Method, system, and device of differentiating among users based on responses to interferences
Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. An end-user device interacts and communicates with a server of a computerized service, or with a local application or Web-browser running on the end-user device. A usage interference is injected or introduced, or an input/output mismatch or abnormality is created, causing an output displayed on the screen of the end-user device, to be non-matching to the expected or intended output that is typically displayed in response to regular non-interfered user gestures or regular non-interfered user input. The reaction or corrective manual actions of the user are tracked and analyzed, to differentiate among users, or to differentiate between an authorized human user and a human cyber-attacker, or to differentiate between an authorized human user and a computer bot or an automated computerized script.
1. A method comprising:
(a) monitoring interactions of a user of an end-user device, with a computerized service, via an input-unit of said end-user device;
(b) injecting into an interface of said end-user device, a module that generates an invisible challenge which changes a manner in which an output-unit of the end-user device responds to an input-unit interaction performed by said user, into an irregular manner that deviates from non-interfered utilization of said input-unit and said output-unit;
wherein the injecting comprises:
(A) generating at least three on-screen user-interface elements, that are displayed concurrently on a same screen and that comprise at least: a first on-screen user-interface element, a second on-screen user-interface element, and a third on-screen user-interface element;
(B) causing an on-screen pointer to be located at the first on-screen user-interface element;
(C) in response to engagement of said user with a TAB key of said computerized device, causing the on-screen pointer to irregularly appear at said third on-screen user-interface element, instead of regularly re-appearing at said second on-screen user-interface element;
(c) determining a user-specific characteristic that indicates at least one of: (I) a type of corrective action that said user performs in response to said invisible challenge; (II) a time-period that it takes said user to commence reacting to said invisible challenge; (III) a time-period that it takes said user to complete said corrective action in response to said invisible challenge;
(d) based on said user-specific characteristic, differentiating between said user and other users of said computerized service.
2. The method of claim 1 ,
wherein the injecting of step (b) further comprises: injecting into said interface an input/output aberration that induces said user to perform excess gestures with said input-unit in order to correct said input/output aberration that was injected into said interface;
wherein step (c) comprises: determining said user-specific characteristic based on monitoring of said excess gestures that were induced by said input/output aberration.
3. The method of claim 1 ,
wherein the injecting of step (b) further comprises: injecting into said interface an input/output aberration that induces said user to perform excess gestures with said input-unit in order to correct said input/output aberration that was injected into said interface;
wherein step (c) comprises: determining said user-specific characteristic based on a particular timing of said excess gestures that were induced by said input/output aberration.
4. The method of claim 1 ,
wherein the injecting of step (b) further comprises: injecting into said interface an input/output aberration that induces said user to perform excess gestures with said input-unit in order to correct said input/output aberration that was injected into said interface;
wherein step (c) comprises: determining said user-specific characteristic based on a particular manner in which said user performs said excess gestures that were induced by said input/output aberration.
5. The method of claim 1 , further comprising:
(e) augmenting a pool of user-specific features, that are utilized in order to differentiate between said user and other users of said computerized service, by adding to said pool said user-specific characteristic that was determined in step (c).
6. The method of claim 1 ,
wherein the injecting of step (b) further comprises: causing an on-screen pointer to irregularly deviate from its regular on-screen route, in response to an input-unit gesture by said user;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to irregular deviation of the on-screen pointer from its regular on-screen route.
7. The method of claim 1 ,
wherein the injecting of step (b) further comprises: causing an on-screen pointer to temporarily disappear from its current on-screen location, in response to an input-unit gesture by said user;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to temporary disappearance of the on-screen pointer from its current on-screen location.
8. The method of claim 1 ,
wherein the injecting of step (b) further comprises: causing an on-screen pointer to disappear from its current on-screen location and to immediately re-appear in a new on-screen location;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to disappearance and then re-appearance of the on-screen pointer at said new on-screen location.
9. The method of claim 1 ,
wherein the injecting of step (b) further comprises: replacing a regular on-screen pointer having a first graphical icon, with a replacement on-screen pointer having a different graphic icon;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to the replacing of the regular on-screen pointer with said replacement on-screen pointer.
