Telefonaktiebolaget Lm Ericsson (publ)

Behaviosec Inc

Lexisnexis Risk Solutions Fl Inc.

Per Burström

Ingo Deutschmann

Arne Simonsson

Philip Lindblad

Per Skillermark

Sara Sandberg

Tony Libell

Bo Hagerman

Anders Furuskär

Peter De Bruin

Mikael Åhlén

Stefano Sorrentino

George Jöngren

David Astely

Jonas Fröberg Olsson

David Julitz

Muhammad Ali Kazmi

Stefan Parkvall

Erik Bengt Dahlman

Henrik Sahlin

Walter Müller

Stefan Wänstedt

Nicklas Johansson

Svante Bergman

Peter Moberg

Jessica Östergaard

Sara Landström

Chrysostomos Koutsimanis

Neil Costigan

Olle Rosin

Aare Mällo

Kristina Hessler

Lancelot Pregniard

Matthias Baumhof

Julian Breitling

Wolfgang Pott

Systems and methods are provided for behavioral biometrics retraining on credential input provided by a user for authentication. A method includes receiving a successful login indication that a user has been authenticated for access on the enterprise server based on the credential input. The method includes receiving metadata and user behaviometric data corresponding to the credential input. The method includes computing, with a behavioral scoring module, a metadata similarity score by comparing the received metadata to metadata previously stored in a user profile, resetting at least a portion of previously stored user profile data based on receiving the successful login indication and the metadata similarity score being less than a threshold value, and training user profile data using the received user behaviometric data based on receiving the successful login indication and the metadata similarity score being less than a threshold value.

Systems and methods for faster behavioral retraining

A method for determining whether a secure transaction between a user computing device and a server, connected via a network, is controlled remotely via a remote access tool. The method includes, during the secure transaction, actively perturbing and/or probing the network to change the conditions in the network. During perturbing of the network, data relating to user interactions with a user interface associated with the user computing device is collected and compared to reference data relating to user interactions carried out prior to the secure transaction or prior to perturbing of the network. Based on the comparison, a probability that the secure transaction is carried out via a remote access tool is computed and is compared to a predefined threshold. If the threshold is exceeded, the secure transaction is terminated.

Detection of use of a remote access tool for secure transactions

System and methods are provided for mitigating click farm fraud by receiving network data and sensor data from a plurality of computing devices, extracting one or more features from the sensor data and the network data for each of the devices. The features represent one or more of a local physical environment and communication channel environment associated with a device of the plurality of computing devices. The method includes determining one or more subsets of the plurality of computing devices based on environmental and network characteristics of the one or more features, identifying, based on the one or more subsets and detected influencer activities, co-located computing devices, and responsive to determining that a count of the co-located computing devices is greater than a predetermined count, sending a session terminating command to one or more servers in communication with the co-located computing devices to mitigate click farm fraudulent activities.

Systems and methods for detecting and mitigating click farm fraud

The systems and methods are provided that can enable the detection of certain modes of online interactions carried out by a user's computing device, for example, when an online app or webpage of an enterprise is accessed by the user's computing device. Certain exemplary implementations may utilize collector code that resides in the app or webpage opened by users accessing the enterprise service to measure and collect timing data to detect whether the user's computing device or associated browsing session is subjected to modes of manipulation such as the user browser's privacy mode being engaged, malware interacting with the browsing session, and/or some type of aggregator interacting with the browsing session. Such modes of manipulation can impact the utility and accuracy of certain forms of behavioral biometric algorithms, particularly those that utilize users' typing, timing, keystroke dwell, etc.

Systems and methods for detecting browser mode

Systems and methods are provided for improving behavioral biometrics scoring accuracy. A method includes receiving streamed behavioral biometrics data and associated contextual data, determining a first trust score by evaluating the streamed behavioral biometric data, and if the first trust score is below a first predetermined value, separating the streamed behavioral biometrics data into contextualized bins corresponding to the contextual data to produce binned data. The contextualized bins can include a target identifier such as a data field; or a data type field, an area of a browser window, a task, and/or a physical activity. Responsive to a first threshold amount of accrued binned data, the method can include evaluating the binned data to determine a second trust score that is context-aware and sending an alert to the enterprise server responsive to the second trust score being below a second predetermined value.

