DEVICE, SYSTEM, AND METHOD OF USER SEGMENTATION

• US 20140317744A1
• Filed: 07/08/2014
• Published: 10/23/2014
• Est. Priority Date: 11/29/2010
• Status: Abandoned Application

• Current Assignee: Biocatch Ltd.
• Original Assignee: Biocatch Ltd.
• Inventors: TURGEMAN, Avi, NOVICK, Itai, LEHMANN, Yaron, KEDEM, Oren
• Application Number:
  US14/325,396
• Publication Number:
  US 20140317744A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a possible attacker. The methods include monitoring of user-side input-unit interactions, in general and in response to an interference introduced to user-interface elements. The monitored interactions are used for detecting an attacker that utilizes a remote access channel; for detecting a malicious automatic script, as well as malicious code injection; to identify a particular hardware assembly; to perform user segmentation or user characterization; to enable a visual login process with implicit two-factor authentication; to enable stochastic cryptography; and to detect that multiple users are utilizing the same subscription account.

Claims

1. A method comprising:

differentiating between (a) a first user interacting with a computerized service, and (b) a second user interacting with said computerized service,

wherein the differentiating does not rely on Internet Protocol (IP) address analysis,

wherein the differentiating does not rely on cookie files analysis;

wherein the differentiating comprises;

monitoring user-side input-unit interactions with said computerized service;

extracting from said user-side input-unit interactions a user-specific characteristic;

based on the user-specific characteristic extracted from said user-side input-unit interactions, differentiating between said first user and said second user.

2. The method of claim 1, wherein the differentiating (A) does not rely on injection of a user-interface interference to said computerized service, and (B) does not rely on user reaction to any user-interface interference.

3. The method of claim 1, wherein the extracting comprises:

extracting from said user-side input-unit interactions a user-specific characteristic which indicates at least one of;

(a) user gender;

(b) user age-range;

(c) user geographic location;

(d) user level of expertise in computer-related tasks;

(e) user anatomical characteristics.

4. The method of claim 1, comprising:

monitoring utilization of keyboard shortcuts during interactions with said computerized service;

based on the monitored utilization of keyboard shortcuts during interactions with said computerized service, determining the level of expertise of a particular user in operating computerized platforms.

5. The method of claim 1, comprising:

monitoring utilization of keyboard shortcuts during interactions with said computerized service;

based on the monitored utilization of keyboard shortcuts during interactions with said computerized service, determining whether a particular user is (a) within an age-range of 15 to 30 years old, or (b) within an age-range of 65 and greater years old.

6. The method of claim 1, comprising:

monitoring utilization of copy-and-paste operations during interactions with said computerized service;

based on the monitored utilization of copy-and-paste operations during interactions with said computerized service, determining the level of expertise of a particular user in operating computerized platforms

7. The method of claim 1, comprising:

monitoring average typing speed during interactions with said computerized service;

based on the monitored average typing speed during interactions with said computerized service, determining the level of expertise of a particular user in operating computerized platforms.

8. The method of claim 1, comprising:

monitoring average typing speed during interactions with said computerized service;

based on the monitored average typing speed during interactions with said computerized service, determining whether a particular user is an old user or a young user.

9. The method of claim 1, comprising:

monitoring user keystrokes during interactions with said computerized service;

extracting statistics of time-gaps between pairs of key-down and key-up events;

based on the extracted statistics of said time-gaps between pairs of key-down and key-up events, determining whether a particular user is a male user or a female user.

10. The method of claim 1, comprising:

monitoring keyboard interactions of a user with said computerized service;

extracting statistics of time-gaps between pairs of key-down and key-up events, for keys in different locations along the keyboard;

based on the extracted statistics of time-gaps, determining whether the fingers of a particular user are short or long.

11. The method of claim 1, comprising:

monitoring keystrokes of a first user during interactions with said computerized service;

extracting first statistics of the time-gaps between pairs of key-down and key-up events during the first user interactions with the computerized service;

monitoring keystrokes of a second user during interactions with said computerized service;

extracting second statistics of the time-gaps between pairs of key-down and key-up events during the second user interactions with the computerized service;

based on said extracted first statistics of first user and said extracted second statistics of second user, differentiating that the first user is male and that the second user is female.

12. The method of claim 1, comprising:

monitoring keyboard interactions of a first user with said computerized service;

identifying a sequence of multiple particular characters, that are entered by the first user consecutively via keyboard more rapidly than other character sequences that the first user types;

determining that said sequence of multiple characters, is more common in a particular natural language;

determining that keyboard interactions of a second user, with said computerized service, lack rapid typing of said sequence of particular characters;

based on both of said determining, differentiating between the first user and the second user.

13. The method of claim 1, comprising:

monitoring keyboard interactions of a first user with said computerized service;

identifying a sequence of multiple particular characters, that are entered by the first user consecutively via keyboard more rapidly than other character sequences that the first user types;

determining that said sequence of multiple characters, is more common for users of a particular keyboard layout that is more common at a particular geographic region;

determining that keyboard interactions of a second user, with said computerized service, lack rapid typing of said sequence of particular characters;

based on both of said determining, differentiating between the first user and the second user.

14. The method of claim 1, comprising:

sampling user-side input-unit interactions of a user with said computerized service;

performing frequency analysis of said sampled user-side input-unit interactions of a first user with said computerized service;

based on said frequency analysis, determining characteristics of a power supply of the computing device of said user;

based on determinations of characteristics of the power supply of the computing device of said user, determining that the computing device of said user is located in a particular geographic region.

15. The method of claim 1, comprising:

monitoring keyboard interactions of a first user with said computerized service;

based on characteristics of the monitored keyboard interactions, determining both (A) gender of the first user, and (B) age-range of said user;

based on the determined gender and age-range of said first user, displaying to said first user tailored advertisement content.

16. The method of claim 1, comprising:

monitoring keyboard interactions of a first user with said computerized service;

based on characteristics of the monitored keyboard interactions, determining both (A) a natural language spoken by the first user, and (B) age-range of said user;

based on the determined natural language and age-range of said first user, displaying to said first user tailored advertisement content.

17. The method of claim 1, comprising:

monitoring user-side input-unit interactions of the first user with said computerized service;

based on characteristics of the monitored keyboard interactions and pointing device events, determining a current mood of said user;

based on the determined mood of said first user, displaying to said first user tailored content suitable for said current mood of said first user.

18. A system comprising:

a user identity determination module to differentiate between (a) a first user interacting with a computerized service, and (b) a second user interacting with said computerized service,

wherein the differentiating by the user identity determination module does not rely on Internet Protocol (IP) address analysis,

wherein the differentiating by the user identity determination module does not rely on cookie files analysis;

wherein the user identity determination module is;

to monitor user-side input-unit interactions with said computerized service;

to extract from said user-side input-unit interactions a user-specific characteristic;

based on the user-specific characteristic extracted from said user-side input-unit interactions, to differentiate between said first user and said second user.

19. The system of claim 18, comprising:

a user expertise estimator module (A) to monitor utilization of keyboard shortcuts during interactions with said computerized service, and (B) based on the monitored utilization of keyboard shortcuts during interactions with said computerized service, determining the level of expertise of a particular user in operating computerized platforms.

20. The system of claim 18, comprising:

a user gender estimator module (a) to monitor user keystrokes during interactions with said computerized service, (b) to extract statistics of time-gaps between pairs of key-down and key-up events, and (c) based on the extracted statistics of said time-gaps between pairs of key-down and key-up events, to determine whether a particular user is a male user or a female user.