WO2021009743A1

WO2021009743A1 - Method, device, and system of back-coloring, forward-coloring, and fraud detection

Info

Publication number: WO2021009743A1
Application number: PCT/IL2020/050724
Authority: WO
Inventors: Uri Rivner; Avi Turgeman
Original assignee: Biocatch Ltd.
Priority date: 2019-07-14
Filing date: 2020-06-30
Publication date: 2021-01-21

Abstract

System, device, and method for behaviorally validated link analysis, session linking, transaction linking, transaction back-coloring, transaction forward-coloring, fraud detection, and fraud mitigation. A method includes: receiving an indicator of a seed transaction known to be fraudulent; selecting, from a database of transactions, multiple transactions that share at least one common property with the seed transaction; generating a list of candidate fraudulent transactions; filtering the candidate fraudulent transactions, by applying a transaction filtering rule that is based on one or more behavioral characteristics; and generating a filtered list of candidate fraudulent transactions.

Description

Method, Device, and System of

Back- Coloring, Forward- Coloring, and Fraud Detection

Field

[001] The present invention is related to cyber security.

Background

[002] Millions of people utilize mobile and non-mobile electronic devices, such as smartphones, tablets, laptop computers and desktop computers, in order to perform various activities. Such activities may include, for example, browsing the Internet, sending and receiving electronic mail (email) messages, capturing photographs and videos, engaging in a video conference or a chat session, playing games, or the like.

[003] Some activities may be privileged, or may require authentication of the user in order to ensure that only the authorized user engages in the activity. For example, a user may be required to correctly enter his username and his password in order to access his email account, or in order to access his online banking interface or website.

Summary

[004] The present invention may comprise systems, devices, and methods for behaviorally validated link analysis, session linking, transaction linking, transaction back-coloring, transaction forward-coloring, fraud detection, and fraud mitigation. For example, a method comprises: receiving an indicator of a seed transaction known to be fraudulent; selecting, from a database of transactions, multiple transactions that share at least one common property with the seed transaction (for example, same IP address, same geo-location venue, same end-user device, same“cookie” data-item, same MAC address, same beneficiary name or address, same shipping name or address, same billing name or address, or the like); generating a list of candidate fraudulent transactions; filtering the candidate fraudulent transactions, by applying a transaction filtering rule that is based on one or more behavioral characteristics and particularly based on negative (or fraud-related) behavioral characteristics (for example, the user is not familiar with the data he enters; the user performs copy-and-paste of his first name or his last name; or the like); and generating a filtered list of candidate fraudulent transactions. Then, the method continues to iteratively link such candidate fraudulent transactions with other transactions sharing a different property (for example, same device parameters), using filtering rule(s) that are based on one or more (e.g., negative) behavioral characteristics; and continues to iteratively expand the list of linked entities or transactions or sessions, while constantly validating that the linked entities or transactions or sessions are likely fraudulent as they all have one or more negative (e.g., fraud-related) behavioral characteristics.

[005] The present invention may provide other and/or additional benefits or advantages.

Brief Description of the Drawings

[006] Fig. 1 is a schematic block-diagram illustration of a system, in accordance with some demonstrative embodiments of the present invention.

Detailed Description of the Present Invention

[007] The present invention provides systems, devices, and methods for behaviorally validated link analysis, session linking, transaction linking, transaction back-coloring, transaction forward-coloring, fraud detection, and fraud mitigation.

[008] In accordance with the present invention, in forensic investigations, fraud investigations and criminal investigations, link analysis or“back coloring” takes a known bad case (e.g., an Initial Transaction or a Seed Transaction that is known or pre-determined to be fraudulent), and performs a recursive or iterative process in which additional sessions or transactions become suspects or fraud-candidates by way of linking them to the Initial Transaction based on one or more similar characteristics; such as, utilization of the same end-user device to perform the transaction, utilization of the same Internet Protocol (IP) address, or the like. Each linked session or transaction can then produce additional suspects or fraud-candidates, similarly connected to that session’s (or transaction’s) linking entities. The result is an exponentially growing tree or web of linked sessions or linked transaction, that are suspects or fraud-candidates as all stemming from or related to (directly, or indirectly via N degrees of separation) the same Initial Transaction.