Systems and methods for improved behavioral scoring accuracy

Systems and methods are provided for detecting when a user uses one or both hands to interact with a device having a physical or virtual keyboard. In one implementation, one-handed typing is determined by analyzing intragroup and intergroup keyflight timing distributions between different groups of clustered keys, each cluster having distinctly different proximal properties. A statistical measure made between the intragroup and intergroup keyflight timing distributions may be performed to determine one-handed or two-handed typing input, which may be used to enhance a user experience by adapting a viewing or input element to an appropriate hand setting. In another implementation, the detection may be used as input to determine a likelihood of suspected coaching fraud for online banking applications. In yet another implementation, the detection of one-handed typing is used as an input to bot detection algorithms to reduce false positives from other modalities.

Systems and methods for detecting hand usage in keyboard interaction

A first behaviometric user profile for a first user is generated and stored, by detecting a position and velocity of the first user relative to the mobile device based on a received response from a radar transmission while the first user uses the mobile device, the received response over time indicating a position and velocity of the first user. Based on further received responses of additional radar transmissions an additional behavioral pattern of an unknown user is determined. The additional behavioral pattern is then compared to the first behaviometric user profile, and based on the comparison, a measure of similarity between the first behaviometric user profile and the additional behavioral pattern, measuring if the first user and the unknown user are a same user is heuristically determined. As a result of the comparison, operation or access to at least some data stored on the mobile device is prevented.

Radar-based behaviometric user authentication

A method performed by a network node for beam management. The network node receives one or more quality values from a User Equipment (UE). The one or more quality values are measured by the UE on first reference signals transmitted by the network node in respective one or more beams in a first set of candidate beams. The A serving beam is selected out of the first set of candidate beams based on the received quality values for data communication with the UE. The network node creates a rule related to signal quality. The network node obtains one or more second quality values related to respective subsequent messages transmitted to the UE in the selected serving beam. As long as the rule is fulfilled with respect to the second quality value, the network node transmits one or more further subsequent messages only in the serving beam.

Network node and method for beam management in a wireless communications network

A user of a device is authenticated after providing a pass code or other data confirming the user can access data on the device. While the user uses the device, behaviometric data is recorded which includes measures of how the user uses the device. Additional data, however, can only be accessed with a biometric and/or second authentication after collecting at least some behaviometric data, in embodiments of the disclosed technology. Depending on how close of a match the behaviometric data received is to previously recorded behaviometric data for the particular user, a threshold minimum is set for the biometric match in order to grant stepped up authentication and authorization to view the additional data. In this manner, a legitimate user often requires less time to authenticate compared to the prior art and a fraudulent user is rejected from access to sensitive data more accurately.

Adjusting biometric detection thresholds based on recorded behavior

A method of granting or denying access to data is disclosed herein. A server requests behaviometric data from a device regarding a user thereof. If behaviometric data is provided, the server uses it to authenticate the user. If behaviometric data is not provided, the server requests device-identifying data from the device. If the device-identifying data matches data of a device from which a user previously consented to collection of behaviometric data, behaviometric data is collected. If not, a request for collection is made.

Authorization-based behaviometric identification

Disclosed is a method for continuously authenticating a user based on motion input data. The method includes recording motion input data from a keyboard such as starting coordinates, ending coordinates, and timestamps of key-up actions to determine that a key has been pressed, recording a timestamp of motion input at the starting coordinate, mapping the timestamp of said motion input at the starting coordinate to a key-down action for the key press, determining which key of said virtual keyboard said key-down action refers to, and granting or denying access to a device if the timing of the key which was pressed and released in the key-down action and the corresponding key-up action matches the press and flight timing of a key which was pressed and released in a previously-recorded key-down action and a previously-recorded key-up action.

Continuous authentication based on motion input data

A method for denying or nullifying a specific online transaction carried out by a specific user using a computing device associated with at least one input interface, while the specific user was coached by a fraudster. The method includes collecting a specific set of behavioral data relating to the behavior of the specific user during a specific online transaction, and using a multi-dimensional classification module to determine a probability that the specific user was coached during collection of the set of behavioral data. In response to the probability being greater than a predefined threshold, the specific transaction is denied or nullified.

Method and a device for denying or nullifying a specific online transaction carried out by an authorized user who is coached by a fraudster

FIDO authentication is augmented to include a behavioral score indicating that during a secure network session between a host and client device, the client device is being operated by a user with expected behavioral actions. The authenticated network session is maintained, stepped-up, or ended based on either or a combination of a positive response to a FIDO challenge and threshold of match between a current behavioral profile and a stored behavioral profile for the user.

Fido authentication with behavior report to maintain secure data connection

Growing community of inventors

Luleå, Sweden

Per Burström