Differentiating among users based on responses to injected interferences
Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, detecting a cyber-attacker, and detecting click-fraud. An end-user device (a desktop computer, a laptop computer, a smartphone, a tablet, or the like) interacts and communicates with a server of a computerized server (a banking website, an electronic commerce website, or the like). The interactions are monitored, tracked and logged. User Interface (UI) interferences or irregularities are intentionally introduced to the communication session; and the server tracks the response or the reaction of the end-user to such communication interferences. The system determines whether the user is a legitimate human user, or a cyber-attacker or automated script posing as the legitimate human user. The system further detects click-fraud, and prevents or mitigates Application Distributed Denial-of-Service attacks.
1. A process comprising:
(a) generating for a particular user of a computerized service, a particular pool of multiple different types of input-output interferences,
wherein each input-output interference causes an anomaly between (I) input gestures that said particular user manually performs via an input unit of an electronic device, and (II) on-screen behavior of an on-screen pointer that is displayed on a display unit of said electronic device as a result of the input gestures performed manually by said particular user;
(b) for a particular input-output interference, which has two possible manual-corrective-responses that are a first manual-corrective-response and a second manual-corrective-response, determining that at least N percent of a population of users of electronic devices react to said particular input-output interference by performing said first manual-corrective-response, and further determining that said particular user also performs said first manual-corrective-response in response to said particular input-output interference; wherein N represents a pre-defined threshold value;
wherein said particular input-output interference is a hidden challenge that is unknown to the user and which forces the user, through abnormal behavior of the on-screen-pointer in response to user gestures, to unknowingly perform a gesture via an input unit that controls the on-screen pointer, said gesture being indicative of the identity of said user;
(c) based on step (b), determining that said particular input-output interference is not to be subsequently utilized with regard to said particular user who performed said first manual-corrective-response, and determining that said particular input-output interference can be subsequently utilized for at least one other user who reacted to said particular input-output-interference by performing said second manual-corrective response.
2. The process of claim 1 ,
wherein said particular input-output interference comprises:
temporarily hiding an on-screen pointer at the output unit of said electronic device;
defining the first manual-corrective-response as linear movement of the input unit by the user;
defining the second manual-corrective-response as non-linear movement of the input unit by the user.
3. The process of claim 1 ,
wherein said particular input-output interference comprises:
temporarily hiding an on-screen pointer at the output unit of said electronic device;
defining the first manual-corrective-response as linear movement of the input unit by the user;
defining the second manual-corrective-response as circular movement of the input unit by the user.
4. The process of claim 1 ,
wherein said particular input-output interference comprises:
temporarily hiding an on-screen pointer at the output unit of said electronic device;
defining the first manual-corrective-response as clockwise rotation movement of the input unit by the user;
defining the second manual-corrective-response as counter-clockwise rotation movement of the input unit by the user.
5. The process of claim 1 ,
wherein said particular input-output interference comprises:
temporarily hiding an on-screen pointer at the output unit of said electronic device;
defining the first manual-corrective-response as movement of the input unit by the user;
defining the second manual-corrective-response as clicking a button of the input unit by the user.
6. The process of claim 1 , comprising:
storing a lookup table representing a pool of possible on-screen interferences;
for each one of the possible on-screen interferences, determining the level of uniqueness in the population of users of each one of two possible manual responses to interference;
updating said lookup table to indicate the level of uniqueness of each possible manual response to each one of the possible on-screen interferences.
7. The process of claim 1 , comprising, with regard to a particular user:
dynamically creating a user profile for user differentiation,
by discarding from said pool a first input-output interference to which the manual correction operation of said particular user is frequent with at least M percent of the population of users;
and by maintaining in said pool a second input-output interference to which the manual correction operation of said particular user is frequent with at most M percent of the population of users, wherein M is a pre-defined threshold value between 0 and 100.
8. The process of claim 1 ,
wherein said particular input-output interference causes an on-screen pointer to deviate from its expected on-screen route.
9. The process of claim 1 ,
wherein said particular input-output interference causes an on-screen pointer to temporarily disappear from the screen.
10. The process of claim 1 ,
wherein said particular input-output interference causes an on-screen pointer to disappear from a first on-screen location, and to re-appear at a second, different, on-screen location.