System, device, and method of differentiating among users based on user-specific page navigation sequence

• US 10,262,324 B2
• Filed: 04/20/2017
• Issued: 04/16/2019
• Est. Priority Date: 11/29/2010
• Status: Active Grant

• Current Assignee: Biocatch Ltd.
• Original Assignee: Biocatch Ltd.
• Inventors: Turgeman, Avi, Novick, Itai
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Le, Thanh H
• Application Number:
  US15/492,026
• Publication Number:
  US 20170221064A1
• Time in Patent Office: 726 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 3/0485 Scrolling or panning
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

Systems, devices, and methods for detecting identity of a user of a computerized service; for determining whether or not an electronic device is being used by a legitimate user; for detecting identity of a user based on navigation sequences; and for differentiating among users. The system monitors user interactions with a financial service or a retailer service, via input units, computer-mouse, keyboard, touch-screen; the system determines a unique sequence in which each users visits multiple pages, or interacts with multiple interface elements; and the system differentiates among users and flags a transaction as possibly-fraudulent.

Claims

1. A method comprising:

(A) during multiple usage sessions of multiple users with a particular computerized financial service, wherein each one of said users utilizes a pointing device and a keyboard for interacting with said particular computerized financial service, monitoring pointing device dynamics and gestures and keystrokes of each one of said users across multiple different pages of said particular computerized financial service;

(B) differentiating between (i) a legitimate user of said particular computerized financial service, and (ii) an illegitimate user of said particular computerized financial service, based on an aggregate combination of;

(I) a first unique sequence in which each user visits multiple web-pages of said particular financial computerized service, and

(II) a second unique sequence in which each user engages with multiple on-screen user interface (UI) elements within a single web-page of said particular computerized financial service;

(C) based on said differentiating, flagging a particular financial transaction of a particular user of said particular computerized financial service as possibly-fraudulent.

2. The method of claim 1, wherein the differentiating of step (B) comprises:

detecting a user-specific sequence, indicating that a particular user (i) utilizes said keyboard to perform a first particular operation in a first page of said particular computerized financial service, and then (ii) said particular user utilizes said pointing device to perform a second particular operation in a second page of said particular computerized financial service;

performing the differentiating of step (B) based on said detecting of said user-specific sequence.

3. The method of claim 1, wherein the differentiating of step (B) comprises:

detecting a user-specific sequence, indicating that a particular user (i) utilizes said pointing device to perform a first particular operation in a first page of said particular computerized financial service, and then (ii) said particular user utilizes said keyboard to perform a second particular operation in a second page of said particular computerized financial service;

performing the differentiating of step (B) based on said detecting of said user-specific sequence.

4. The method of claim 1, wherein the differentiating of step (B) comprises:

detecting a user-specific sequence in which a particular user fills-out data-items into multiple data-entry fields of a particular page of said particular computerized financial service;

performing the differentiating of step (B) based on said detecting of said user-specific sequence.

5. The method of claim 1, wherein the differentiating of step (B) comprises:

detecting a user-specific sequence in which a particular user fills-out data-items into multiple data-entry fields of a particular page of said particular computerized financial service, and further determining that said user-specific sequence indicates that said particular user fills-out data-items not in accordance with order-of-appearance of said data-entry fields in said particular page of said particular computerized financial service;

performing the differentiating of step (B) based on said detecting of said user-specific sequence and based on said determining.

6. The method of claim 1, wherein the differentiating of step (B) comprises:

detecting a user-specific sequence which indicates that it takes a particular user at least T seconds, to transition between (i) a first online operation at a first page of said particular computerized financial service, and (ii) a second online operation at a second page of said particular computerized financial service;

performing the differentiating of step (B) based on said detecting of said user-specific sequence.

7. The method of claim 1, wherein the differentiating of step (B) comprises:

detecting a user-specific sequence which indicates a user-specific manner in which said particular user alternates between utilizing said pointing device and utilizing said keyboard, across multiple pages of said particular computerized financial service;

performing the differentiating of step (B) based on said detecting of said user-specific sequence.

8. The method of claim 1, wherein the differentiating of step (B) comprises:

detecting a user-specific sequence which indicates a user-specific manner in which said particular user alternates between (i) utilizing a computer-mouse to scroll one or more pages of said particular computerized financial service, and (ii) utilizing a keyboard to scroll one or more pages of said particular computerized financial service;

performing the differentiating of step (B) based on said detecting of said user-specific sequence.

9. The method of claim 1, wherein the differentiating of step (B) comprises:

(i) detecting that in a previous usage session, a particular user utilized a touch-screen to scroll within web-pages of said particular computerized financial service;

(ii) detecting that in a current usage session, said particular user utilizes a computer-mouse or keyboard to scroll within web-pages of said particular computerized financial service;

performing the differentiating of step (B) based on said detecting of step (i) and said detecting of step (ii).

10. The method of claim 1, wherein the differentiating of step (B) comprises:

(i) detecting that in a previous usage session, a particular user utilized a touch-screen to enter data-items within web-pages of said particular computerized financial service;

(ii) detecting that in a current usage session, said particular user utilizes a physical keyboard to enter data-items within web-pages of said particular computerized financial service;

performing the differentiating of step (B) based on said detecting of step (i) and said detecting of step (ii).

