Method and system for detecting remote access during activity on the pages of a web resource
Non-limiting embodiments of the present technology are directed to a field of computer science, and particularly to the methods and systems for remote access detection when browsing web resource pages. A method comprises receiving data representative of a periodicity of a computer mouse movement events; generating a statistical model, the statistical model representative of a typical periodicity of the computer mouse movement events associated with a legitimate user of the electronic device; receiving an indication of computer mouse movement events from the electronic device during a browsing session of the web resource; comparing a periodicity of the computer mouse movement events with the statistical model; in response to detecting a deviation in computer mouse movement events, generating a notification determining a presence of a remote connection to the browsing session; transmitting the notification to an entity associated with the web resources.
1. A method of remote connection detection when browsing a web resource page using an electronic device, the method executable by a server communicatively coupled to the electronic device, the method comprising:
receiving, by the server from the electronic device, data representative of a periodicity of interrupt signals of a processor of the electronic device,
the interrupt signals having been triggered by computer mouse movement events associated with a computer mouse of the electronic device;
generating, by the server using a machine learning algorithm based on the data, a statistical model, the statistical model representative of a typical periodicity of the interrupt signals associated with a legitimate user of the electronic device;
receiving, by the server, an indication of the interrupt signals from the electronic device during a given browsing session of the web resource;
determining, based on the indication of the interrupt signals, a current periodicity of the interrupt signals for the given browsing session;
comparing, by the server, the current periodicity of the interrupt signals with the typical periodicity of the interrupt signals associated with the legitimate user;
in response to detecting a deviation between the current periodicity of the interrupt signals and the typical periodicity of the interrupt signals, generating a notification determining, by the server, a presence of a remote connection to the given browsing session;
transmitting, by the server, the notification to an entity associated with the web resources.
2. The method of claim 1 , wherein the data representative of the periodicity of the interrupt signals comprises a median and a dispersion of a time measurement set distribution between adjacent interrupt signals.
3. The method of claim 2 , wherein the time measurement is expressed in milliseconds.
4. The method of claim 1 , wherein the generating the statistical model comprises using the machine learning method that is based on at least one of k-nearby neighbours method and linear regression.
5. The method of claim 1 , wherein the generating the statistical model comprises application of approximating functions for calculating the parameters necessary for detecting use of remote access means.
6. A system for remote connection detection when browsing a web resource page, the system comprising:
a server communicatively coupled to an electronic device and configured to:
receive data representative of a periodicity of interrupt signals of a processor of the electronic device,
the interrupt signals having been triggered by computer mouse movement events associated with a computer mouse of the electronic device;
generate, using a machine learning algorithm based on the data, a statistical model, the statistical model representative of a typical periodicity of the interrupt signals associated with a legitimate user of the electronic device;
receive an indication of the interrupt signals from the electronic device during a given browsing session of the web resource;
determining, based on the indication of the interrupt signals, a current periodicity of interrupt signals for the given browsing session;
compare the current periodicity of the interrupt signals with the typical periodicity of the interrupt signals associated with the legitimate user;
in response to detecting a deviation between the current periodicity of the interrupt signals and the typical periodicity of the interrupt signals, generate a notification determining a presence of a remote connection to the given browsing session;
transmit the notification to an entity associated with the web resources.
7. The system of claim 6 , wherein the server is configured to receive the indication of the interrupt signals from the electronic device from a browser executed by the electronic device, the browser having been configured to load a script including an interrupt handler for collecting and transmitting the data representative of the periodicity of the interrupt signals on the electronic device.