US 11,877,152 B2Granted

Method, device, and system of differentiating between a cyber-attacker and a legitimate user

AssigneeBiocatch Ltd.

InventorsAvi Turgeman, Oren Kedem, Uri Rivner

Life of this patent

Estimating the term…

Loading patent…

Abstract

Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. A user utilizes a desktop computer, a laptop computer, a smartphone, a tablet, or other electronic device, to interact with a banking website or application, a retailer website or application, or other computerized service. Input-unit interactions are monitored, logged, and analyzed. Based on several types of analysis of the input-unit interactions, a score is generated to reflect fraud-relatedness or attack-relatedness of the input-unit interactions. Based on the score, the system estimates or determines whether the user is an attacker, and initiates attack-mitigation operations or fraud-mitigation operations.

Claims17

Dependent claims

A system comprising:

one or more processors, that are configured to execute code;
wherein the one or more processors are operably associated with one or more memory units that are configured to store code;
wherein the one or more processors are configured to perform a process comprising:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry or for navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular average typing speed of said user in said usage session;
and if said particular average typing speed matches one or more average typing speeds that are pre-defined as average typing speeds of attackers, then increasing said attack-relatedness score of said usage session;
(c) if said attack-relatedness score of said usage session is greater than a particular threshold value, then:
determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations;
wherein the process further comprises:
defining a first field in said fillable form, as a field that users are familiar with and type data therein at a typing speed that is greater than a pre-defined value;
defining a second field in said fillable form, as a field that users are unfamiliar with and type data therein at a typing speed that is smaller than or equal to said pre-defined value;
detecting that a rate of manual data entry by said user into the first field, is generally similar to a rate of manual data entry by said user into the second field;
based on said detecting of the rate of manual data entry, determining that said user is an attacker posing as an authorized user and gaining unauthorized access to the computerized service.

11 more elements

A system comprising:

one or more processors, that are configured to execute code;
wherein the one or more processors are operably associated with one or more memory units that are configured to store code;
wherein the one or more processors are configured to perform a process comprising:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry or for navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular average typing speed of said user in said usage session;
and if said particular average typing speed matches one or more average typing speeds that are pre-defined as average typing speeds of attackers, then increasing said attack-relatedness score of said usage session;
(c) if said attack-relatedness score of said usage session is greater than a particular threshold value, then:
determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations;
wherein the process further comprises:
defining a first field in said fillable form, as a field that users are familiar with and type data therein at a typing speed that is greater than a pre-defined value;
defining a second field in said fillable form, as a field that users are unfamiliar with and type data therein at a typing speed that is smaller than or equal to said pre-defined value;
detecting that said user enters data into said first field, that was defined as a field that users are familiar with, at a typing rate that is smaller than or equal to said pre-defined value;
based on said detecting that said user enters data into said first field at said typing rate, determining that said user is an attacker posing as an authorized user and gaining unauthorized access to the computerized service.

11 more elements

A system comprising:

one or more processors, that are configured to execute code;
wherein the one or more processors are operably associated with one or more memory units that are configured to store code;
wherein the one or more processors are configured to perform a process comprising:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry or for navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular average typing speed of said user in said usage session;
and if said particular average typing speed matches one or more average typing speeds that are pre-defined as average typing speeds of attackers, then increasing said attack-relatedness score of said usage session;
(c) if said attack-relatedness score of said usage session is greater than a particular threshold value, then:
determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations;
wherein the process further comprises:
defining a first field in said fillable form, as a field that users are familiar with and type data therein at a typing speed that is greater than a pre-defined value;
defining a second field in said fillable form, as a field that users are unfamiliar with and type data therein at a typing speed that is smaller than or equal to said pre-defined value;
detecting that said user enters data into said second field, that was defined as a field that users are unfamiliar with, at a typing rate that is greater than said pre-defined value;
based on said detecting that said user enters data into said second field at said typing rate, determining that said user is an attacker posing as an authorized user and gaining unauthorized access to the computerized service.

11 more elements

A system comprising:

one or more processors, that are configured to execute code;
wherein the one or more processors are operably associated with one or more memory units that are configured to store code;
wherein the one or more processors are configured to perform a process comprising:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry or for navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular average typing speed of said user in said usage session;
and if said particular average typing speed matches one or more average typing speeds that are pre-defined as average typing speeds of attackers, then increasing said attack-relatedness score of said usage session;
(c) if said attack-relatedness score of said usage session is greater than a particular threshold value, then:
determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations;
wherein the process further comprises:
generating a determination that either (I) analyzed input-unit interactions indicate that the user entered data in a first Typing-Rhythm that characterizes legitimate users, or (II) analyzed input-unit interactions indicate that the user entered data in a second Typing-Rhythm that characterizes attackers;
based on said determination, distinguishing between a legitimate user and attackers.

