Device, system, and method of differentiating among users based on detection of hardware components
Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, detecting a possible attacker, and flagging a particular financial transaction or a particular retail transaction as being possibly-fraudulent. The methods include monitoring of user-side input-unit interactions, in general and in response to an interference introduced to user-interface elements. The monitored interactions are analyzed, and enable extraction of hardware-specific features of a computer mouse, a touchpad, a touch-screen, a keyboard, or other input unit. In some methods, detection of different mouse polling rates or different mouse DPI values, across two different usage sessions in the same financial account, enables the method to detect a possibly-fraudulent transaction.
1. A method comprising:
(A) performing an analysis of monitored mouse interactions of a particular user who interacts with a computerized service, and determining from a sampling rate of said mouse interactions a hardware-specific mouse-characteristic that characterizes a hardware feature of said mouse regardless of whether said mouse was utilized by one user or by multiple users;
(B) performing an analysis of monitored keyboard interactions of said particular user who interacts with said computerized service, and determining from a typing pattern a hardware-specific keyboard-characteristic that characterizes a hardware feature of said keyboard regardless of whether said keyboard was utilized by one user or by two different users;
(C) differentiating between two or more human users that access said computerized service, based on an analysis that is based at least on (i) said hardware-specific mouse-characteristic and (ii) said hardware-specific keyboard-characteristic.
2. The method of claim 1 ,
wherein steps (A) through (C) are performed without access to Operating System information that indicate which mouse is being utilized in any particular usage session.
3. The method of claim 1 ,
wherein at least one of steps (A) through (C) is performed by a remote server that is located remotely from said mouse and from said keyboard.
4. The method of claim 1 ,
wherein at least one of steps (A) through (C) is performed by a Web browser module which does not have access to user-side Operating System identification of a mouse being used.
5. The method of claim 1 ,
wherein the determining of step (A) is based on, at least, analysis of an average level of linearity of mouse-strokes that were performed by said particular user.
6. The method of claim 1 ,
wherein the determining of step (A) is further based on, at least, an average level of curvature of mouse-strokes that were performed by said particular user.
7. A system comprising:
one or more processors, configured to execute code;
one or more memory units, configured to store code;
wherein the one or more processors are configured:
(A) to perform an analysis of monitored mouse interactions of a particular user who interacts with a computerized service, and to determine from a sampling rate of said mouse interactions a hardware-specific mouse-characteristic that characterizes a hardware feature of said mouse regardless of whether said mouse was utilized by one user or by multiple users;
(B) to perform an analysis of monitored keyboard interactions of said particular user who interacts with said computerized service, and to determine from a typing pattern a hardware-specific keyboard-characteristic that characterizes a hardware feature of said keyboard regardless of whether said keyboard was utilized by one user or by two different users;
(C) to differentiate between two or more human users that access said computerized service, based on an analysis that is based at least on (i) said hardware-specific mouse-characteristic and (ii) said hardware-specific keyboard-characteristic.