[009] The Applicants have realized that link expansion using elements such as utilization of the same device or the same IP address, cause numerous“false positive” errors. For example, in many fraud cases, a shared device is used by the criminal, such as, a computer station at a Public Library or at an Internet Cafe. Legitimate or“genuine” users also utilize the same device, before the criminal and after the criminal, to perform legitimate non-fraudulent transactions, which may be incorrectly“colored” as fraud-candidates (e.g., back-colored if occurring before the Initial Transaction; or forward-colored if occurring after the Initial Transaction), even though they originated from legitimate users who just happened to utilize the same public computer that a criminal had also utilized for the Initial Transaction. The Applicants have realized that this may limit the number of iterations used to expand the tree of fraud candidates. For example, a candidate fraud transaction that is several times removed from the Initial Transaction, may often belong to a legitimate user and may be non-related at all to the criminal responsible for the Initial Transaction.

[0010] The present invention provides systems and methods enabling a unique capability for Behaviorally Validated' link analysis, transactions analysis, transaction relatedness generation, transaction coloring, back-coloring, forward-coloring, fraud detection and/or fraud mitigation. The system of the present invention may expand the related-transactions tree (or web) using common characteristics (e.g., same device, same IP address, same payee or beneficiary, same shipping address, or the like), while dramatically reducing the risk of incorrectly flagging a legitimate transaction that was performed by a legitimate user who happened to share the same resource (e.g., public computer; public Wi-Fi network; or the like) that was also utilized by the criminal during his fraudulent Initial Transaction and good people is dramatically reduced because we also verify the session using behavioral biometric analysis that shows criminal behavior signs. If it doesn't show criminal behavior signs it won't enter the link analysis and won't trigger additional links.

[0011] The system and method of the present invention significantly improve the ability to create a powerful link analysis and to generate a tree or web of related transactions while reducing the number or rate of“false positive” errors; thereby preventing a link analysis or back-coloring process that rapidly becomes infested with“false positive” errors due to a shared resource, such as, the criminal performed the Initial Transaction using a free Wi-Fi network at a local coffeeshop, or via a desktop computer at a public library or an Internet cafe, which was also utilized by hundreds of other users on the same month to perform legitimate transactions. The Applicants have realized that once such a“shared resource” is utilized for transaction linking and transaction coloring, legitimate users and legitimate transaction are rapidly added (erroneously) to the tree or web of fraud-candidate linked transactions, and the“false positive” errors grow exponentially, and the quality of the generated list or tree or web of fraud candidates degrades dramatically.

[0012] The present invention may validate or filter-in or maintain transactions that exhibit behavioral characteristic(s) which (i) correspond to criminal or fraudulent behavior in general, and/or (ii) match the behavioral characteristics extracted from the Initial Transactions performed by the original criminal. Typically, the utilized features are very rare in the total population, thereby reducing the chance of incorrectly linking “by accident” legitimate transactions of legitimate users; thereby enabling the system, through its behavioral validation, to iteratively and continuously expand the list or tree or web or related fraud-candidate transactions, with little or no risk of“incriminating” legitimate users or of flagging legitimate transactions.

[0013] The present invention provides devices, system, and methods of automated and improved transaction coloring, back-coloring and forward-coloring, as well as session linking and transaction linking, particularly useful in forensic investigations, law enforcement investigations, fraud detection, cyber-security enforcement, cyber-security investigations, and other fields.

[0014] For example, a computerized system of an entity, such as a bank, an online retailer, an online merchant, or the like, may perform an initial detection that a particular transaction (“the Initial Transaction”) is or was fraudulent. The initial detection may be based on manual or human analysis of data or meta-data; and/or may be based on manual and/or human indications or messages (e.g., a credit card customer submitting a fraud report or disputing a transaction as fraudulent); and/or may be automatic or semi-automatic (e.g., a banking system detects a new wire transfer towards a beneficiary that was already determined, in the past, to be a fraudulent or criminal destination; a retailer system detecting a new purchase of a product with a shipping address that is already known to that system as fraud-related).

