and store in said data depository an invalid voucher, according to the risk determination of malicious use of the credentials, wherein the digital invalid voucher is structurally similar to a valid voucher;
- wherein said malicious activity detection server is further configured to transmit said invalid voucher to the client terminal via the communication network, in response to the request to obtain the digital voucher, instead of providing the client terminal the requested digital voucher and
- is further configured to monitor at least one interactive User Interface (UI) mechanism generated by the at least one web server and presented on the client terminal, said at least one UI mechanism allows the user who received the invalid voucher to submit an appeal, during a predefined interval of time, as a response of the user to invalidity of the digital invalid voucher during an attempt, of the user, to redeem the invalid voucher through a transaction between said client terminal and said at least one application of said at least one web server;
- wherein said malicious activity detection server is configured to transmit to said validation server, over said communication network, a message indicative of an attempt of malicious use of said credentials when said malicious activity detection server identifies that an output of each of said at least one monitored UI mechanism does not indicate that said appeal was submitted by the user within the predefined interval of time;
- and
- wherein said detection of said malicious use of the monetary credentials is performed by said malicious activity detection server without said at least one application hosted by said at least one web server and providing online transactions being aware of said detection.