Patent ID: 9703953
Date: 2017-07-11
CPC Classifications: G06F,H04L

Claim:
1. A method comprising: (a) monitoring input-unit interactions of a plurality of users, wherein each user of said plurality of users separately utilizes an electronic device to access a computerized service; (b) clustering a first user, a second user, and a third user of said plurality of users into a particular cluster of users whose input-unit interactions exhibit a particular behavioral trait when they interact with said computerized service through a portable electronic device; (c) subsequently, detecting that the first user and the second user, access said computerized service via a non-portable electronic device, in a manner that exhibits a second, different, behavioral trait; (d) determining that the third user is also expected to exhibit said second behavioral trait when the third user accesses said computerized service via a non-portable electronic device; (e) in a particular usage session, in which said third user firstly-ever accesses the computerized service via a non-portable electronic device: if said particular usage session of said third user, does not exhibit said second behavioral trait that was determined in steps (c) and (d), then, determining that said particular usage session is attributed to a cyber-attacker and not to said third user;