[0015] Accordingly, the entire record that is related to such Initial Transaction, is flagged or marked or tagged as fraud-related. The system now proceeds to perform back-coloring and/or session linking, based on such Initial Transaction. For example, the system determines that the Initial Transaction was performed from a particular Internet Protocol (IP) address that was logged by the system during the transaction submission, and/or from a particular geographic location (e.g., based on geo-location of the logged IP address). The system now searches its database of all transactions, that were performed before and/or after the Initial Transaction, and which originated or were performed from the same IP address and/or the same geo-location; as such additional transactions are candidates of being fraud-related or fraudulent. Similarly, the system may search from transactions that were performed via the same web browser (e.g., relying on a“cookie” data-item of that browser; or relying on a unique browser-signature reflected in the types of fonts installed on the computer; or the like).

[0016] Flowever, the Applicants have realized that such simplified process of back-coloring or session linking may be problematic, and may result in a significant number of“false positives” or erroneous transactions. For example, the Initial Transaction is often performed by a criminal at a computer station located at an Internet cafe or at a public library, and such computer station is later used by hundreds of other non-criminal persons to perform thousands of non-fraudulent transactions. An attempt to back-color or forward-color or session-link, between records or transactions or sessions, based on such data, may thus lead to hundreds of “false positive” transactions or records which actually belong to (or, are associated with) legitimate users and/or legitimated (non-fraudulent) transactions.

[0017] Similarly, the Applicants have realized that often, the Initial Transaction is performed by a criminal using his own laptop computer but being located at a venue which offers free public Internet connection over Wi-Fi, such as, a coffee shop or a restaurant that offers free Wi-Fi based Internet access to customers or visitors. Therefore, geo-location of the Initial Transaction may pin-point to a particular venue or location, in which the criminal indeed operated during the Initial Transaction, but which was also populated and used by hundreds of other, legitimate, users who performed hundreds of legitimate transactions from the same venue or location.

[0018] Accordingly, the Applicants have realized that it does not suffice to link between or among sessions or transactions, based solely on identification of the same IP address and/or identification of the same geo-location and/or identification that the same computer station (or other specific computing device) was utilized; as such methods of session linking and/or back- coloring and/or forward-coloring rapidly yields hundreds or thousands of “false positive” detections which are marked as fraudulent or as fraud-candidates but actually belong to legitimate non-fraudulent transactions.

[0019] The Applicants have further realized that the problem intensifies once the process is performed iterative to construct a Tree of second-order and third-order and Nth-order linkage among sessions or transactions or records. For example, an Initial Transaction was detected to be fraudulent, but was performed by a criminal via a computer in an Internet cafe. In that month, 500 other (legitimate) users have also utilized that same computer in that same Internet cafe, to perform 500 other transactions, all of them are now marked or tagged or flagged as fraud-candidates. Then, the system may proceed to review or analyze the data or meta-data of those 500 other transactions, in order to perform“second order” coloring or session-linking: for example, by flagging or tagging as fraudulent, any other transaction in which the product was shipped to the same address as one of those 500 transactions, or any other transaction in which a wire transfer was made to a beneficiary who is the same as one of those 500 transactions. This“second order” analysis, or second iteration of the analysis, may thus yield thousands of flagged transactions, which are erroneous or“false positives”. [0020] For example, a criminal used a Public Library computer to perform a fraudulent purchase at an online retailer. Based on the IP address and/or geo-location, 600 other purchases that 600 other legitimate users have performed via the same Public Library computer, are also tagged or flagged or marked (incorrectly) as possibly fraudulent. Then, the Shipping Addresses of those 600 fraud-candidate transactions, are utilized to further flag or mark or tag Thousands of other transactions, that were performed via other computers, at the same retailer and shipped products to the same shipping addresses; thereby creating a“second order” group of thousands of transactions that are flagged as fraudulent. Then, in a“third order” analysis or a third iteration, the IP addresses associated with those thousands of flagged transactions, are further utilized by the system to tag tens-of-thousands of transactions that originated from the same IP address; although they are all legitimate transactions, that hundreds of users performed from their home, and that were only linked to the Initial Transaction because those hundreds of legitimate users have utilized one time the same Public Library computer that the original criminal utilized.

