Method, device, and system of differentiating between a cyber-attacker and a legitimate user
Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. A user utilizes a desktop computer, a laptop computer, a smartphone, a tablet, or other electronic device, to interact with a banking website or application, a retailer website or application, or other computerized service. Input-unit interactions are monitored, logged, and analyzed. Based on several types of analysis of the input-unit interactions, a score is generated to reflect fraud-relatedness or attack-relatedness of the input-unit interactions. Based on the score, the system estimates or determines whether the user is an attacker, and initiates attach-mitigation operations or fraud-mitigation operations.
1. A method comprising:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry or for navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular typing rhythm of said user in said usage session; and if said particular typing rhythm matches one or more typing rhythms that are pre-defined as typing rhythms of attackers, then increasing said attack-relatedness score of said usage session;
(c) if said attack-relatedness score is greater than a particular threshold value, then: determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations.
2. The method of claim 1 ,
wherein steps (b1) and (b2) analyze a batch of input-unit interactions which includes interactions that were performed by said user within a single fillable form.
3. The method of claim 1 ,
wherein steps (b1) and (b2) analyze a batch of input-unit interactions which includes interactions that were performed by said user across multiple web-pages that belong to a single usage session of said user.
4. The method of claim 1 ,
wherein steps (b1) and (b2) analyze a batch of input-unit interactions which includes interactions that were performed by said user across multiple fillable forms that were filled by said user.
5. The method of claim 1 ,
wherein steps (b1) and (b2) analyze a batch of input-unit interactions which includes interactions that were performed by said user across multiple web-pages that correspond to a single fillable form that is filled and submitted by said user within a single usage session.
6. The method of claim 1 ,
wherein steps (b1) through (b2) analyze said batch of input-unit interactions which are interactions of a new user (I) that is not logged-in to said computerized service and (II) that is accessing said computerized service for his first time and (III) that is not associated with any pre-defined user profile derived from prior visits of said user.
7. The method of claim 1 ,
wherein steps (b1) through (b2) analyze said batch of input-unit interactions which are interactions of a user that already passed a CAPTCHA challenge and already proved to the computerized service that he is a human and not a machine.
8. The method of claim 1 ,
wherein steps (b1) through (b2) analyze said batch of input-unit interactions which are interactions of an already logged-in user that had successfully authenticated himself to the computerized service;
wherein the method comprises determining that said user is an attacker even though he had successfully authenticated himself to the computerized service.
9. The method of claim 1 ,
wherein steps (b1) and (b2) comprise:
(I) analyzing a batch of input-unit interactions of said user, relative to a pre-generated attackers interactions model that indicates characteristics of input-unit interactions derived from analysis of interactions performed by a plurality of users that are known to be attackers;
(II) if said batch of input-unit interactions of said user, is sufficiently similar beyond a threshold-level of similarity to said attackers interactions model, then: determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations.
10. The method of claim 1 ,
wherein the method comprises analyzing at least one of: keystrokes, mouse-strokes, mouse-clicks, touch-screen taps, touch-screen gestures, and touch-pad gestures.
11. The method of claim 1 ,
wherein said input-unit interactions comprise interactions that are captured from at least one of: a physical keyboard, an on-screen keyboard, a mouse, a touchpad.
12. The method of claim 1 ,
wherein the method comprises analyzing at least touch-screen gestures that are performed by said user via a touch-screen of said electronic device.
13. The method of claim 1 ,
wherein the method comprises analyzing at least typing gestures that are performed by said user via a physical keyboard of said electronic device.
14. The method of claim 1 ,
wherein said electronic device is a device selected from the group consisting of: a laptop computer, a desktop computer, a tablet, a smartphone.
15. A non-transitory storage medium having stored thereon instructions that, when executed by one or more hardware processors, cause the one or more hardware processors to perform a method comprising:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry or for navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular typing rhythm of said user in said usage session; and if said particular typing rhythm matches one or more typing rhythms that are pre-defined as typing rhythms of attackers, then increasing said attack-relatedness score of said usage session;
(c) if said attack-relatedness score is greater than a particular threshold value, then: determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations.
16. A system comprising:
one or more hardware processors, that are configured to perform:
(a) monitoring input-unit interactions of a user, who utilizes during a usage session one or more input units of an electronic device to fill-out data in a fillable form of a computerized service;
(b1) if said input-unit interactions indicate that said user utilized keyboard shortcuts for data entry or for navigation, then increasing an attack-relatedness score of said usage session;
(b2) detecting a particular typing rhythm of said user in said usage session; and if said particular typing rhythm matches one or more typing rhythms that are pre-defined as typing rhythms of attackers, then increasing said attack-relatedness score of said usage session;
(c) if said attack-relatedness score is greater than a particular threshold value, then: determining that said input-unit interactions are part of an attack, and initiating one or more mitigation operations.