11. The method of claim 1, wherein the differentiating of step (B) comprises:

(i) detecting that in a previous usage session, a particular user utilized a touch-screen to submit forms within web-pages of said particular computerized financial service;

(ii) detecting that in a current usage session, said particular user utilizes a physical keyboard to submit forms within web-pages of said particular computerized financial service;

performing the differentiating of step (B) based on said detecting of step (i) and said detecting of step (ii).

12. The method of claim 1, wherein the differentiating of step (B) comprises:

(i) detecting that in a previous usage session, a particular user utilized a computer-mouse to submit forms within web-pages of said particular computerized financial service;

(ii) detecting that in a current usage session, said particular user utilizes a physical keyboard to submit forms within web-pages of said particular computerized financial service;

performing the differentiating of step (B) based on said detecting of step (i) and said detecting of step (ii).

13. A method comprising:

(A) during multiple usage sessions of multiple users with a particular computerized financial service, wherein each one of said users utilizes a pointing device and a keyboard for interacting with said particular computerized financial service, monitoring pointing device dynamics and gestures and keystrokes of each one of said users across multiple different pages of said particular computerized financial service;

(B) differentiating between (i) a legitimate user of said particular computerized financial service, and (ii) an illegitimate user of said particular computerized financial service, based on an aggregate combination of;

(I) a unique sequence in which each user visits multiple web-pages of said particular financial computerized service, and

(II) a unique transition pattern in which each user transitions from a first on-screen component of a first web-page to a second on-screen component of a second web-page of said particular computerized financial service;

(C) based on said differentiating, flagging a particular financial transaction of a particular user of said particular computerized financial service as possibly-fraudulent.

14. A method comprising:

(A) during multiple usage sessions of multiple users with a particular computerized financial service, wherein each one of said users utilizes a pointing device and a keyboard for interacting with said particular computerized financial service, monitoring pointing device dynamics and gestures and keystrokes of each one of said users across multiple different pages of said particular computerized financial service;

(B) differentiating between (i) a legitimate user of said particular computerized financial service, and (ii) an illegitimate user of said particular computerized financial service, based on an aggregate combination of;

(I) a unique sequence in which each user engages with on-screen user interface (UI) elements within a single web-page of said particular computerized financial service, and

(II) a unique transition pattern in which each user transitions from a first on-screen component of a first web-page to a second on-screen component of a second web-page of said particular computerized financial service;

(C) based on said differentiating, flagging a particular financial transaction of a particular user of said particular computerized financial service as possibly-fraudulent.

15. A process comprising:

(A) during multiple usage sessions of multiple users with a particular online retailer service, wherein each one of said users utilizes a pointing device and a keyboard for interacting with said particular online retailer service, monitoring pointing device dynamics and gestures and keystrokes of each one of said users across multiple different pages of said particular online retailer service;

(B) differentiating between (i) a legitimate user of said particular online retailer service, and (ii) an illegitimate user of said particular online retailer service, based on an aggregate combination of;

(I) a first unique sequence in which each user visits multiple web-pages of said particular online retailer service, and

(II) a second unique sequence in which each user engages with multiple on-screen user interface (UI) elements within a single web-page of said particular online retailer service;

(C) based on said differentiating, flagging a particular financial transaction of a particular user of said particular online retailer service as possibly-fraudulent.

16. A process comprising:

(A) during multiple usage sessions of multiple users with a particular online retailer service, wherein each one of said users utilizes a pointing device and a keyboard for interacting with said particular online retailer service, monitoring pointing device dynamics and gestures and keystrokes of each one of said users across multiple different pages of said particular online retailer service;

(B) differentiating between (i) a legitimate user of said particular online retailer service, and (ii) an illegitimate user of said particular online retailer service, based on an aggregate combination of;

(I) a unique sequence in which each user visits multiple web-pages of said particular online retailer service, and

(II) a unique transition pattern in which each user transitions from a first on-screen component of a first web-page to a second on-screen component of a second web-page of said particular online retailer service;

(C) based on said differentiating, flagging a particular financial transaction of a particular user of said particular online retailer service as possibly-fraudulent.

17. A process comprising:

(A) during multiple usage sessions of multiple users with a particular online retailer service, wherein each one of said users utilizes a pointing device and a keyboard for interacting with said particular online retailer service, monitoring pointing device dynamics and gestures and keystrokes of each one of said users across multiple different pages of said particular online retailer service;

(B) differentiating between (i) a legitimate user of said particular online retailer service, and (ii) an illegitimate user of said particular online retailer service, based on an aggregate combination of;

(I) a unique sequence in which each user engages with on-screen user interface (UI) elements within a single web-page of said particular online retailer service, and

(II) a unique transition pattern in which each user transitions from a first on-screen component of a first web-page to a second on-screen component of a second web-page of said particular online retailer service;

(C) based on said differentiating, flagging a particular transaction of a particular user of said particular online retailer service as possibly-fraudulent.