[0021] The Applicants have realized that such methods of back-coloring or forward-coloring or session-linking or session clustering or transaction clustering, grow rapidly and exponentially towards numerous amount of flagged transactions; which, in turn, are mostly and dominantly“false positive” flags, and which are virtually impossible to be manually reviewed (or acted upon) by a fraud investigator or by law enforcement agency.

[0022] The Applicants have further realized that such exponential growth of flagged transactions, may lead to adverse effects to thousands of legitimate users; whose accounts (e.g., hank account, credit card account, user account at an online retailer) may become frozen or on- hold or suspended or blocked due to such erroneous session-linking.

[0023] The present invention provides unique methods, devices, and systems that perform Behaviorally Validated link analysis and/or Behaviorally Validated linkage analysis and/or Behaviorally Validated back-coloring of transactions and/or Behaviorally Validated forward coloring of transactions and/or Behaviorally Validated session linking and/or Behaviorally Validated transaction linking.

[0024] In a first example, a transaction that is related to the Initial Transaction (directly in the first order, or in an Nth order), is indeed flagged as fraudulent, only if the two transactions (the Initial Transaction, and the Related Transaction) exhibit the same behavioral biometric characteristics. For example, criminal user Adam utilized the computer at the Public Library to perform transaction P0. Then, 50 other users utilized the same computer at the same Public Library to perform transactions numbered PI through P50. Then, the same criminal user Adam utilized again the same computer at that Public Library to perform another fraudulent transaction P51. The system of the present invention tracks, monitors and analyzes the user interactions and/or user gestures of all those 52 transactions (from P0 to P51), and searches for unique and/or repeating behavioral features. For example, the criminal user Adam moves the on-screen pointer between fields in a form by using the Tab key; this behavior is observed in transactions P0 and P51 (of user Adam), and is also observed in transactions PI through P24 (of various legitimate users, who happen to also utilize the Tab key for moving between fields), but is not observed in transactions P25 through P50 (as those legitimate users did not user the Tab key to move between fields, but rather, used the computer mouse to move the on-screen pointer between fields). Therefore, the method of the present invention significantly narrows- down the original list of 52 transactions, that were performed at the same computer in the Public Library. Then, the method may proceed, for example, to examine the manner in which each transaction was“submitted”. For example, in Transaction P0 of user Adam, the form was submitted by pressing the“Enter” key on the keyboard, rather than clicking via the mouse on the on-screen“submit” button. The system checks each one of the remaining candidate transactions (numbers PI through P24 and also P51) for their submission method; and finds that: in transactions PI through P8 and also P51, the form was submitted via the Enter key, whereas, in the remaining transactions (numbers P9 through P24) the form was submitted via a mouse-click on the Submit button; thereby enabling the system to further narrow-down the list of suspicious transactions to only 9 transactions (numbers PI through P8, and P51).

[0025] The system may then proceed to further narrow-down the list based on other behavioral features that were extracted from the usage session of transaction P0, or that behaviorally characterized the utilization of the input-units of the computer during transaction P0. For example, the total time that it took criminal Adam to perform the initial transaction P0, was a relatively short period of time, such as 45 seconds (denoted L). The system examines the total time that it took to perform each one of the remaining suspicious transactions; and filters-out or removes suspicious transactions whose time-length was, for example, greater than 2L or smaller than 0.5L; thereby leaving only transactions P51 and PI through P4 as possibly fraudulent.

[0026] Then, for example, the system detects that during the Initial Transaction P0, the user gestures have exhibited on-screen pointer movements that were all clock-wise; and the system proceeds to filter-out or remove candidate transactions in which the on-screen pointer movement were all counter-clockwise. Similarly, the system may detect that during the Initial Transaction, the user (Adam) has repeatedly clicked on the right-most region of each on-screen button that was used; and the system may thus filter-out and remove candidate transactions in which the user(s) repeatedly clicked on the left-most region of each on-screen button.

