Granted Patent B2

US 9,558,339 · App. 14/675,769 · Granted Jan 31, 2017

Inventor: Avi Turgeman (Cambridge, MA)

Assignee: BioCatch Ltd.

G06F21/36G06F3/041G06F21/31G06F21/316G06F21/32G06F21/554H04L63/08H04L63/1408H04L63/1458H04W12/06H04W12/12G06F2221/2133

Abstract

Claims (69)

1. A method comprising:

determining whether a user, who utilizes a computing device to interact with a computerized service, is either an authorized user or an attacker; wherein the determining comprises:

modifying a log-in screen of the computerized service to cause said log-in screen to exhibit a temporary input/output interference that causes an anomaly between (A) input gestures that the user performs via an input unit of said computing device, and (B) output that is displayed on a display unit of said computing device;

tracking user interactions via said input unit in response to said temporary input/output interference at the log-in screen;

if said tracking of user interactions indicates that said user performed a manual correction operation to correct said anomaly, then determining that said user is an authorized user;

if said tracking of user interactions indicates that said user did not perform manual correction operations that adequately correct said anomaly, then determining that said user is an attacker.

2. The method of claim 1 , wherein the tracking of step (ii) comprises:

determining whether or not said user performed any manual correction operations;

if it is determined that said user did not perform any manual correction operations, then determining that said user is an attacker.

3. The method of claim 1 , wherein the tracking of step (ii) comprises:

determining whether or not said user performed any manual correction operations;

if it is determined that said user performed manual correction operations, then further determining whether the manual correction operations that the user performed adequately correct said anomaly; and if it is determined that the manual correction operations did not adequately correct said anomaly, then determining that said user is an attacker.

4. The method of claim 1 , wherein the tracking of step (ii) comprises:

determining whether or not said user performed any manual correction operations;

if it is determined that said user performed manual correction operations, then further determining whether the manual correction operations that the user performed adequately correct said anomaly;

if it is determined that the manual correction operations did not adequately correct said anomaly, then determining that said user is possibly an authorized user and performing an additional authentication challenge for said user.

5. The method of claim 1 , wherein modifying the log-in screen of the computerized service comprises:

causing a deviation of an on-screen pointer that is being moved by said user, relative to a regular on-screen route of said on-screen pointer.

6. The method of claim 1 , wherein modifying the log-in screen of the computerized service comprises:

temporarily hiding an on-screen pointer that is being moved by said user.

7. The method of claim 1 , wherein modifying the log-in screen of the computerized service comprises:

causing an on-screen pointer that is being moved by said user, to appear in a different on-screen location relative to an intended movement route of said on-screen pointer.

8. The method of claim 1 , wherein modifying the log-in screen of the computerized service comprises:

defining an account creation process that comprises at least three screens in which said user enters information to create a new account for the computerized service;

pseudo-randomly shuffling an order in which said at least three screens are presented to said user during said account creation process of said computerized service.

9. The method of claim 1 , wherein modifying the log-in screen of the computerized service comprises:

defining an account creation process that comprises at least a first screen, a second screen and a third screen; wherein the first screen of said account creation process is fixed and is always the first screen to be displayed to all users during creation of new accounts;

presenting to said user the first, fixed, screen of the account creation process;

pseudo-randomly selecting whether to present to said user, during the account creation process and immediately after the first fixed screen, either: (A) the second screen of the account creation process, and then the third screen of the account creation process; or (B) the third screen of the account creation process, and then the second screen of the account creation process.

10. The method of claim 1 , wherein modifying the log-in screen of the computerized service comprises:

defining an account creation process that comprises at least a first screen, a second screen and a third screen; wherein the first screen of said account creation process is fixed and is always the first screen to be displayed to all users during creation of new accounts;

presenting to said user the first, fixed, screen of the account creation process;

pseudo-randomly selecting whether to present to said user, after the first fixed screen of the account creation process, either: (A) the second screen of the account creation process, and then the third screen of the account creation process; or (B) the third screen of the account creation process, and then the second screen of the account creation process;

if step (B) is pseudo-randomly selected, then:

(a) presenting to the user the third screen of the log-in process prior to the second screen of the account creation process; (b) tracking user interactions during with said third screen that is presented instead of said second screen; (c) determining whether or not the user interactions at the third screen reflect a user surprise from a change in an expected order of screens of the account creation process; (d) if the determining of step (c) is positive, then determining that said user is an attacker.