10. The method of claim 1 ,
wherein the injecting of step (b) further comprises: while said end-user is operating the input-unit in order to move an on-screen pointer towards a target on-screen location having a user-interface element, moving said user-interface element from said target on-screen location to a different on-screen location;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to the moving of the user-interface element from said target location to said different on-screen location.
11. The method of claim 1 ,
wherein the injecting of step (b) further comprises: causing an output unit of said end-user device, to display a first character, in response to said user manually entering a second, different character;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to the end-user device displaying said first character even though said user manually entered said second character.
12. The method of claim 1 ,
wherein the injecting of step (b) further comprises: causing an output unit of said end-user device, to display a first string of multiple characters, in response to said user manually entering a second, different, string of multiple characters;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to the end-user device displaying said first string of multiple characters even though said user manually entered said second, different, string of multiple characters.
13. The method of claim 1 ,
wherein the injecting of step (b) further comprises: causing an output unit of said end-user device, to display a particular character repeated multiple times, in response to said user manually entering said particular character a single time;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to the end-user device displaying said particular character repeated multiple times even though said user manually entered said particular character only a single time.
14. The method of claim 1 ,
wherein the injecting of step (b) further comprises: while the user is operating a touch-screen of said end-user device to scroll through an on-screen content, causing an abrupt stop of an ongoing on-screen scrolling of said on-screen content;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to said abrupt stop of the on-screen scrolling of said on-screen content.
15. The method of claim 1 ,
wherein the injecting of step (b) further comprises: while the user is operating a touch-screen of said end-user device to scroll through an on-screen content, irregularly modifying a scrolling-speed of the on-screen scrolling of said on-screen content;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to modification of the scrolling-speed of the on-screen scrolling of said on-screen content.
16. The method of claim 1 ,
wherein the injecting of step (b) further comprises: while the user is operating a touch-screen of said end-user device to scroll through an on-screen content, causing said on-screen scrolling to be temporarily non-responsive to scrolling gestures performed by the user on said touch-screen;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to the on-screen scrolling being temporarily non-responsive to scrolling gestures performed by the user on said touch-screen.
17. The method of claim 1 ,
wherein the injecting of step (b) further comprises: while the user is operating a scrolling-wheel of a computer mouse of said end-user device to scroll through an on-screen content, causing an abrupt stop of an ongoing on-screen scrolling of said on-screen content;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to said abrupt stop of the on-screen scrolling of said on-screen content.
18. The method of claim 1 ,
wherein the injecting of step (b) further comprises: while the user is operating a scrolling-wheel of a computer mouse of said end-user device to scroll through an on-screen content, irregularly modifying a scrolling-speed of the on-screen scrolling of said on-screen content;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to modification of the scrolling-speed of the on-screen scrolling of said on-screen content.
19. The method of claim 1 ,
wherein the injecting of step (b) further comprises: while the user is operating a scrolling-wheel of a computer mouse of said end-user device to scroll through an on-screen content, causing said on-screen scrolling to be temporarily non-responsive to scrolling gestures performed by the user via said scrolling-wheel of the computer mouse;
wherein step (c) comprises: determining said user-specific characteristic based on reaction of said user to the on-screen scrolling being temporarily non-responsive to scrolling gestures performed by the user via said scrolling-wheel of the computer mouse.
20. The method of claim 1 ,
wherein the injecting of step (b) further comprises: pseudo-randomly selecting, from a pool of pre-defined usage interferences, a particular usage interference to be introduced to usage of said end-user device.
21. The method of claim 1 ,
wherein the injecting of step (b) further comprises: non-randomly selecting, from a pool of pre-defined usage interferences, a particular usage interference to be introduced to usage of said end-user device, wherein said selecting is based on prior efficiency of usage interferences in differentiating between said user and other users.
22. The method of claim 1 ,
wherein the injecting of step (b) further comprises: non-randomly selecting, from a pool of pre-defined usage interferences, a particular usage interference to be introduced to usage of said end-user device, wherein said selecting is based on prior efficiency of usage interferences in differentiating between two or more users of said computerized service.
23. The method of claim 1 ,
wherein the injecting of step (b) further comprises: non-randomly selecting, from a pool of pre-defined usage interferences, a particular usage interference to be introduced to usage of said end-user device, wherein said selecting is based at least on a type of end-user device that is being utilized by said user.