[0027] The system may thus continue to remove or filter-out or discard candidate transactions or usage-sessions, that originated from the same computer or IP address or geo-located venue, based on particular behavioral features that were extracted from tracking of the user-gestures in the Initial Transactions, and that were lacking from such other “linked” candidate transactions; thereby narrowing-down the list of related sessions or transactions from thousands to few transaction or even to a single transaction, thereby reducing the number of “false positive” errors or even avoiding entirely any“false positive” error. Furthermore, similar filtering-down or narrowing-down or discarding of candidate transactions, may similarly be performed with regard to second-order or third-order or Nth-order linkage among transaction.

[0028] Additionally or alternatively, the system may filter-out or discard or narrow-down transactions, based on criminally-related indicators and/or fraud-related indicators. For example, criminal Bob utilizes his laptop computer at a coffee shop to perform a fraudulent transaction at a particular online retailer. The system firstly identifies 500 other transactions that were performed during the same week at that same coffee shop. Flowever, the system detects that in the Initial Transaction of Bob, the laptop utilized was accessing the retailer via a Virtual Private Network (VPN). This typically characterizes many fraudulent transactions; and typically characterizes few legitimate transactions. Therefore, the system may filter-in, or may keep, only linked transactions (that originated from the same venue or geo-location or IP address) in which a VPN was utilized; thereby filtering-out or discarding previously-tagged transactions that lacked VPN usage.

[0029] Further, the system detects that in the Initial Transaction, a particular Browser type and/or Browser version and/or Operating System (OS) were utilized by criminal Bob, which typically characterize fraudulent transactions and are less-likely features in legitimate transactions. The system may thus filter-in only flagged transactions that utilized the same browser type or browser version or OS, and may filter-out or discard previously-flagged transactions that were performed in the same venue by utilized other browser(s) and/or OS.

[0030] Furthermore, the system may filter-in only flagged transactions that exhibit one or more behavioral features that are known (or, that are pre-defined in the system) as being associated with criminal or fraudulent transactions; and this may be performed even if the Initial Transaction (P0) did not exhibit such behavioral feature(s). For example, the system may define that performing a copy-and-paste of the user’s own name into an online form, is a fraud indicator; as most legitimate users typically type their name whereas many criminals utilize a copy-and-paste operation from a separate document of victim’s data. Therefore, even if the Initial Transaction (P0) did not exhibit copy-and-paste of the user name, and exhibited manual typing of the user name, the system may proceed to filter-in linked transactions (e.g., originating from the save device or IP address or geo-location or venue as transaction P0; or shipping a product to the same destination address as transaction P0; or transferring funds to the same beneficiary as in transaction P0) that exhibit copy-and-paste of the user name.

[0031] Similarly, the system may filter-in only flagged transactions that exhibit one or more device features that are known (or, that are pre-defined in the system) as being associated with criminal or fraudulent transactions; and this may be performed even if the Initial Transaction (P0) did not exhibit such device feature(s). For example, the system may define that utilizing a TOR client or a VPN is a fraud indicator. Therefore, even if the Initial Transaction (P0) did not exhibit utilization of a VPN or of a TOR client, the system may still proceed to filter-in linked transactions (e.g., originating from the save device or IP address or geo-location or venue as transaction P0; or shipping a product to the same destination address as transaction P0; or transferring funds to the same beneficiary as in transaction P0) that exhibited utilization of a TOR client or a VPN.

[0032] For demonstrative purposes, some portions of the discussion herein may relate to detection of Fraud or Fraudulent Transactions, or for coloring or back-coloring or forward coloring of fraud or fraudulent transactions; however, some embodiments of the present invention may similarly be utilized for detecting or coloring or analyzing other types of transactions, for example, illegal transactions, risky transactions, high-risk transactions, transactions that are related to money laundering, transactions that are related to terror activities or to terrorists or to terror funding, transactions that are related to gambling or illegal gambling, transactions that are related to pornography or to illegal pornography, transactions that are related to criminal offenses (e.g., sale or purchase of illegal drugs or illegal goods), transactions that are related to (or that utilize) a“mule” bank account, transactions that are related to currency offences or securities-related offenses or security trading offenses, or the like.

