Device, system, and method of differentiating over multiple accounts between legitimate user and cyber-attacker

• US 10,083,439 B2
• Filed: 06/26/2016
• Issued: 09/25/2018
• Est. Priority Date: 11/29/2010
• Status: Active Grant

• Current Assignee: Biocatch Ltd.
• Original Assignee: Biocatch Ltd.
• Inventors: Turgeman, Avi, Kedem, Oren
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US15/193,057
• Publication Number:
  US 20160307191A1
• Time in Patent Office: 821 Days
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: G06Q 20/308 using the Internet of Things
• CPC Class Codes: G06Q 20/321 using wearable devices
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Devices, systems, and methods of user authentication, as well as automatic differentiation between a legitimate user and a cyber-attacker. A system detects that two different accounts of the same computerized service, were accessed by a single computing device over a short period of time. The system may employ various techniques in order to determine automatically whether a legitimate user accessed the two different account, such as, a husband accessing his own bank account and shortly after that accessing also his wife'"'"'s bank account, or a payroll company accessing bank accounts of two clients for payroll management purposes. Conversely, the system is able to detect that the same user exhibited the same pattern of interactions when operating the two accounts, a pattern of interactions that does not frequently appear in the general population of legitimate users, thereby indicating that the single user is a cyber-attacker.

Claims

1. A method comprising:

(a) detecting that within a pre-defined period of time, a single user is attempting to access, via a single computing device,

a first account that belongs to a first account-owner, and a second account that belongs to a second account-owner;

(b) querying a database that stores data about real-life relationship between people, and determining existence of a real-life family linkage or a real-life business linkage, between the first account owner and the second account-owner;

(c) based on said real-life linkage, determining that said single user is a legitimate human user that is genuinely associated with each one of said accounts, and is not a cyber-attacker that is illegitimately attempting to access multiple accounts.

2. The method of claim 1, wherein the determining of step (c) is performed by generating a fraud-probability score, which indicates a probability that said single user is a cyber-attacker.

3. The method of claim 1, wherein the determining of step (c) is performed by generating a binary-type indication which indicates either:

(I) a determination that said single user is a legitimate human user that is genuinely associated with each one of said two or more accounts, or (II) a determination that said single user is a cyber-attacker that is illegitimately attempting to access multiple accounts.

4. The method of claim 1, wherein,

if the generated linkage score value that indicates the strength of real-life linkage between the first account owner and the second account-owner, is greater than a pre-defined threshold value, then determining that said single user is a legitimate human user that is genuinely associated with each one of said two or more accounts;

if the generated linkage score value that indicates the strength of real-life linkage between the first account owner and the second account-owner, is smaller than said pre-defined threshold value, then determining that said single user is a cyber-attacker that is illegitimately attempting to access multiple accounts.

5. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that the first account-owner and the second account-owner have different first-names and also have the same family-name;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

6. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that the first account-owner and the second account-owner have different first-names; and

further determining that the family-name of the first account-owner comprises (i) the family name of the second account-owner, and also (ii) an additional string;

(B) based on the two determining operations of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

7. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that the first account-owner and the second account-owner are associated with the same real-life address;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

8. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that the first account-owner and the second account-owner were previously accessed by two legitimate users from a same, single, Internet Protocol (IP) address;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

9. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that the first account-owner and the second account-owner were previously accessed by two legitimate users from a same, single, electronic device;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

10. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that the first account-owner and the second account-owner are associated with the same single employer;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

11. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that the first account-owner and the second account-owner are associated with the same single corporate entity;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

12. The method of claim 1, wherein the determining of step (c) comprises:

(A) by querying a database that stores data about real-life relationship between people, determining that there exists a family relationship between the first account-owner and the second account-owner even though the first and account-owner and the second account-owner do not have the same last-name;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

13. The method of claim 1, wherein the determining of step (c) comprises:

(A) by querying a database that stores data about real-life relationship between people, determining that the first account-owner is a spouse of the second account-owner;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

14. The method of claim 1, wherein the determining of step (c) comprises:

(A) by querying a database that stores data about real-life relationship between people, determining that the first account-owner is a parent of the second account-owner;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

15. The method of claim 1, wherein the determining of step (c) comprises:

(A) by querying a database that stores data about corporate relationship among corporate entities, determining that;

the first account-owner, who is a first corporate entity, is affiliated by a corporate relationship with the second account-owner, who is a second corporate entity;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

16. The method of claim 1, wherein the determining of step (c) comprises:

(A) by querying a database that stores data about corporate relationship among corporate entities, determining that;

the first account-owner, who is a first corporate entity, is a subsidiary of the second account-owner, who is a second corporate entity;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

17. The method of claim 1, wherein the determining of step (c) comprises:

(A) by querying a database that stores data about corporate relationship among corporate entities, determining that the same majority shareholder owns a majority interest in the first account-owner and also owns a majority interest in the second account-owner;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

18. The method of claim 1, wherein the determining of step (c) comprises:

(A) analyzing a similarity between (i) a corporate name of the first account-owner, and (ii) a corporate name of the second account-owner; and

based on said analyzing, determining that;

the first account-owner, who is a first corporate entity, is affiliated by a corporate relationship with the second account-owner, who is a second corporate entity;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

19. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that said single user accessed said first account and said second account, via the same single computing device which is associated with a funds-managing entity that manages funds for clients;

(B) determining that the first account belongs to a first client of said funds-managing entity;

(C) determining that the second account belongs to a second client of said funds-managing entity;

(D) based on the determining operations of steps (A) and (B) and (C), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

20. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that said single user accessed said first account and said second account, via the same single computing device which is associated with an accounting service provider that provides accounting services to clients;

(B) determining that the first account belongs to a first client of said accounting service provider;

(C) determining that the second account belongs to a second client of said accounting service provider;

(D) based on the determining operations of steps (A) and (B) and (C), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

21. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that said single user accessed said first account and said second account, via the same single computing device which is associated with a payroll service provider that provides payroll services to clients;

(B) determining that the first account belongs to a first client of said payroll service provider;

(C) determining that the second account belongs to a second client of said payroll service provider;

(D) based on the determining operations of steps (A) and (B) and (C), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

22. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that said single user accessed said first account and said second account, via the same single computing device which is associated with a consulting service provider that provides consulting services to clients;

(B) determining that the first account belongs to a first client of said consulting service provider;

(C) determining that the second account belongs to a second client of said consulting service provider;

(D) based on the determining operations of steps (A) and (B) and (C), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

23. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that the first account-owner is a legal custodian of the second account-owner;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

24. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that there exists a trustee-and-beneficiary relationship between the first account-owner and the second account-owner;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

25. The method of claim 1, wherein the determining of step (c) comprises:

(A) determining that the first account and the second account are currently non-linked to each other; and

further determining that the first account and the second account used to be linked to each other at a past time-point;

(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.

26. The method of claim 1, comprising:

(A) monitoring operations that said single user performs as logged-in user in said first account;

(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;

(C) monitoring operations that said single user performs as logged-in user in said second account;

(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;

(E) determining that the first pattern of operations is identical to the second pattern of operations;

(F) based on the determining of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.

27. The method of claim 1, comprising:

(A) monitoring operations that said single user performs as logged-in user in said first account;

(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;

(C) monitoring operations that said single user performs as logged-in user in said second account;

(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;

(E) determining that the first pattern of operations is similar, beyond a pre-defined level of similarity, to the second pattern of operations;

(F) based on the determining of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.

28. The method of claim 1, comprising:

(A) monitoring operations that said single user performs as logged-in user in said first account;

(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;

(C) monitoring operations that said single user performs as logged-in user in said second account;

(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;

(E) determining that the first pattern of operations is identical to the second pattern of operations, and further determining that the first account is not related to the second account;

(F) based on the determining operations of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.

29. The method of claim 1, comprising:

(A) monitoring operations that said single user performs as logged-in user in said first account;

(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;

(C) monitoring operations that said single user performs as logged-in user in said second account;

(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;

(E) determining that the first pattern of operations is similar, beyond a pre-defined level of similarity, to the second pattern of operations, and further determining that the first account is not related to the second account;

(F) based on the determining operations of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.

30. The method of claim 1, comprising:

(A) monitoring operations that said single user performs as logged-in user in said first account;

(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;

(C) monitoring operations that said single user performs as logged-in user in said second account;

(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;

(E) determining that the first pattern of operations is identical to the second pattern of operations, and further determining that the first pattern of operations is abnormal relative to a general distribution of operation patterns of a general group of users of said computerized service;

(F) based on the determining of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.

31. The method of claim 1, comprising:

(A) monitoring operations that said single user performs as logged-in user in said first account;

(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;

(C) monitoring operations that said single user performs as logged-in user in said second account;

(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;

(E) determining that the first pattern of operations is similar, beyond a pre-defined level of similarity, to the second pattern of operations, and further that the first pattern of operations is abnormal relative to a general distribution of operation patterns of a general group of users of said computerized service;

(F) based on the determining of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.

32. The method of claim 1, comprising:

(A) monitoring operations that said single user performs as logged-in user in said first account;

(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;

(C) monitoring operations that said single user performs as logged-in user in said second account;

(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;

(E) determining that the first pattern of operations is identical to the second pattern of operations, and further determining that the first account is non-related to the second account, and further determining that the first pattern of operations is abnormal relative to a general distribution of operation patterns of a general group of users of said computerized service;

(F) based on the determining of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.

33. The method of claim 1, comprising:

(A) monitoring operations that said single user performs as logged-in user in said first account; and

determining a first pattern of operations that said single user performed as logged-in user in said first account;

(B) monitoring operations that said single user performs as logged-in user in said second account; and

determining a second pattern of operations that said single user performed as logged-in user in said second account;

(C) determining that the first pattern of operations is similar, beyond a pre-defined level of similarity, to the second pattern of operations, and further determining that the first account is non-related to the second account, and further that the first pattern of operations is abnormal relative to a general distribution of operation patterns of a general group of users of said computerized service;

(D) based on the determining of step (C), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.