Device, system, and method of detecting multiple users accessing the same account
Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a possible attacker. The methods include monitoring of user-side input-unit interactions, in general and in response to an interference introduced to user-interface elements. The monitored interactions are used for detecting an attacker that utilizes a remote access channel; for detecting a malicious automatic script, as well as malicious code injection; to identify a particular hardware assembly; to perform user segmentation or user characterization; to enable a visual login process with implicit two-factor authentication; to enable stochastic cryptography; and to detect that multiple users are utilizing the same subscription account.
1. A method comprising:
determining that a particular subscription account of a computerized service, is accessed by two different human users who utilize a same set of login credentials, by performing:
(a) monitoring input-unit interactions of pairs of usage sessions that originated from two different users;
(b) extracting from the input-unit interactions that were monitored in step (a), a cross-account usage-session pairing pattern;
(c) monitoring input-unit interactions of pairs of usage sessions that originated from a same human user;
(d) extracting from the input-unit interactions that were monitored in step (c), an intra-account usage-session pairing pattern;
(e) determining whether a pair of usage sessions, that originated from a particular subscription account, is: (i) relatively more similar to the cross-account usage-session pairing pattern, or (ii) relatively more similar to the intra-account usage-session pairing pattern;
wherein the monitoring of step (a) comprises: monitoring input-unit interactions of pairs of usage sessions that originated from two different human users and which comprise user reactions to an injected user-interface interference;
wherein the monitoring of step (c) comprises: monitoring input-unit interactions of pairs of usage sessions that originated from said same human user and which comprise user reactions to said injected user-interface interference.
2. The method of claim 1 , wherein, if it is determined in step (e) that the pair of usage session, that originated from said particular subscription account, is relatively more similar to the cross-account usage-session pairing pattern, then generating a notification that said particular subscription account is accessed by two different human users who utilize the same set of login credentials.
3. The method of claim 1 , wherein the monitoring of step (a) further comprises: monitoring also input-unit interactions of pairs of usage sessions that originated from pairs of two different subscriptions accounts and which comprise natural interactions that are not induced by any user-interface interference;
wherein the monitoring of step (c) further comprises: monitoring also input-unit interactions of pairs of usage sessions that originated from a same subscription account and which comprise natural interactions that are not induced by any user-interface interference.
4. The method of claim 1 , comprising:
checking whether a characteristic of monitored user-interface interactions over a pair of usage-sessions of a same subscription account, is more similar to either: (i) a first pattern of user-interface interactions that characterize multiple pairs of usage sessions of different human users, or (ii) a second pattern of user-interface interactions that characterizes multiple pairs of usage sessions wherein each pair of usage session belong to the same subscription account.
5. The method of claim 4 , comprising:
if it is determined that said characteristic of monitored user-interface interactions, over said pair of usage-sessions of the same subscription account, is more similar to said first pattern of user-interface interactions that characterize multiple pairs of usage sessions of different human users, then generating a notification that said particular subscription account is accessed by two different human users who utilize the same set of login credentials.
6. The method of claim 1 , comprising:
checking whether a characteristic of monitored user-interface interactions over a pair of usage-sessions of a same subscription account, that comprise user reactions to an injected user-interface interference, is more similar to either: (i) a first pattern of user-interface interactions that characterize multiple pairs of usage sessions of different human users, or (ii) a second pattern of user-interface interactions that characterizes multiple pairs of usage sessions wherein each pair of usage session belong to the same subscription account.
7. The method of claim 6 , comprising:
if it is determined that said characteristic of monitored user-interface interactions, over said pair of usage-sessions of the same subscription account, that comprise user reactions to said injected user-interface interference, is more similar to said first pattern of user-interface interactions that characterize multiple pairs of usage sessions of different human users, then generating a notification that said particular subscription account is accessed by two different human users who utilize the same set of login credentials.
8. The method of claim 1 , wherein said computerized service comprises a service selected from the group consisting of:
a digital streaming video service;
a digital streaming audio service;
an online gaming service.
9. The method of claim 1 , wherein said computerized service comprises a service selected from the group consisting of:
an online premium-content service available only to paying subscribers;
an online legal information service available only to paying subscribers;
an online financial information service available only to paying subscribers;
an online business information service available only to paying subscribers;
an online news information service available only to paying subscribers.