[0033] Reference is made to Fig. 1, which is a schematic block-diagram illustration of a system 100, in accordance with some demonstrative embodiments of the present invention. System 100 may comprise an electronic device 101 able to communicate with a remote server 102, over wired and/or wireless links or network(s), over the Internet, or over other suitable communications medium.

[0034] For demonstrative purposes, certain components are depicted as being implemented in electronic device 101, and are not depicted as part of remote server 102. However, this is only a non-limiting example; and embodiments of the present invention may implement the components of electronic device 101, or some of them, or all of them, also in remote server 102, in addition to (or instead of) being in electronic device 101.

[0035] Electronic device 101 may be, for example, a desktop computer, a laptop computer, a smartphone, a tablet, a smart-watch, a gaming console, a smart television, or other electronic device capable of communicating with a remote entity or remote server.

[0036] Remote server 102 may be or may comprise, for example, a web server, and application server, a cloud-computing server and/or repository and/or database, a server of a bank or banking entity, a server of a retailer or an online retailer or online vendor or online merchant, a server of an email provider or a social network service, or other suitable server which is capable of performing and/or facilitating a transaction that is submitted or entered or requested by the electronic device 101.

[0037] Remote server may comprise, for example, a Transactions Database 151 storing data and meta-data about transactions (e.g., banking transactions, electronic commerce transactions). A Transactions Selector Unit 152 may operate to select transactions from the Transactions Database, based on one or more selection rules or queries; for example, selecting transactions that were performed or submitted from a particular IP address, or device, or device MAC address, or that have a particular shipping name or shipping address, or that have a particular billing name or billing address, or that have a particular beneficiary name or beneficiary address, or the like.

[0038] Electronic device 101, as well as server 102, may comprise suitable hardware components and/or software components, such as: a processor, a memory unit, a storage unit, one or more input units (e.g., mouse, touch-screen, touch-pad, physical keyboard, on-screen keyboard, physical keypad, on-screen keypad), one or more output units (e.g., display unit, screen, monitor, touch-screen, audio speakers), a power source (e.g., internal battery, external battery, rechargeable battery, connection to mains power), communication means (e.g., Wi-Fi transceiver, Bluetooth transceiver, cellular transceiver, Network Interface Card (NIC), wired or wireless modem), an Operating System (OS), drivers, applications, or the like.

[0039] Device 101 may further comprise, for example: an accelerometer 111 able to measure or sense acceleration of device 101; as well as one or more gyroscopes 112 or compass units 113 or other device-orientation sensors 114 able to sense spatial orientation or tilt or slanting of the device 101 or its spatial positioning relative to the ground.

[0040] A user-gestures tracking unit 115 may track, monitor and log the user-gestures performed by a user of device 101 on the entirety of the device (e.g., rotating the device, lifting it, tilting it, spinning it, or the like) and/or on an input unit of the device (e.g., tapping or double tapping on the touchscreen; moving the mouse; clicking the mouse; dragging a finger on the touch-pad; clicking the touch-pad; scrolling the mouse-wheel; or the like). Such user-gestures may be logged, with their time-stamp / date-stamp (e.g., a keypress of the character Ή” occurred at a certain time and date), as well as with contextual or context-based information associated with each user-gesture (for example, a keypress of the character Ή” occurred during filling-out of the Beneficiary field in a wire transfer request form; a tap on the on-screen keyboard of the letter“K” occurred during entry of a recipient address; a paste operation (CTRL-V) occurred within data-entry in a Username field; or the like).

[0041] A user-interactions tracking unit 116 may track, monitor and log the particular interactions that the user performs, without necessarily relating them to the particular input- unit that was used. For example, the unit may track and log that a“submit form” interaction was performed at a certain date and time, in a certain context (e.g., in a“wire transfer request” form), regardless of whether the form was submitted by pressing the Enter key on the keyboard or by clicking on the on-screen Submit button via the computer mouse or via the touch-pad.

