Abstract: Systems and methods are provided for automatically generating unique identifiers for text fields and determining the type of information of a specific text field in an online user journey. The method identifies a data type identifier for each text field by training on historical sessions from many user interactions to group text fields, even with randomly generated IDs, and based on the metadata associated with the text fields. The method can predict the data type for new data and can enable the automatic selection and application of a correct keystroke dynamics algorithm for authentication and fraud detection.

Abstract: Systems and methods are provided for automatically generating unique identifiers for text fields and determining the type of information of a specific text field in an online user journey. The method identifies a data type identifier for each text field by training on historical sessions from many user interactions to group text fields, even with randomly generated IDs, and based on the metadata associated with the text fields. The method can predict the data type for new data and can enable the automatic selection and application of a correct keystroke dynamics algorithm for authentication and fraud detection.

Abstract: A method for determining whether a secure transaction between a user computing device and a server, connected via a network, is controlled remotely via a remote access tool. The method includes, during the secure transaction, actively perturbing and/or probing the network to change the conditions in the network. During perturbing of the network, data relating to user interactions with a user interface associated with the user computing device is collected and compared to reference data relating to user interactions carried out prior to the secure transaction or prior to perturbing of the network. Based on the comparison, a probability that the secure transaction is carried out via a remote access tool is computed and is compared to a predefined threshold. If the threshold is exceeded, the secure transaction is terminated.

Abstract: System and methods are provided for mitigating click farm fraud by receiving network data and sensor data from a plurality of computing devices, extracting one or more features from the sensor data and the network data for each of the devices. The features represent one or more of a local physical environment and communication channel environment associated with a device of the plurality of computing devices. The method includes determining one or more subsets of the plurality of computing devices based on environmental and network characteristics of the one or more features, identifying, based on the one or more subsets and detected influencer activities, co-located computing devices, and responsive to determining that a count of the co-located computing devices is greater than a predetermined count, sending a session terminating command to one or more servers in communication with the co-located computing devices to mitigate click farm fraudulent activities.

Abstract: Systems and methods are provided for behavioral biometrics retraining on credential input provided by a user for authentication. A method includes receiving a successful login indication that a user has been authenticated for access on the enterprise server based on the credential input. The method includes receiving metadata and user behaviometric data corresponding to the credential input. The method includes computing, with a behavioral scoring module, a metadata similarity score by comparing the received metadata to metadata previously stored in a user profile, resetting at least a portion of previously stored user profile data based on receiving the successful login indication and the metadata similarity score being less than a threshold value, and training user profile data using the received user behaviometric data based on receiving the successful login indication and the metadata similarity score being less than a threshold value.

Abstract: Systems and methods are provided for behavioral biometrics retraining on credential input provided by a user for authentication. A method includes receiving a successful login indication that a user has been authenticated for access on the enterprise server based on the credential input. The method includes receiving metadata and user behaviometric data corresponding to the credential input. The method includes computing, with a behavioral scoring module, a metadata similarity score by comparing the received metadata to metadata previously stored in a user profile, resetting at least a portion of previously stored user profile data based on receiving the successful login indication and the metadata similarity score being less than a threshold value, and training user profile data using the received user behaviometric data based on receiving the successful login indication and the metadata similarity score being less than a threshold value.

Abstract: A method for determining whether a secure transaction between a user computing device and a server, connected via a network, is controlled remotely via a remote access tool. The method includes, during the secure transaction, actively perturbing and/or probing the network to change the conditions in the network. During perturbing of the network, data relating to user interactions with a user interface associated with the user computing device is collected and compared to reference data relating to user interactions carried out prior to the secure transaction or prior to perturbing of the network. Based on the comparison, a probability that the secure transaction is carried out via a remote access tool is computed and is compared to a predefined threshold. If the threshold is exceeded, the secure transaction is terminated.

Abstract: Systems and methods are provided for improving behavioral biometrics scoring accuracy. A method includes receiving streamed behavioral biometrics data and associated contextual data, determining a first trust score by evaluating the streamed behavioral biometric data, and if the first trust score is below a first predetermined value, separating the streamed behavioral biometrics data into contextualized bins corresponding to the contextual data to produce binned data. The contextualized bins can include a target identifier such as a data field; or a data type field, an area of a browser window, a task, and/or a physical activity. Responsive to a first threshold amount of accrued binned data, the method can include evaluating the binned data to determine a second trust score that is context-aware and sending an alert to the enterprise server responsive to the second trust score being below a second predetermined value.

Abstract: System and methods are provided for mitigating click farm fraud by receiving network data and sensor data from a plurality of computing devices, extracting one or more features from the sensor data and the network data for each of the devices. The features represent one or more of a local physical environment and communication channel environment associated with a device of the plurality of computing devices. The method includes determining one or more subsets of the plurality of computing devices based on environmental and network characteristics of the one or more features, identifying, based on the one or more subsets and detected influencer activities, co-located computing devices, and responsive to determining that a count of the co-located computing devices is greater than a predetermined count, sending a session terminating command to one or more servers in communication with the co-located computing devices to mitigate click farm fraudulent activities.