10. The method of claim 1 , comprising:
generating an attributes vector for each usage session;
utilizing a clustering algorithm to determine the number of most-probable sources for the usage sessions;
based on the clustering result, determining whether the usage sessions correspond to one use or to multiple users.
11. The method of claim 1 , comprising:
generating an ad-hoc model reflecting user-side interactions that were performed in all usage sessions that originated from a particular computing device;
based on said ad-hoc model, for all other usage sessions accesses using a different device, comparing said usage sessions to said model;
if a particular usage session is determined to be significantly different than said ad-hoc model, then determining the said particular usage session originated from a different user.
12. A method comprising:
determining that a particular subscription account of a computerized service, is accessed by two or more different human users who utilize a same set of login credentials, by performing:
(a) monitoring input-unit interactions of sets of multiple usage sessions that originated from sets of multiple different subscriptions accounts and which comprise user reactions to an injected user-interface interference;
(b) extracting from the input-unit interactions that were monitored in step (a), a cross-account usage-session grouping pattern;
(c) monitoring input-unit interactions of sets of usage sessions that originated from a same subscription account and which comprise user reactions to said injected user-interface interference;
(d) extracting from the input-unit interactions that were monitored in step (c), an intra-account usage-session grouping pattern;
(e) determining whether a set of multiple usage sessions, that originated from said particular subscription account, is: (i) relatively more similar to the cross-account usage-session grouping pattern, or (ii) relatively more similar to the intra-account usage-session grouping pattern.
13. The method of claim 10 , wherein each one of the sets of multiple usage sessions comprises a pair of usage sessions.
14. The method of claim 10 , wherein each one of the sets of multiple usage sessions comprises a set of three usage sessions.
15. The method of claim 10 , wherein each one of the sets of multiple usage sessions comprises a group of four usage sessions.
16. A system comprising:
a multiple-users for same account detector, to determine that a particular subscription account of a computerized service, is accessed by two different human users who utilize a same set of login credentials,
wherein the multiple-users for same account detector is:
(a) to monitor input-unit interactions of pairs of usage sessions that originated from pairs of two different human users;
(b) to extract from the input-unit interactions that were monitored in step (a), a cross-account usage-session pairing pattern;
(c) to monitor input-unit interactions of pairs of usage sessions that originated from a same human user;
(d) to extract from the input-unit interactions that were monitored in step (c), an intra-account usage-session pairing pattern;
(e) to determine whether a pair of usage sessions, that originated from a particular subscription account, is: (i) relatively more similar to the cross-account usage-session pairing pattern, or (ii) relatively more similar to the intra-account usage-session pairing pattern;
wherein in step (a), the multiple-users for same account detector is to monitor input-unit interactions of pairs of usage sessions that originated from two different human users and which comprise user reactions to an injected user-interface interference;
wherein in step (c), the multiple-users for same account detector is to monitor input-unit interactions of pairs of usage sessions that originated from a same human user and which comprise user reactions to said injected user-interface interference.
17. The system of claim 16 , wherein, if it is determined in step (e) that the pair of usage session, that originated from said particular subscription account, is relatively more similar to the cross-account usage-session pairing pattern, then the multiple-users for same account detector is to generate a notification that said particular subscription account is accessed by two different human users who utilize the same set of login credentials.
18. The system of claim 16 , wherein the multiple-users for same account detector is to determine that a particular subscription account of a computerized service, is accessed by two or more different human users who utilize a same set of login credentials, by performing:
(a) monitoring input-unit interactions of sets of multiple usage sessions that originated from sets of multiple different subscriptions accounts;
(b) extracting from the input-unit interactions that were monitored in step (a), a cross-account usage-session grouping pattern;
(c) monitoring input-unit interactions of sets of usage sessions that originated from a same subscription account;
(d) extracting from the input-unit interactions that were monitored in step (c), an intra-account usage-session grouping pattern;
(e) determining whether a set of multiple usage sessions, that originated from said particular subscription account, is: (i) relatively more similar to the cross-account usage-session grouping pattern, or (ii) relatively more similar to the intra-account usage-session grouping pattern.