System, device, and method of generating and managing behavioral biometric cookies

• US 10,298,614 B2
• Filed: 09/19/2017
• Issued: 05/21/2019
• Est. Priority Date: 11/29/2010
• Status: Active Grant

• Current Assignee: Biocatch Ltd.
• Original Assignee: Biocatch Ltd.
• Inventors: Turgeman, Avi
• Primary Examiner(s): Gracia, Gary S
• Application Number:
  US15/708,155
• Publication Number:
  US 20180034850A1
• Time in Patent Office: 609 Days
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: G06F 3/041 Digitisers, e.g. for touch screens or touch pads, characterised by the transducing means
• CPC Class Codes: G06F 3/0488 using a touch-screen or digitiser, e.g. input of commands through traced gestures
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/0633 Workflow analysis
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 30/0248 Avoiding fraud
• CPC Class Codes: G06Q 30/0275 Auctions
• CPC Class Codes: G06Q 30/0277 Online advertisement
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/1408 : by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 : Denial of Service
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 12/12 : Detection or prevention of fraud

Abstract

Devices, systems, and methods of generating and managing behavioral biometric cookies. The system monitors user-interactions of a user, that are performed via an input unit of an end-user device; and extracts a set of user-specific characteristics, which are used as a behavioral profile or behavioral signature. The set of user-specific characteristics are further used as a behavioral biometric cookie data-item, allowing the system to distinguish between two human users that utilize the same electronic device; and allowing the system to distinguish between a human user and an automated script. The system further allows creation and utilization of behavioral sub-cookies that distinguish among multiple users of the same device. The system also allows creation of a cross-device behavioral cookie, to track browsing or usage history of a single user across multiple electronic devices.

Claims

1. A method comprising:

(A) monitoring user interactions that a user performs via an input unit of an electronic device, when the user interacts through a computerized service with a remote server;

(B) extracting from the monitored user interactions, a behavioral biometric model that characterize said user interactions;

(C) generating a first behavioral cookie data-item that selectively tracks only usage history of a first particular human user of said electronic device based on behavioral attributes that are extracted from user interactions and that are unique to said first particular human user;

(D) generating a second behavioral cookie data-item that selectively tracks only usage history of a second particular human user of said electronic device based on behavioral attributes that are extracted from user interactions and are unique to said second particular human user;

(E) classifying a usage session that is performed via said electronic device, as belonging either to the first particular human user or to the second particular human user, based on user-specific behavioral attributes that are extracted from current user interactions via the input unit of said electronic device,

wherein the behavioral cookie data-item comprises at least a Global Unique Identifier (GUID) able to track a user, based on behavioral attributes, across multiple different devices, and across multiple different browsers, and across multiple different Internet Protocol (IP) addresses.

2. The method of claim 1, wherein a behavioral cookie data-item, that is generated in step (C) or in step (D), is generated by performing:

(aa) storing in a remote database, that is external to said electronic device, a record indicating (i) the extracted behavioral biometric model of said user, and (ii) a unique identifier;

(bb) generating, and storing internally within said electronic device, a behavioral biometric cookie data-item that reflects an association between;

(I) said user, and (II) said record reflecting the extracted behavioral biometric model that is stored in said remote database.

3. The method of claim 1, further comprising:

in a subsequent usage session,

monitoring fresh user interactions of a current user,

extracting from the fresh user interactions a fresh behavioral biometric model,

matching between the fresh behavioral model and a particular previously-created behavioral biometric cookie data-item,

determining that the current user who performed the fresh user interactions, is the same human user as the user that previously performed interactions associated with said particular previously-created behavioral biometric cookie data-item.

4. The method of claim 1, comprising:

based on said behavioral cookie data-item, differentiating between;

(i) a first human user who utilizes said electronic device via a first web-browser, and (ii) a second human user who utilizes said electronic device via a second, different, web-browser.

5. The method of claim 1, comprising:

based on said behavioral cookie data-item, differentiating between;

(i) a first human user who utilizes said electronic device from a particular Internet Protocol (IP) address, and (ii) a second human user who utilizes said electronic device from said particular IP address.