[0042] A behavioral characteristics detector 117 may analyze the tracked user interactions and user-gestures, and may deduce or extract or detect one or more particular behavioral characteristics that characterize the gestures and interactions of each user or each usage-session or each transaction. For example, transaction PI performed by user U1 may exhibit the following behavioral characteristics: the entire transaction took 44 seconds from start to finish; the form was submitted by pressing the Enter key; the family name was pasted and not manually typed; the movement among fields in the form was by using the Tab key; the screen was scrolled down using the scroll-wheel of a mouse (and not via the keyboard cursor keys, and not by dragging the scroll bar at the margin of the screen); or the like. Such set of behavioral characteristics may be recorded as being associated with the interactions and gestures that were part of that transaction PI of user Ul. For demonstrative purposes, behavioral characteristics detector 117 is shown as part of remote server 102; for example, operating on data that was transmitted or uploaded from device 101 ; although in other embodiments, behavioral characteristics detector 117 may be implemented (additionally or alternatively) as part of device 101.

[0043] A device properties tracking unit 118 may track, monitor and log the properties of the device 101 itself, during the transaction and/or during particular segments of the transaction. For example, it may record and log that during 90 percent of the duration of the transaction PI of user Ul, the entirety of device 101 was held generally parallel to the ground; during the two seconds of the Submit operation, the device was slanted at 30 degrees relative to the ground; the device was accelerated upwardly during the scrolling of the screen; or the like. Such data may be sensed by, measured by, and collected from the relevant units of the device, for example, the device orientation sensors, gyroscope, compass unit, accelerometer, or the like.

[0044] A device characteristics detector 119 may analyze the tracked device properties, and may deduce or extract or detect one or more particular characteristics or sets of characteristics, that characterize the specific device and its spatial properties during (and/or immediately before and/or immediately after) gestures and interactions of each user or each usage-session or each transaction. For example, transaction PI performed by user U1 may exhibit the following device characteristics: during the filling-out of 90% of the online form, the device was horizontal and parallel to the ground; during the filling out of the family name, the device was vertical and perpendicular to the ground; during the pressing of the Submit on-screen button, the device was slanted at 30 degrees relative to the ground and was also rotated 20 degrees counterclockwise during that touch on the touch-screen. Such set of device characteristics may be recorded as being characteristic of the particular device in conjunction with the interactions and gestures that were part of that transaction PI of user Ul. For demonstrative purposes, device characteristics detector 119 is shown as part of remote server 102; for example, operating on data that was transmitted or uploaded from device 101 ; although in other embodiments, device characteristics detector 119 may be implemented (additionally or alternatively) as part of device 101

[0045] A fraud indicators detector 120 may analyze the tracked user interactions and user- gestures, and may deduce or extract or detect one or more particular behavioral characteristics that are pre-defined in the system as typically characterizing fraudulent transactions and/or criminal transactions, and/or as typically lacking from legitimate non-fraudulent transactions or usage sessions. Such indicators may be, for example: the entire time-period for filling out the form and submitting it is shorter than T seconds (wherein T is a pre-defined threshold value, such as 30 seconds); the First Name, or the Family Name or the zip code, of the user or of the beneficiary or of the shipping name or the billing name or the credit card holder were pasted and not typed manually character by character; the transaction was performed via a VPN connection, or while a TOR client was running; the time or the time-zone of the device (e.g., as queried by the browser) does not match the time or the time-zone that is expected based on geo-location by the IP address (e.g., the IP address indicates geo-location to Russia; but the time or time-zone as queried by the browser or application return a United States time or time zone); or the like. [0046] Optionally, a User Expertise Estimator 121 may operate to deduce or estimate a level of computer savviness or level of expertise of a user associated with a transaction. For example, filling out the entire form in less than T seconds may contribute 1 point of computer savviness; using the Tab key to move among fields in the form may contribute an additional 1 point of computer savviness; using a paste operation (e.g., CTRL-V) in two or more fields may contribute an additional 1 point of computer savviness; submitting a form via the Enter key rather than using a mouse-click may contribute additional two points; using Shift-Tab to go back to a previous field in the same form may contribute 4 additional points (e.g., being a rare and less-known keyboard shortcut); utilizing a Linux operating system may contribute 2 points of computer savviness; and so forth. A user-expertise lookup table (or, a computer savviness lookup table) may be used, with threshold values or ranges-of-values, to correlate between cumulative points and the matching level of expertise or level of computer savviness. For example, a transaction or usage-session that accumulated 10 or more points of computer savviness, may be assigned a High level of computer savviness; whereas, a transaction or usage-session that accumulated 5 to 9 points of computer savviness, may be assigned a Medium level of computer savviness; whereas, a transaction or usage-session that accumulated 0 to 4 points of computer savviness, may be assigned a Low level of computer savviness. In some embodiments, for example, the Initial Transaction (P0) may have a High level of computer savviness; and therefore, the system may enforce a pre-defined rule that discards all possibly- fraudulent transactions, that were linked in one way or another to P0 (e.g., based on same device, or same IP address, or same geo-location venue, or same shipping address, or same beneficiary name, or the like), if such other transactions have a Low level of computer savviness; or, in some embodiments, if such transactions have either Low or Medium level of computer savviness (since the Initial Transaction P0 had a High level).