24. The method of claim 1 ,
wherein the injecting of step (b) further comprises: non-randomly selecting, from a pool of pre-defined usage interferences, a particular usage interference to be introduced to usage of said end-user device, wherein said selecting is based at least on uniqueness of a prior reaction of said user to said particular usage interference that was injected to a previous usage session of said user.
25. The method of claim 1 ,
wherein the injecting of step (b) further comprises: upon commencement of engagement of said user with an on-screen drop-down list of selectable items, dynamically modifying an order in which at least one selectable item is included in said drop-down list.
26. The method of claim 1 ,
wherein the injecting of step (b) further comprises: upon commencement of engagement of said user with an on-screen drop-down list of selectable items, dynamically re-arranging an order in which said list of selectable items are ordered.
27. The method of claim 1 ,
wherein the injecting of step (b) further comprises: upon commencement of engagement of said user with a page having two or more fields, dynamically modifying an order in which said fields are ordered on the screen.
28. The method of claim 1 ,
wherein the injecting of step (b) further comprises: upon commencement of engagement of said user with a page having one or more on-screen fields, dynamically moving at least one on-screen field from its current on-screen location to a different on-screen location.
29. A method comprising:
(a) monitoring interactions of a user of an end-user device, with a computerized service, via an input-unit of said end-user device;
(b) injecting into an interface of said end-user device, a module that generates an invisible challenge which changes a manner in which an output-unit of the end-user device responds to an input-unit interaction performed by said user, into an irregular manner that deviates from non-interfered utilization of said input-unit and said output-unit;
wherein the injecting comprises:
(A) generating at least three on-screen user-interface elements, that are displayed concurrently on a same screen and that comprise at least: (I) a first on-screen user-interface element, and (II) a second on-screen user-interface element which is located at a same horizontal level of the first on-screen user-interface element, and (III) a third on-screen user-interface element that is located at a different horizontal level relative to the first and second user-interface elements;
(B) causing an on-screen pointer to be located at the first on-screen user-interface element;
(C) in response to engagement of said user with a TAB key of said computerized device, causing the on-screen pointer to irregularly appear at said third on-screen user-interface element, instead of regularly re-appearing at said second on-screen user-interface element;
(c) determining a user-specific characteristic that indicates at least one of: (I) a type of corrective action that said user performs in response to said invisible challenge; (II) a time-period that it takes said user to commence reacting to said invisible challenge; (III) a time-period that it takes said user to complete said corrective action in response to said invisible challenge;
(d) based on said user-specific characteristic, differentiating between said user and other users of said computerized service.
30. A process comprising:
(a) monitoring interactions of a user of an end-user device, with a computerized service, via an input-unit of said end-user device;
(b) injecting into an interface of said end-user device, a module that generates an invisible challenge which changes a manner in which an output-unit of the end-user device responds to an input-unit interaction performed by said user, into an irregular manner that deviates from non-interfered utilization of said input-unit and said output-unit;
wherein the injecting comprises:
(A) generating at least three on-screen user-interface elements, that are displayed concurrently on a same screen and that comprise at least: a first on-screen user-interface element, a second on-screen user-interface element, and a third on-screen user-interface element;
(B) causing an on-screen pointer to be located at the first on-screen user-interface element;
(C) in response to engagement of said user with a TAB key of said computerized device, causing the on-screen pointer to irregularly appear at said third on-screen user-interface element, instead of regularly re-appearing at said second on-screen user-interface element;
(c) determining a user-specific characteristic that indicates at least one of: (I) a type of corrective action that said user performs in response to said invisible challenge; (II) a time-period that it takes said user to commence reacting to said invisible challenge; (III) a time-period that it takes said user to complete said corrective action in response to said invisible challenge;
(d) based on said user-specific characteristic, differentiating between (i) a cyber-attacker that poses as a legitimate user of said computerized service, and (ii) the legitimate user of said computerized service.
31. The process of claim 30 ,
wherein the injecting of step (b) further comprises: upon commencement of engagement of said user with an on-screen drop-down list of selectable items, dynamically modifying an order in which at least one selectable item is included in said drop-down list.
32. The process of claim 30 ,
wherein the injecting of step (b) further comprises: upon commencement of engagement of said user with a page having two or more fields, dynamically modifying an order in which said fields are ordered on the screen.