Abstract: Techniques for detecting shared devices are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for detecting shared devices comprising receiving, using a shared computer detection component, information about a connection to a website from a user device, identifying, using the shared computer detection component, one or more characteristics associated with the connection from the user device, determining, in the event there is sufficient data based on the one or more characteristics associated with the connection from the user device, whether the user device is a shared device, and calculating a first responsive action in the event it is determined that the user device is a shared device.

Abstract: A system and method for establishing patterns of social behavior for users of mobile devices. An administrator registers a person of interest with a service by identifying a mobile device used by the person of interest and generates one or more rules. The registered mobile device monitors network traffic of other surrounding mobile devices and sends their unique identifiers to the service. The service accesses one or more registries to identify users associated with the other surrounding mobile devices. The service determines whether any rule infractions occur based on one or more of the identified users, distances between the registered mobile device and other surrounding devices, frequencies of occurrences of mobile devices being relatively near and detected time periods. If any rule infractions occur, then the service generates an alert and sends it to the administrator.

Abstract: NAT systems are identified by detecting highly authenticated operations being made by multiple users from IP addresses. Users of a web service are authenticated in response to performing highly authenticated operations, such as identity proofing or multifactor authentication. Successful highly authenticated operations are tracked. A NAT system operating in conjunction with a specific IP address is identified, in response to a threshold number of different users successfully performing highly authenticated operations from the specific IP address within a specific amount of time. The total number of users behind the identified NAT system is estimated, based on the rate at which different users successfully perform operations from the specific IP address. One or more additional action(s) are taken to manage the processing of traffic originating from the specific IP address, taking into account that multiple users are operating behind the identified NAT system. An example action is rate limiting.