Contextual mapping of web-pages, and generation of fraud-relatedness score-values

• US 10,621,585 B2
• Filed: 06/28/2016
• Issued: 04/14/2020
• Est. Priority Date: 11/29/2010
• Status: Active Grant

• Current Assignee: Biocatch Ltd.
• Original Assignee: Biocatch Ltd.
• Inventors: Turgeman, Avi, Kedem, Oren
• Primary Examiner(s): Lagor, Alexander
• Assistant Examiner(s): Jones, William B
• Application Number:
  US15/194,593
• Publication Number:
  US 20160307201A1
• Time in Patent Office: 1,386 Days
• Field of Search: 726 1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: G06Q 20/321 using wearable devices
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Devices, systems, and methods of contextual mapping of web-page elements and other User Interface elements, for the purpose of differentiating between fraudulent transactions and legitimate transactions, or for the purpose of distinguishing between a fraudulent user and a legitimate user. User Interface elements of a website or webpage or application or other computerized service, are contextually analyzed. A first User Interface element is assigned a low fraud-relatedness score-value, since user engagement with the first User Interface element does not create a security risk or a monetary exposure. A second, different, User Interface element is assigned a high fraud-relatedness score-value, since user engagement with the second User Interface element creates a security risk or a monetary exposure. The fraud-relatedness score-values are taken into account, together with user-specific behavioral characteristics, in order to determine whether to generate a possible-fraud notification, or as part of generating a possible-fraud score for a particular set-of-operations.

Claims

1. A method comprising:

(a) automatically analyzing content of a banking or retailer website, by performing;

analyzing a log of historical transactions that are known to be fraudulent;

identifying in said log a first Graphical User Interface (GUI) element that is typically clicked by cyber-attackers as part of cyber-attacks;

identifying in said log a second Graphical User Interface (GUI) element that is typically not clicked by cyber-attackers as part of cyber-attacks;

constructing a lookup table that indicates that the first GUI element is typically clicked by cyber-attackers as part of cyber-attacks, and that further indicates that the second GUI element is typically not clicked by cyber-attackers as part of cyber-attacks;

(b) monitoring interactions of a user with said banking or retailer website via one or more input units of an end-user device, and detecting one or more user interactions that indicate a possibly-fraudulent activity based on one or more pre-defined threshold parameters;

(c) if said possibly-fraudulent activity that was detected in step (b), is a click of said user on the first GUI element, then activating a fraud-mitigation unit;

(d) if said possibly-fraudulent activity that was detected in step (b), is a click of said user on the second GUI element, then maintaining said fraud-mitigation unit deactivated;

wherein the method further comprises;

generating a security-exposure map of on-screen GUI elements of said banking or retailer website,

by generating a first indication that user-engagement with a first particular on-screen GUI element on a particular web-page of said banking or retailer website creates a potential security risk for said banking or retailer website,

and by generating a second indication that user-engagement with a second particular on-screen GUI element on said particular web-page of said banking or retailer website does not create a potential security risk for said banking or retailer website.

2. The method of claim 1, comprising:

generating said fraud-exposure map of on-screen GUI elements of said banking or retailer website,

by generating a first additional indication that user-engagement with a first particular on-screen GUI element on a specific web-page of said banking or retailer website creates a potential fraud risk for said banking or retailer website,

and by generating a second additional indication that user-engagement with a second particular on-screen GUI element on said specific web-page of said banking or retailer website does not create a potential fraud risk for said banking or retailer website.

3. The method of claim 1,

wherein web-pages of said banking or retailer website are HTML-based pages that are accessible through a web browser.

4. The method of claim 1,

wherein web-pages of said banking or retailer website are components of a native mobile application.