9 more elements

A system comprising:

one or more processors, that are configured to execute code;
wherein the one or more processors are operably associated with one or more memory units that are configured to store code;
wherein the one or more processors are configured to perform a process comprising:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry or for navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular average typing speed of said user in said usage session;
and if said particular average typing speed matches one or more average typing speeds that are pre-defined as average typing speeds of attackers, then increasing said attack-relatedness score of said usage session;
(c) if said attack-relatedness score of said usage session is greater than a particular threshold value, then:
determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations;
wherein the process further comprises:
generating a determination that either (I) analyzed input-unit interactions indicate that the user exhibits Data Familiarity, relative to data that he is entering, at a first level that is equal to or greater than a pre-defined data-familiarity threshold value;
or (II) analyzed input-unit interactions indicate that the user exhibits Data Familiarity, relative to data that he is entering, at a second level that is smaller than said pre-defined data-familiarity threshold value;
based on said determination, distinguishing between a legitimate user and attackers.

10 more elements

A system comprising:

one or more processors, that are configured to execute code;
wherein the one or more processors are operably associated with one or more memory units that are configured to store code;
wherein the one or more processors are configured to perform a process comprising:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry or for navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular average typing speed of said user in said usage session;
and if said particular average typing speed matches one or more average typing speeds that are pre-defined as average typing speeds of attackers, then increasing said attack-relatedness score of said usage session;
(c) if said attack-relatedness score of said usage session is greater than a particular threshold value, then:
determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations;
wherein the process further comprises:
generating a determination that either (I) analyzed input-unit interactions indicate that the user exhibits Application Fluency at a first level that is equal to or greater than a pre-defined Application Fluency threshold value;
or (II) analyzed input-unit interactions indicate that the user exhibits Application Fluency at a second level that is smaller than said pre-defined Application Fluency threshold value;
based on said determination, distinguishing between a legitimate user and attackers.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/814,962Filed 26 Jul 2022 · continuation
Priority: 29 Nov 2010
Published: US 2022/0369106 A117 Nov 2022
Granted: 16 Jan 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

H04W 12/06
Security arrangements; Authentication; Protecting privacy or anonymity: authentication
G06F 3/041
Arrangements for converting the position or the displacement of a member into a coded form: digitisers, e.g. for touch screens or touch pads,…
G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
G06F 21/316
User authentication: by observing the pattern of computer usage, e.g. typical user behaviour

Family

Application61/417,479Us provisional application · filed 29 Nov 2010
PCT/IL2011/000907Parent of this continuation-in-part · filed 29 Nov 2011
Application13/922,271Parent of this continuation · filed 20 Jun 2013
Application61/843,915Us provisional application · filed 9 Jul 2013
Application61/973,855Us provisional application · filed 2 Apr 2014
Application14/320,653Parent of this continuation-in-part · filed 1 Jul 2014
Application14/320,656Parent of this continuation-in-part · filed 1 Jul 2014
Application14/325,396Parent of this continuation-in-part · filed 8 Jul 2014
Application14/325,395Parent of this continuation-in-part · filed 8 Jul 2014
Application14/325,393Parent of this continuation-in-part · filed 8 Jul 2014
Application14/325,397Parent of this continuation-in-part · filed 8 Jul 2014
Application14/325,394Parent of this continuation-in-part · filed 8 Jul 2014
Application14/325,398Parent of this continuation-in-part · filed 8 Jul 2014
Application14/566,723Parent of this continuation · filed 11 Dec 2014
US 8,938,787 B2Parent of this continuation · filed 20 Jan 2015
Application14/675,764Parent of this continuation-in-part · filed 1 Apr 2015
US 9,071,969 B2Parent of this continuation · filed 30 Jun 2015
US 9,069,942 B2Parent of this continuation-in-part · filed 30 Jun 2015
US 9,275,337 B2Parent of this continuation-in-part · filed 1 Mar 2016
US 9,450,971 B2Parent of this continuation-in-part · filed 20 Sep 2016
US 9,477,826 B2Parent of this continuation-in-part · filed 25 Oct 2016
US 9,531,733 B2Parent of this continuation-in-part · filed 27 Dec 2016
US 9,547,766 B2Parent of this continuation-in-part · filed 17 Jan 2017
US 9,621,567 B2Parent of this continuation-in-part · filed 11 Apr 2017
US 9,665,703 B2Parent of this continuation-in-part · filed 30 May 2017
Application15/885,819Parent of this continuation · filed 1 Feb 2018
Application17/060,131Parent of this continuation · filed 1 Oct 2020
US 10,834,590 B2Parent of this continuation · filed 10 Nov 2020
US 2022/0369106 A1Pre-grant publication · published 17 Nov 2022
US 11,425,563 B2Parent of this continuation
Application15/885,819Parent of this continuation-in-part
Application14/675,764Parent of this continuation
Application14/566,723Parent of this continuation-in-part
Application13/877,676Parent of this continuation-in-part
Application13/922,271Parent of this continuation-in-part
US 2013/0239195 A1Published application
US 2013/0288647 A1Published application
US 2014/0317028 A1Published application
US 2014/0317726 A1Published application
US 2014/0317744 A1Published application
US 2014/0325223 A1Published application
US 2014/0325645 A1Published application
US 2014/0325646 A1Published application
US 2014/0325682 A1Published application
US 2014/0344927 A1Published application
US 2015/0094030 A1Published application
US 2015/0205957 A1Published application
US 2018/0160309 A1Published application
US 2021/0021997 A1Published application
US 11,877,152 B2This patent

From the US filing history. Foreign family members aren’t listed.