11. The method of claim 1 , wherein modifying the log-in screen of the computerized service comprises:

defining an account creation process that comprises at least a first screen, a second screen and a third screen; wherein the first screen of said account creation process is fixed and is always the first screen to be displayed to all users during creation of new accounts;

presenting to said user the first, fixed, screen of the account creation process;

when said user interacts with the first fixed screen of the account creation process, generating said temporary input/output interference that causes anomaly between (A) input gestures that the user performs via the input unit of said computing device, and (B) output that is displayed on the display unit of said computing device;

tracking user interactions in response to said temporary input/output interference that is introduced into the first fixed screen;

if the user interactions in response to said temporary input/output interference that is introduced into the first fixed screen, indicate that the user did not perform manual correction operations that adequately fix said anomaly, then determining that said user is a possible attacker;

if it is determined that said user is a possible attacker, then:

pseudo-randomly selecting whether to present to said user, after the first fixed screen of the account creation process, either: (A) the second screen of the account creation process, and then the third screen of the account creation process; or (B) the third screen of the account creation process, and then the second screen of the account creation process.

12. The method of claim 1 , wherein modifying the log-in screen of the computerized service comprises:

defining an account creation process that comprises at least a first screen, a second screen and a third screen; wherein the first screen of said account creation process is fixed and is always the first screen to be displayed to all users during creation of new accounts;

presenting to said user the first, fixed, screen of the account creation process;

when said user interacts with the first fixed screen of the account creation process, generating said temporary input/output interference that causes anomaly between (A) input gestures that the user performs via the input unit of said computing device, and (B) output that is displayed on the display unit of said computing device;

tracking user interactions in response to said temporary input/output interference that is introduced into the first fixed screen;

if the user interactions in response to said temporary input/output interference that is introduced into the first fixed screen, indicate that the user did not perform manual correction operations that adequately fix said anomaly, then determining that said user is a possible attacker;

if it is determined in step (e) that said user is a possible attacker, then:

pseudo-randomly selecting whether to present to said user, after the first fixed screen of the account creation process, either: (A) the second screen of the account creation process, and then the third screen of the account creation process; or (B) the third screen of the account creation process, and then the second screen of the account creation process;

if step (B) is pseudo-randomly selected, then:

(a1) presenting to the user the third screen of the log-in process prior to the second screen of the account creation process; (b1) tracking user interactions during with said third screen that is presented instead of said second screen; (c1) determining whether or not the user interactions at the third screen reflect a user surprise from a change in an expected order of screens of the account creation process; (d1) if the determining of step (c1) is positive, then determining that said user is an attacker.

13. The method of claim 1 , comprising:

detecting that a rate of incorrect log-in attempts to said computerized service, within a pre-defined time period, is greater than a threshold rate;

determining that the computerized service is possibly undergoing an Application Distributed Denial-of-Service (Application DDoS) attack;

based on said determining, modifying a log-in process to the computerized service by generating said temporary input/output interference, and tracking user interactions in response to said temporary input/output interference.

14. The method of claim 1 , comprising:

detecting that a rate of incorrect log-in attempts to said computerized service, within a pre-defined time period, is greater than a threshold rate;

determining that the computerized service is possibly undergoing an Application Distributed Denial-of-Service (Application DDoS) attack;

based on the determination of step (b), modifying a log-in process to the computerized service by generating said temporary input/output interference, and tracking user interactions in response to said temporary input/output interference;

determining which Internet packets incoming to the computerized service from a source that does not perform manual correction operations in response to said temporary input/output interference;

selectively steering said Internet packets to a fraud mitigation module of said computerized service, while steering other incoming Internet packets to a primary server of said computerized service.

15. The method of claim 1 , comprising:

detecting that a rate of incorrect log-in attempts to said computerized service, within a pre-defined time period, is greater than a threshold rate;

determining that the computerized service is possibly undergoing an Application Distributed Denial-of-Service (Application DDoS) attack;

based on the determination of step (b), modifying a log-in process to the computerized service by generating said temporary input/output interference, and tracking user interactions in response to said temporary input/output interference;

determining which Internet packets incoming to the computerized service from a source that does not perform manual correction operations in response to said temporary input/output interference;

selectively steering said Internet packets to a secondary server of said computerized service, while steering other incoming Internet packets to a primary server of said computerized service.

Assignments (6)

Continuity (16)