Patent Document ID: 9552470
Application ID: 14675765
Patent Status: 1

Claim One:
1. A method comprising: monitoring user interactions of a user, who utilizes a computing device to interact with a computerized service during a usage session; for each particular type of data entry method that the user utilizes during said usage session: calculating a current number of occurrences of utilization of said particular type of data entry method during said usage session, and generating output corresponding to said current number of occurrences during said usage session; calculating a ratio between (A) said current number of occurrences of utilization of said particular type of data entry method during said usage session, and (B) an average number of occurrences of utilization of said particular type of data entry method during previous usage sessions of said user; and generating output corresponding to said ratio; based on (i) said current number of occurrences, and (ii) said average number of occurrences during previous usage sessions of said user, determining whether said user is an authorized user or a cyber-attacker; wherein the method comprises: (a) for a particular type of user interaction with a user-interface element of said computerized service, defining at least: (a1) a first data-entry method that users can utilize to engage with said user-interface element, and (a2) a second data-entry method that users can utilize to engage with said user-interface element; (b) for a particular usage session of said user, which is being reviewed for possible fraud, calculating: (b1) a first-method current-session occurrence value, indicating the number of times that said user utilized the first data-entry method to engage with said user-interface element during said particular usage session being reviewed; and (b2) a second-method current-session occurrence value, indicating the number of times that said user utilized the second data-entry method to engage with said user-interface element during said particular usage session being reviewed; (c) for all previous usage sessions of said user, that occurred within a pre-defined time period prior to the particular usage session being reviewed, calculating: (c1) a first-method aggregated occurrence value, indicating the number of times that said user utilized the first data-entry method to engage with said user-interface element during said previous usage sessions; and (c2) a second-method aggregated occurrence value, indicating the number of times that said user utilized the second data-entry method to engage with said user-interface element during said previous sage sessions; (d) generating a table comprising: (d1) the first data-entry method, the first-method current-session occurrence value, and the first-method aggregated occurrence value; and (d2) the second data-entry method, the second-method current-session occurrence value, and the second-method aggregated occurrence value.