Device, system, and method of detecting user identity based on inter-page and intra-page navigation patterns

1. A method comprising:

(A) during multiple usage sessions of multiple users with a particular computerized financial service, wherein each one of said users utilizes a pointing device and a keyboard for interacting with said particular computerized service, monitoring pointing device dynamics and gestures and keystrokes of each one of said users across multiple different pages of said particular computerized financial service;

(B) differentiating between (i) a legitimate user of said particular computerized financial service, and (ii) an illegitimate user of said particular computerized financial service, based on an aggregate combination of:

(I) a first unique sequence in which each user visits multiple web-pages of said particular financial computerized service, and

(II) a second unique sequence in which each user engages with on-screen user interface (UI) elements within a single web-page of said particular computerized financial service, and

(III) a unique transition pattern in which each user transitions from a first on-screen component of a first web-page to a second on-screen component of a second web-page of said particular computerized financial service;

(C) based on said differentiating, flagging a particular financial transaction of a particular user of said particular computerized financial service as possibly-fraudulent.

2. The method of claim 1 , comprising:

monitoring whether said user more frequently utilizes the pointing device or the keyboard in order to perform a particular type of interaction with said particular computerized financial service;

based on said monitoring, generating a user-specific intra-application usage pattern associated with said user.

3. The method of claim 1 , comprising:

based on analysis of user interactions, determining whether (A) said user utilizes the pointing device more frequently than the keyboard in order to submit a format said particular computerized financial service;

based on said monitoring, generating a user-specific intra-application usage pattern associated with said user.

4. The method of claim 1 , comprising:

monitoring whether said user more frequently utilizes the pointing device or the keyboard in order to fill-in data in a form at said particular computerized financial service;

based on said monitoring, generating a user-specific intra-application usage pattern associated with said user.

5. The method of claim 1 , comprising:

monitoring whether said user more frequently utilizes the pointing device or the keyboard in order to move a cursor between fields at said particular computerized financial service;

based on said monitoring, generating a user-specific intra-application usage pattern associated with said user.

6. The method of claim 1 , comprising:

monitoring whether said user more frequently utilizes the pointing device or the keyboard in order to paste data into a particular field at said particular computerized financial service;

based on said monitoring, generating a user-specific intra-application usage pattern associated with said user.

7. The method of claim 1 , comprising:

monitoring whether said user more frequently (a) pastes data into a particular field at said particular computerized financial service, or (b) types data into said particular field at said particular computerized financial service;

based on said monitoring, generating a user-specific intra-application usage pattern associated with said user.

8. The method of claim 1 , comprising:

determining a user-specific inter-application usage pattern that indicates that said user, in most of its interactions with said particular computerized financial service, performs a first particular action prior to performing a second particular action;

based on said user-specific inter-application usage pattern, determining whether a subsequent user of said particular computerized financial service is the same person as said user.

9. The method of claim 1 , comprising:

determining a user-specific inter-application usage pattern that indicates that said user, in most of its interactions with said particular computerized financial service, spends a first period of time at a first particular page of said particular computerized financial service prior to spending a second period of time at a second particular page of said particular computerized financial service;

based on said user-specific inter-application usage pattern, determining whether a subsequent user of said particular computerized financial service is the same person as said user.

10. The method of claim 1 , comprising:

monitoring for each field in a said particular computerized financial service, mouse dynamics and gestures for that field;

based on said monitoring, generating a user-specific field-usage pattern associated with said user and with said financial service.

11. The method of claim 1 , comprising:

monitoring for each field in said particular computerized financial service, (a) a mouse angle of approach to the field, (b) a mouse angle of exit from the field, (c) velocities of mouse approach and mouse exit, (d) time period spent within the field, and (e) location of a mouse click event within the field;

based on said monitoring, generating a user-specific field-usage pattern associated with said user.

12. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures and based on monitored keystrokes of said user, estimating a user-specific behavioral trait of multiple-field-usage stream pattern of said user in relation to multiple fields on a particular page of said particular computerized financial service;

based on the estimated user-specific behavioral trait of multiple-field-usage stream pattern of said user, differentiating between said user and another user interacting with said particular computerized financial service.

13. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a user-specific behavioral trait corresponding to angle of approach by said user to an on-screen field of said particular computerized financial service;

based on the estimated user-specific behavioral trait of angle of approach of said user, differentiating between said user and another user interacting with said particular computerized financial service.

14. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a user-specific behavioral trait corresponding to angle of exit by said user from an on-screen field of said particular computerized financial service;

based on the estimated user-specific behavioral trait of angle of exit of said user, differentiating between said user and another user interacting with said particular computerized financial service.

15. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a user-specific behavioral trait corresponding to speed of approach by said user to an on-screen field of said particular computerized financial service;

based on the estimated user-specific behavioral trait of speed of approach of said user, differentiating between said user and another user interacting with said particular computerized financial service.

16. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a user-specific behavioral trait corresponding to speed of exit by said user from an on-screen field of said particular computerized financial service;

based on the estimated user-specific behavioral trait of speed of exit of said user, differentiating between said user and another user interacting with said particular computerized financial service.

17. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a user-specific behavioral trait corresponding to acceleration of approach by said user to an on-screen field of said particular computerized financial service;

based on the estimated user-specific behavioral trait of acceleration of approach of said user, differentiating between said user and another user interacting with said particular computerized financial service.

18. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a user-specific behavioral trait corresponding to acceleration of exit by said user from an on-screen field of said particular computerized financial service;

based on the estimated user-specific behavioral trait of acceleration of exit of said user, differentiating between said user and another user interacting with said particular computerized financial service.

19. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user and based on monitored keystrokes of said user, estimating a time period that is typically required for said user in order to move an on-screen pointer from a first particular field to a second particular field of said particular computerized financial service;

based on estimation of said time period, that is typically required for said user in order to move an on-screen pointer from a first particular field to a second particular field of said computerized service, differentiating between said user and another user interacting with said particular computerized financial service.

20. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user and based on monitored keystrokes of said user, estimating a time period that is typically required for said user in order to proceed from (i) a click within a particular field of said particular computerized financial service, to (ii) typing within said particular field of said particular computerized financial service;

based on estimation of said time period, that is typically required for said user in order to proceed from (i) click within said particular field of said particular computerized financial service, to (ii) typing within said particular field of said particular computerized financial service, differentiating between said user and another user interacting with said particular computerized financial service.

21. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user and based on monitored keystrokes of said user, estimating a time period that is typically required for said user in order to proceed from (i) end of typing within a particular field of said particular computerized financial service, to (ii) moving an on-screen pointer away from said particular field of said particular computerized financial service;

based on estimation of said time period, that is typically required for said user in order to proceed from (i) end of typing within said particular field of said particular computerized financial service, to (ii) moving an on-screen pointer away from said particular field of said particular computerized financial service, differentiating between said user and another user interacting with said particular computerized financial service.

22. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user and based on monitored keystrokes of said user, estimating whether said user typically scrolls a page of said particular computerized financial service (i) using a mouse, or (ii) using a keyboard;

based on estimation of whether said user typically scrolls a page of said particular computerized financial service (i) using a mouse, or (ii) using a keyboard, differentiating between said user and another user interacting with said particular computerized financial service.

23. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating whether said user typically scrolls a page of said particular computerized financial service (i) using mouse-clicks on an on-screen scroll-bar, or (ii) using mouse-wheel;

based on estimation of whether said user typically scrolls a page of said particular computerized financial service (i) using mouse-clicks on an on-screen scroll-bar, or (ii) using mouse-wheel, differentiating between said user and another user interacting with said particular computerized financial service.

24. The method of claim 1 , comprising:

based on monitored keystrokes of said user, estimating whether said user typically scrolls a page of said particular computerized financial service (i) using arrow-down and arrow-up keys, or (ii) using page-up and page-down keys;

based on estimation of whether said user typically scrolls a page of said particular computerized financial service (i) using arrow-down and arrow-up keys, or (ii) using page-up and page-down keys, differentiating between said user and another user interacting with said particular computerized financial service.

25. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating an average pointing device movement speed of said user;

based on estimation of average pointing device movement speed of said user, differentiating between said user and another user interacting with said particular computerized financial service.

26. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a standard deviation of pointing device movement speed of said user;

based on estimation of standard deviation of pointing device movement speed of said user, differentiating between said user and another user interacting with said particular computerized financial service.

27. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a distribution of pointing device movement speed of said user;

based on estimation of distribution of pointing device movement speed of said user, differentiating between said user and another user interacting with said particular computerized financial service.

28. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating an average of positive values of acceleration of pointing device movement of said user in a particular direction;

based on estimation of said average of positive values of acceleration, differentiating between said user and another user interacting with said particular computerized financial service.

29. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating an average of negative values of acceleration of pointing device movement of said user in a particular direction;

based on estimation of said average of negative values of acceleration, differentiating between said user and another user interacting with said particular computerized financial service.

30. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a standard deviation of acceleration of pointing device movement of said user in a particular direction;

based on estimation of said standard deviation of acceleration, differentiating between said user and another user interacting with said particular computerized financial service.

31. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a ratio between (i) a number of positive values of acceleration in a direction of movement, and (ii) a number of negative values of acceleration in said direction of movement;

based on estimation of said ratio, differentiating between said user and another user interacting with said particular computerized financial service.

32. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating an average of positive values of acceleration of pointing device movement of said user in a direction perpendicular to a direction of movement of said pointing device;

based on estimation of said average of positive values of acceleration, differentiating between said user and another user interacting with said particular computerized financial service.

33. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating an average of negative values of acceleration of pointing device movement of said user in a direction perpendicular to a direction of movement of said pointing device;

based on estimation of said average of negative values of acceleration, differentiating between said user and another user interacting with said particular computerized financial service.

34. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a median of absolute values of angular velocity of pointing device movement of said user;

based on estimation of median of absolute values of angular velocity of pointing device movement of said user, differentiating between said user and another user interacting with said particular computerized financial service.

35. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a distribution of angular velocity of pointing device movement of said user;

based on estimation of distribution of angular velocity of pointing device movement of said user, differentiating between said user and another user interacting with said particular computerized financial service.

36. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a median speed of movement at a click event of said pointing device of said user;

based on estimation of median speed of movement at a click event of said pointing device of said user, differentiating between said user and another user interacting with said particular computerized financial service.

37. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating an average of time difference between a mouseclick-down event and a mouseclick-up event of said pointing device of said user;

based on estimation of average of time difference between a mouseclick-down event and a mouseclick-up event of said pointing device of said user, differentiating between said user and another user interacting with said particular computerized financial service.

38. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating an average direction of pre-mouseclick movements of said pointing device of said user;

based on estimation of average direction of pre-mouseclick movements of said pointing device of said user, differentiating between said user and another user interacting with said particular computerized financial service.

39. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a ratio between (i) mouse movement events of said user, to (ii) all mouse events of said user;

based on estimation of said ratio between (i) mouse movement events of said user, to (ii) all mouse events of said user, differentiating between said user and another user interacting with said particular computerized financial service.

40. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a ratio between (i) mouse click events of said user, to (ii) all mouse events of said user;

based on estimation of said ratio between (i) mouse click events of said user, to (ii) all mouse events of said user, differentiating between said user and another user interacting with said particular computerized financial service.

41. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a ratio between (i) mouse wheel events of said user, to (ii) all mouse events of said user;

based on estimation of said ratio between (i) mouse wheel events of said user, to (ii) all mouse events of said user, differentiating between said user and another user interacting with said particular computerized financial service.

42. The method of claim 1 , comprising:

based on monitored pointing device dynamics and gestures of said user, estimating a ratio between (i) sharp mouse movements of said user, to (ii) all mouse movements of said user;

based on estimation of said ratio between (i) sharp mouse movements of said user, to (ii) all mouse movements of said user, differentiating between said user and another user interacting with said particular computerized financial service.

43. A process comprising:

(A) during multiple usage sessions of multiple users with a particular online retailer, wherein each one of said users utilizes a pointing device and a keyboard for interacting with said particular online retailer, monitoring pointing device dynamics and gestures and keystrokes of each one of said users across multiple different pages of said particular online retailer;

(B) differentiating between (i) a legitimate user of said particular online retailer, and (ii) an illegitimate user of said particular online retailer, based on an aggregate combination of:

(I) a first unique sequence in which each user visits multiple web-pages of said particular online retailer, and

(II) a second unique sequence in which each user engages with on-screen user interface (UI) elements within a single web-page of said particular online retailer, and

(III) a unique transition pattern in which each user transitions from a first on-screen component of a first web-page to a second on-screen component of a second web-page of said particular online retailer;

(C) based on said differentiating, flagging a particular transaction of a particular user of said particular online retailer as possibly-fraudulent.