Method of and system for processing an unauthorized user access to a resource
There is provided a method of authenticating a user in a network. The method can be executed on a server. The method comprises: acquiring a non-authorized user-behavior model associated with a non-authorized access to a network resource by an unauthorized entity, the non-authorized user-behavior model having been generated during blocking the non-authorized access to the network resource by the unauthorized entity; retrieving from a log stored on the network server, an indication of a plurality of users, each respective user associated with a respective user-behavior model; responsive to one of the respective user-behavior model matching the non-authorized user-behavior model, associating a user account associated with the respective user associated with the one of the respective user-behavior model with a security-violation parameter; responsive to the security-violation parameter, restricting user activity within the user account.
1. A method of authenticating a user in a network, the method executed on a server, the method comprising:
acquiring a non-authorized user-behavior model associated with a non-authorized access to a network resource by an unauthorized entity, the non-authorized user-behavior model having been generated during blocking the non-authorized access to the network resource by the unauthorized entity, the non-authorized user-behavior model having a first model portion based on at least one device-specific parameter and a second model portion based on at least one user-device interaction parameter, the user-device interaction parameter being indicative of a type of action performed by the unauthorized entity with the network resource;
retrieving from a log stored on the network server, an indication of a plurality of users, each respective user of the plurality of users being associated with a respective user-behavior model, the respective user-behavior model having a respective first model portion based on at least one device-specific parameter and a respective second model portion based on at least one user-device interaction parameter, the user-device interaction parameter being indicative of a type of action performed by the respective user with the network resource;
responsive to the first model portion and the second model portion of one of the respective user-behavior model associated with a respective user of the plurality of users matching the first model portion and the second model portion of the non-authorized user-behavior model, associating a user account associated with the respective user associated with the one of the respective user-behavior model with a security-violation parameter;
responsive to the security-violation parameter, restricting user activity within the user account.
2. The method of claim 1 , further comprising, prior to the restricting, executing a verification routine within the respective user account to confirm if the user access is unauthorized.
3. The method of claim 2 , wherein the executing the verification routine comprises presenting a user associated with the user account a challenge question.
4. The method of claim 1 , wherein the security-violation parameter comprises a cookie associated with the user account augmented with a flag indicative of the security-violation parameter.
5. The method of claim 1 , wherein the security-violation parameter is indicative of a degree of trust that the user associated with the user account is an un-authorized user.
6. The method of claim 1 , wherein the restricting comprises blocking access to the user account.
7. The method of claim 1 , wherein the restricting comprises allowing limited functionality with the user account.
8. The method of claim 1 , wherein the first model portion and the second model portion of the respective user-behavior model and the non-authorized user-behavior model have been generated by applying a hashing function on the device-specific parameter and the user-device interaction parameter.
9. The method of claim 7 , wherein the user-device interaction parameter comprises at least one of:
user-associated click pattern;
user-associated mouse movement pattern;
user-associated typing pattern;
user-specific function execution pattern;
a user time patterns when the user typically establishes user sessions.
10. The method of claim 8 , wherein the device-specific parameter comprises
a network address associated with a user electronic device typically used for establishing user sessions;
a version of a browsing application used by the user for establishing user sessions.
11. The method of claim 8 , wherein the user-device interaction parameter comprises at least one of: a short term user-device interaction parameter and a long term user-device interaction parameter.
12. The method of claim 1 , further comprising, prior to the acquiring,
generating each of the respective user-behavior model.
13. The method of claim 12 , wherein the respective user-behavior model has been generated by analyzing at least one of: device-specific parameter and user-device interaction parameter.
14. The method of claim 13 , wherein the user-device interaction parameter comprises at least one of:
user-associated click pattern;
user-associated mouse movement pattern;
user-associated typing pattern;
user-specific function execution pattern;
a user time patterns when the user typically establishes user sessions.
15. The method of claim 13 , wherein the device-specific parameter comprises at least one of:
a network address associated with a user electronic device typically used for establishing user sessions;
a version of a browsing application used by the user for establishing user sessions.
16. The method of claim 13 , wherein the user-device interaction parameter comprises at least one of: a short term user-device interaction parameter and a long term user-device interaction parameter.
17. A server comprising:
a communication interface for communication with an electronic device via a communication network,
a processor operationally connected with the communication interface, the processor configured to authenticate a user in a network, the processor being further configured to:
acquire a non-authorized user-behavior model associated with a non-authorized access to a network resource by an unauthorized entity, the non-authorized user-behavior model having been generated during blocking the non-authorized access to the network resource by the unauthorized entity, the non-authorized user-behavior model having a first model portion based on at least one device-specific parameter and a second model portion based on at least one user-device interaction parameter, the user-device interaction parameter being indicative of a type of action performed by the unauthorized entity with the network resource;
retrieve from a log stored on the network server, an indication of a plurality of users, each respective user of the plurality of users being associated with a respective user-behavior model, the respective user-behavior model having a respective first model portion based on at least one device-specific parameter and a respective second model portion based on at least one user-device interaction parameter, the user-device interaction parameter being indicative of a type of action performed by the respective user with the network resource;
responsive to the first model portion and the second model portion of one of the respective user-behavior model associated with a respective user of the plurality of users matching the first model portion and the second model portion of the non-authorized user-behavior model, associate a user account associated with the respective user associated with the one of the respective user-behavior model with a security-violation parameter;
responsive to the security-violation parameter, restrict user activity within the user account.
18. The server of claim 17 , the processor being further configured, prior to executing restricting, to execute a verification routine within the respective user account to confirm if the user access is unauthorized.
19. The server of claim 18 , wherein to execute the verification routine, the processor is configured to present a user associated with the user account a challenge question.
20. The server of claim 17 , wherein the security-violation parameter comprises a cookie associated with the user account augmented with a flag indicative of the security-violation parameter.