6. The method of claim 1, comprising:

based on said behavioral cookie data-item, differentiating between;

(i) a human user who utilizes said electronic device, and (ii) an automated script that emulates a human user, wherein the automated script is running on said electronic device.

7. A process comprising:

(A) monitoring user interactions that a user performs via an input unit of an electronic device, when the user interacts through a computerized service with a remote server;

(B) extracting from the monitored user interactions, a behavioral biometric model that characterize said user interactions;

(C) checking whether a behavioral biometric cookie is already locally-stored within said electronic device;

(D) when the checking result of step (C) is negative, then;

(D1) monitoring fresh user interactions of a current user of said electronic device; and

extracting from the monitored fresh user interaction a current behavioral biometric model that characterizes the current user;

(D2) checking whether said current behavioral biometric model, that characterizes the current user, matches one or more previously-extracted behavioral biometric models that were previously extracted in a previous usage session having a same Internet Protocol (IP) address;

(D3) when the checking result of step (D2) is positive, then;

generating a new behavioral biometric cookie data-item, and storing it internally within the electronic device, and generating a tag that indicates that said new behavioral biometric cookie data-item reflects a continuation of a particular previously-extracted behavioral biometric model that was found to match said current behavioral biometric model,

wherein the behavioral cookie data-item comprises at least a Global Unique Identifier (GUID) able to track a user, based on behavioral attributes, across multiple different devices, and across multiple different browsers, and across multiple different Internet Protocol (IP) addresses.

8. A method comprising:

(A) monitoring user interactions that one or more users perform via one or more input units of one or more electronic devices;

(B1) extracting a first set of user-specific behavioral characteristics from user interactions that are performed via a first input unit of a first electronic device;

(B2) extracting a second set of user-specific behavioral characteristics from user interactions that are performed via a second input unit of a second electronic device;

(C) determining a match between the first and the second sets of user-specific behavioral characteristics;

(D) based on said determining of step (C), generating a cross-device behavioral cookie data-item that tracks usage history of a single user across multiple electronic devices;

(E) storing said cross-device behavioral cookie data-item on at least one of said first electronic device and said second electronic device; and

wherein the behavioral cookie data-item comprises at least a Global Unique Identifier (GUID) able to track a user, based on behavioral attributes, across multiple different devices, and across multiple different browsers, and across multiple different Internet Protocol (IP) addresses.

9. The method of claim 8, wherein a behavioral cookie data-item that is generated in step (D), is generated by performing:

(aa) storing in a remote database, that is external to said electronic device, a record indicating (i) an extracted behavioral biometric model of a user, and (ii) a unique identifier;

(bb) generating, and storing internally within said electronic device, a behavioral biometric cookie data-item that reflects an association between;

(I) said user, and (II) said record reflecting the extracted behavioral biometric model that is stored in said remote database.

10. A process comprising:

(A) monitoring user interactions that a user performs via an input unit of an electronic device, when the user interacts through a computerized service with a remote server;

(B) extracting from the monitored user interactions, a behavioral biometric model that characterizes at least the user interactions at a particular computerized service and that does not necessarily characterize user interactions at other computerized services;

(C) generating a computerized-service-specific behavioral biometric cookie data-item, that selectively tracks only usage history of a particular human within said particular computerized service based on behavioral attributes that are extracted from user interactions and that are unique to said particular human user at said particular computerized service;

(D) utilizing said computerized-service-specific behavioral biometric cookie data-item as a Global Unique Identifier (GUID) that tracks said user when said user accesses said particular computerized service, across multiple different devices and across multiple different browsers, and across multiple different Internet Protocol (IP) addresses, based on a match between;

(i) behavioral attributes that are extracted from fresh user interactions, and (ii) the behavioral biometric model that is indicated by said computerized-service-specific behavioral biometric cookie data-item.

11. The process of claim 10, further comprising:

(E) selecting a content item for serving to a user of said particular computerized service, based on usage history that was tracked by the computerized-service-specific behavioral biometric cookie data-item.