Abstract: Systems and methods are provided for improving behavioral biometrics scoring accuracy. A method includes receiving streamed behavioral biometrics data and associated contextual data, determining a first trust score by evaluating the streamed behavioral biometric data, and if the first trust score is below a first predetermined value, separating the streamed behavioral biometrics data into contextualized bins corresponding to the contextual data to produce binned data. The contextualized bins can include a target identifier such as a data field; or a data type field, an area of a browser window, a task, and/or a physical activity. Responsive to a first threshold amount of accrued binned data, the method can include evaluating the binned data to determine a second trust score that is context-aware and sending an alert to the enterprise server responsive to the second trust score being below a second predetermined value.

Abstract: System and methods are provided for mitigating click farm fraud by receiving network data and sensor data from a plurality of computing devices, extracting one or more features from the sensor data and the network data for each of the devices. The features represent one or more of a local physical environment and communication channel environment associated with a device of the plurality of computing devices. The method includes determining one or more subsets of the plurality of computing devices based on environmental and network characteristics of the one or more features, identifying, based on the one or more subsets and detected influencer activities, co-located computing devices, and responsive to determining that a count of the co-located computing devices is greater than a predetermined count, sending a session terminating command to one or more servers in communication with the co-located computing devices to mitigate click farm fraudulent activities.

Abstract: Systems and methods are provided for improving behavioral biometrics scoring accuracy. A method includes receiving streamed behavioral biometrics data and associated contextual data, determining a first trust score by evaluating the streamed behavioral biometric data, and if the first trust score is below a first predetermined value, separating the streamed behavioral biometrics data into contextualized bins corresponding to the contextual data to produce binned data. The contextualized bins can include a target identifier such as a data field; or a data type field, an area of a browser window, a task, and/or a physical activity. Responsive to a first threshold amount of accrued binned data, the method can include evaluating the binned data to determine a second trust score that is context-aware and sending an alert to the enterprise server responsive to the second trust score being below a second predetermined value.

Abstract: Systems and methods are provided for automatically generating unique identifiers for text fields and determining the type of information of a specific text field in an online user journey. The method identifies a data type identifier for each text field by training on historical sessions from many user interactions to group text fields, even with randomly generated IDs, and based on the metadata associated with the text fields. The method can predict the data type for new data and can enable the automatic selection and application of a correct keystroke dynamics algorithm for authentication and fraud detection.

Abstract: Systems and methods are provided for behavioral biometrics retraining on credential input provided by a user for authentication. A method includes receiving a successful login indication that a user has been authenticated for access on the enterprise server based on the credential input. The method includes receiving metadata and user behaviometric data corresponding to the credential input. The method includes computing, with a behavioral scoring module, a metadata similarity score by comparing the received metadata to metadata previously stored in a user profile, resetting at least a portion of previously stored user profile data based on receiving the successful login indication and the metadata similarity score being less than a threshold value, and training user profile data using the received user behaviometric data based on receiving the successful login indication and the metadata similarity score being less than a threshold value.

Abstract: A method for determining whether a secure transaction between a user computing device and a server, connected via a network, is controlled remotely via a remote access tool. The method includes, during the secure transaction, actively perturbing and/or probing the network to change the conditions in the network. During perturbing of the network, data relating to user interactions with a user interface associated with the user computing device is collected and compared to reference data relating to user interactions carried out prior to the secure transaction or prior to perturbing of the network. Based on the comparison, a probability that the secure transaction is carried out via a remote access tool is computed and is compared to a predefined threshold. If the threshold is exceeded, the secure transaction is terminated.

Abstract: a user profile of behavior of a specific user is generated, including obtaining a plurality of dummy user profiles. An initial behavioral dataset relating to the behavior of the specific user during a specific transaction is collected, and compared to each of the plurality of dummy user profiles. When the initial behavioral dataset matches at least one of the plurality of dummy user profiles, the method further includes initiating a new user profile of the specific user to be equivalent to the at least a portion of at least one of the plurality of dummy user profiles, and further training the new user profile based on the initial behavioral dataset, to modify the new user profile to more accurately reflect behavior of the specific user.

Abstract: A computer-implemented method, program-code, web-client device and computer system to realize and guard over a secure input routine based on their behavior.

Abstract: Method for a secure authenticating of a user identity of a device for a service during a session including a transaction between an authentication-client and a connected authentication-server, whereby said authentication-client is running on said device using a user-agent with a specific authentication-interface to communicate encrypted authentication messages using a Transport Layer Security (TLS) protocol between said user-agent of said authentication-client and a web-server of both said authentication-server of a ‘Relying Party’ using a unique and secret authentication-identifier (e.g. a hash-value created from ‘Relying Party’, date and time) between them, and a Behaviometric-server using a unique and secret Behaviometric-identifier (e.g. a hash-value created from a Behaviometric-Server, date and time) between them, whereby said session comprising an earlier authentication stage and at least in authentication case (said user identity is positively authenticated) a later controlling stage.

Abstract: A computer-implemented method, computer device and computer system for detecting multiple users based on a biometric user profile and/or a behavioral user profile.

Abstract: A computer-implemented method, program-code, web-client device and computer system to realize and guard over a secure input routine based on their behavior.