System, apparatus, and method of collecting and processing data in electronic devices
System and method of collecting and processing data in electronic devices. A sensors data collector collects measurements from at least an accelerometer and a gyroscope of an electronic device. A data-loss prevention module operates to pass these measurements, immediately upon their collection, to a supplemental locally-running processing thread which retains the measurements even after a refresh of a web-page in which the measurements were collected, and which transmits the measurements to a remote server even after refresh of the web-page in which the measurements were collected. Non-global scope of functions is utilized, to reduce security exposure. An asynchronous SharedWorker module is utilized, to alleviate congestion of computing resources of the electronic device. Data obfuscation and encoding is utilized to maintain anonymity of user-entered data while still allowing a remote server to ensure the integrity of data received from the electronic device.
1. A system comprising:
one or more hardware processors configured to execute code, wherein the one or more hardware processors are operably associated with one or more memory units to store code;
wherein the one or more hardware processors are configured to implement:
a sensors data collector, to collect sensed data from at least one sensor selected from a group consisting of: an accelerometer of an electronic device in which said sensors data collector operates, a gyroscope of said electronic device, a spatial orientation sensor of said electronic device, a touch-screen of said electronic device, an on-screen keyboard of said electronic device, a keyboard of said electronic device;
a defensive module, configured to protect against fraud, by utilizing sensed data collected from said at least one sensor of said electronic device, wherein the sensed data comprises at least one of: keystrokes, touch-screen typing;
wherein the defensive module comprises a data obfuscation module, that is configured:
(i) to receive a user-entered string that was manually entered by a user via said electronic device,
(ii) to generate a replacement string, wherein a length of the user-entered string is identical to a length of the replacement string, by performing: (a) replacing each letter in said user-entered string with a first fixed substitute letter, (b) replacing each digit in said user-entered string with a second fixed substitute letter, (c) maintaining unchanged each non-letter non-digit character;
wherein the defensive module is to transmit said replacement string to a remote data-integrity server which determines authenticity of said user-entered string, by comparing between: attributes of the replacement string that is received from the defensive module, and attributes of the user-entered string that is sent by a protected application that runs on said electronic device which is protected by said defensive module.
2. The system of claim 1 ,
wherein an entirety of said sensors data collector is implemented by exclusively utilizing non-global functions which are non-accessible from a main JavaScript processing thread.
3. The system of claim 1 , wherein the one or more hardware processors are further configured to implement:
a defensive module activation and de-activation unit, (I) to selectively activate a first particular data-collecting function of said defensive module when a battery of said electronic device is being charged by an external power source, and (II) to selectively de-activate a second particular data-collecting function of said defensive module when the battery of said electronic device is not being charged by the external power source.
4. The system of claim 1 , comprising wherein the one or more hardware processors are further configured to implement:
a defensive module activation and de-activation unit, (I) to selectively activate a first particular data-collecting function of said defensive module when said electronic device is connected to a Wi-Fi network, and (II) to selectively de-activate a second particular data-collecting function of said defensive module when said electronic device is not connected to a Wi-Fi network.
5. The system of claim 1 , comprising wherein the one or more hardware processors are further configured to implement:
a defensive module activation and de-activation unit, (I) to selectively activate a first particular data-collecting function of said defensive module when said electronic device is capable of sending data via a cellular network, and (II) to selectively de-activate a second particular data-collecting function of said defensive module when said electronic device is not capable of sending data via the cellular network.
6. The system of claim 1 ,
wherein said defensive module comprises:
a main processing thread that collects data and immediately passes each collected data-item to a SharedWorker module;
said SharedWorker module, (a) to receive each collected data-item from the main processing thread, and (b) to subsequently process said data locally in a-synchronous manner after completion of loading of a web-page in which the main processing thread is operable, and (c) to subsequently transmit a processed version of said data to a remote server in a-synchronous manner after completion of loading of the web-page in which the main processing thread is operable.
7. The system of claim 1 , wherein the one or more hardware processors are further configured to implement:
a background-mode detector, (a) to generate a detection that that a protected application that is associated with said defensive module, was minimized to background-running mode in said electronic device; and (b) upon said detection in step (a), to selectively de-activate a particular data-collecting function of said defensive module.
8. The system of claim 1 , wherein the one or more hardware processors are further configured to implement:
a defensive-module de-activation element, which is inserted into a first web-page of a monitored application, to command said defensive module to pause data-collecting operations while said first web-page is visited;
a defensive-module re-activation element, which is inserted into a second web-page of said monitored application, to command said defensive module to resume data-collecting operations while said second web-page is visited.
