International Business Machines Corporation

Itay Hazan

Matan Levi

Eitan Menahem

Andrey Finkelshtein

Noga Agmon

Eden Abadi

Techniques for verifying the identity of users transferring between devices are disclosed. An example method includes receiving device usage data by monitoring user-device interactions of a first set of users interacting with a first device and a second set of users interacting with a second device. The method also includes extracting features from the data and aggregating feature samples from the user-device interactions for first set of users and the second set of users. The method also includes generating a score for each feature based on an analysis the feature samples. The feature score indicates a degree to which the first set of feature samples and the second set of feature samples differentiate between the devices. The method also includes identifying features as transferrable if the score is below a specified threshold, and generating a new behavior model by modifying existing user behavior data according to the transferrable features.

Behavioral biometrics verification adaptation for cross devices

User verification using a mobile interaction can include receiving interaction data associated with a user of an application operating on a mobile device, the interaction data is generated during an interactive session of the user with the application on the mobile device. A plurality of features are extracted from the interaction data and one or more feature vectors are generated from the plurality of features. The plurality of features are aggregated to the one or more feature vectors and embedded within each feature vector. The embedded plurality of features are then projected to a global feature space by comparing a history of interactive sessions associated with the user and a history of interactive sessions associated with a plurality of different users for generating a global training dataset. Finally, a verification model is generated as a global binary classification model using the global training dataset.

Enhancing verification in mobile devices using model based on user interaction history

In an example computer-implemented method, a number of cursor locations within a text field, and associated action types and time stamps are received via a processor. One or more features including a latency between a number of events associated with the cursor locations is extracted via the processor based on the cursor locations and the associated action types and time stamps. A user is authenticated, identified, or verified via the processor based on the extracted one or more features and a learning model or a statistical mechanism.

Authentication using features extracted based on cursor locations

Aspects of the present invention disclose a method, computer program product, and system for employing keystroke dynamics authentication. The method includes one or more processors recording, for a plurality of users, a respective keystroke session of multiple typing samples (typed consecutively) of a credential associated with a respective user of the plurality. The method further includes extracting a set of features that characterize typing changes between the multiple typing samples. The method further includes detecting repeated typing of a certain one of the credentials that is associated with a certain user of the plurality. The method further includes extracting, from the repeated typing of the certain credential, a set of features that characterize typing changes between repetitions. The method further includes comparing the feature set extracted from the repeated typing against feature sets extracted from a set of the keystroke sessions, estimating which user is the first user.

Computer security forensics based on temporal typing changes of authentication credentials

A method for calibrating user behavior based models, in order to enable user validation across different devices (i.e. known and unknown devices), comprising: receiving device usage data generated by monitoring user-device interactions on one or more user devices; employing a user behavior model based on the device usage data and a plurality of values of technical parameters of the one or more devices; receiving a plurality of values of technical parameters of an additional device; receiving device usage data by monitoring user-device interactions on the additional device; and analyzing the device usage data of the additional device by employing the user behavior model to validate an action held using the additional device.

Mobile behaviometrics verification models used in cross devices

There is provided a computer implemented method of authenticating a user, comprising: receiving a sequence of key-related events of a manually typed text by a user using a keyboard, extracting a plurality of sub-features from the sequence of key-related events, for each instance of a plurality of instances of a respective n-gram of a plurality of n-grams extracted from the text, computing a plurality of statistical features for each respective n-gram from the plurality of sub-features extracted for the plurality of instances of the respective n-grams, feeding the plurality of statistical features computed for each of the plurality of n-grams into a trained machine learning (ML) model, and triggering a security process when the ML model outputs an indication of non-authentication of the user.

Systems and methods for authentication of a user based on free text

An example system includes a processor to receive a current session and previous sessions associated with an account. The processor can split the current session and the previous sessions into action windows. The processor can calculate a window similarity score for each action window of the current session using a pair-wise comparison with action windows of each of the previous sessions. The processor can aggregate the window similarity scores to generate a replay likelihood score for the current session with respect to each of the previous sessions. The processor can classify the current session as a replay attack in response to detecting that a replay likelihood score of the current session exceeds a threshold.

Detecting replay attacks using action windows

A keystroke dynamics anonymization technique that includes: receiving a plain-text password from a computer user; providing at least the plain-text password as a seed to a pseudorandom mapping function; applying the pseudorandom mapping function to keycodes that are produced by the computer responsive to keystrokes of the computer user, to map the keycodes to a set of mapped, anonymized keycodes; and providing the set of mapped, anonymized keycodes to a keystroke dynamics algorithm, to enable the keystroke dynamics algorithm to (a) learn a keystroke dynamics model of the computer user, and (b) authenticate an identity of the computer user.

Growing community of inventors

Beer Sheva, Israel

Itay Hazan