9. The system of claim 1 , wherein the one or more hardware processors are further configured to implement:
a defensive-module de-activation element, which is inserted into a first web-page of a monitored application, to command said defensive module to pause data-collecting operations while said first web-page is visited, wherein said first web-page is pre-defined as a web-page that does not generate user interactions that are useful for fraud detection;
a defensive-module re-activation element, which is inserted into a second web-page of said monitored application, to command said defensive module to resume data-collecting operations while said second web-page is visited, wherein said second web-page is pre-defined as a web-page that generates user interactions that are useful for fraud detection.
10. The system of claim 1 , wherein the one or more hardware processors are further configured to implement:
a defensive-module de-activation element, which is inserted into a first web-page of a monitored application, to command said defensive module to pause data-collecting operations while said first web-page is visited, wherein said first web-page is pre-defined as a web-page that pauses a security risk smaller than a pre-defined threshold;
a defensive-module re-activation element, which is inserted into a second web-page of said monitored application, to command said defensive module to resume data-collecting operations while said second web-page is visited, wherein said second web-page is pre-defined as a web-page that pauses a security risk that is equal to or greater than a pre-defined threshold.
11. The system of claim 1 ,
wherein said electronic device is a non-rooted electronic device.
12. The system of claim 1 ,
wherein said defensive module is operable without having root access in said electronic device.
13. The system of claim 1 ,
wherein said defensive module is operable without having access to any system logs of said electronic device.
14. The system of claim 1 ,
wherein said defensive module is implemented as an integral component of a monitored application that is protected by said defensive module.
15. The system of claim 1 ,
wherein said defensive module is implemented as an integral component of a monitored application that is protected by said defensive module.
16. The system of claim 1 ,
wherein said defensive module is implemented as an external component which resides in said electronic device and which runs on said electronic device but is a separate application from a monitored application that is protected by said defensive module.
17. A method comprising:
at a sensors data collector, collecting sensed data from at least one sensor selected from a group consisting of: an accelerometer of an electronic device in which said sensors data collector operates, a gyroscope of said electronic device, a spatial orientation sensor of said electronic device, a touch-screen of said electronic device, an on-screen keyboard of said electronic device, a keyboard of said electronic device;
at a defensive module, that is configured to protect against fraud by utilizing sensed data collected from said at least one sensor of said electronic device, operating a the defensive module having a data obfuscation module, by performing:
(i) receiving a user-entered string that was manually entered by a user via said electronic device,
(ii) generating a replacement string, wherein a length of the user-entered string is identical to a length of the replacement string, by performing: (a) replacing each letter in said user-entered string with a first fixed substitute letter, (b) replacing each digit in said user-entered string with a second fixed substitute letter, (c) maintaining unchanged each non-letter non-digit character;
transmitting, by the defensive module, said replacement string to a remote data-integrity server which determines authenticity of said user-entered string, by comparing between: attributes of the replacement string that is received from the defensive module, and attributes of the user-entered string that is sent by a protected application that runs on said electronic device which is protected by said defensive module.
18. A non-transitory storage medium have stored thereon instructions that, when executed by a machine, cause the machine to perform a method comprising:
at a sensors data collector, collecting measurements from at least one sensor selected from a group consisting of: an accelerometer of an electronic device in which said sensors data collector operates, a gyroscope of said electronic device, a spatial orientation sensor of said electronic device, a touch-screen of said electronic device, an on-screen keyboard of said electronic device, a keyboard of said electronic device;
at a defensive module, that is configured to protect against fraud by utilizing measurements collected from said at least one sensor of said electronic device, operating a the defensive module having a data obfuscation module, by performing:
(i) receiving a user-entered string that was manually entered by a user via said electronic device,
(ii) generating a replacement string, wherein a length of the user-entered string is identical to a length of the replacement string, by performing: (a) replacing each letter in said user-entered string with a first fixed substitute letter, (b) replacing each digit in said user-entered string with a second fixed substitute letter, (c) maintaining unchanged each non-letter non-digit character;
transmitting, by the defensive module, said replacement string to a remote data-integrity server which determines authenticity of said user-entered string, by comparing between: attributes of the replacement string that is received from the defensive module, and attributes of the user-entered string that is sent by a protected application that runs on said electronic device which is protected by said defensive module.