[0047] In other embodiments, the level of expertise or computer savviness may be utilized even without necessarily relying on that of the Initial Transaction P0; for example, if an Initial Transaction P0 is associated with a Medium level of computer savviness, and the system generates an initial list of 20,000 possibly linked transactions (e.g., based on same device, or same IP address, or same geo-location venue, or same shipping address, or same beneficiary name, or the like), then the system may perform a first narrowing-down or filtering iteration in which all candidate transactions that have Low or Medium level of computer savviness are discarded (even though P0 had a Medium level), in order to reduce significantly the number of possible candidates and to enable the system to focus on the candidate transactions that have a High level of computer expertise. [0048] In some embodiments, optionally, the system may perform a filtering-in process of candidate transactions, based on a mismatch between (i) the estimated level of computer savviness associated with a particular transaction (e.g., transaction P5) based on analysis of tracked user-gestures and user interactions, and (ii) the estimated level of computer savviness associated with that transaction based on age or age -range that is known to the system. For example, Initial Transaction P0 may be linked to hundreds of other possibly-fraudulent transactions, one of them being Transaction P5. The system detects that the level of computer savviness, that is deduced from user-gestures and user-interactions in Transaction P5, match a High level of computer savviness (e.g., having 17 points of computer savviness); however, the system also detects that Transaction P5 is performed by a hank customer which the system already knows to have a date-of-birth indicating that the customer is 83 years old, which typically has Low or Medium (and not High) level of computer savviness. The system may thus detect and declare a Mismatch between those two parameters, and this may be a trigger to keep Transaction P5 in the list of fraud candidate transactions, and to avoid discarding Transaction P5 from that list; or may further cause the system to generate a separate notification alert regarding such mismatch as a stand-alone fraud indicator that warrants blocking of the transaction or the relevant account until further review.

[0049] In some embodiments, an Initial Transaction Feeder 122 (or a Seed Transaction feeder) may receive as input, a pointer or indicator or transaction-number of the Initial Transaction or the Seed Transaction (transaction P0) which is known to be fraudulent. Such input may be fed manually into the system via a fraud investigator; and/or may be fed automatically or semi- automatically (e.g., based on a credit card dispute submitted by a genuine logged-in user who submitted a statement that Transaction P0 was fraudulent and he never performed or authorized it).

[0050] A Related-Transactions List Generator 123 may operate to generate a first-order list of transactions that are possibly related to the Initial Transaction. For example, it may search all the transactions that were performed in the past 12 months before the Initial Transaction, or in the 8 months that preceded and the 7 months that followed the Initial Transaction, and had one or more common properties with the Initial Transaction; such as, same IP address, same device identifier, same device MAC address, same“cookie” data-item, same shipping address, same billing address, same beneficiary name or account number or address, same customer name or address, same geo-location of the IP address, same location or venue, or the like.

[0051] Then, an Iterative List Expander 124 may utilize the initial List of Related Transactions, feeding each transaction on the initial list as a new input into the Related-Transactions List Generator 123; thereby generating a second-order list of related transactions (e.g., twice removed from the original Initial Transaction P0). The Iterative List Expander 124 may repeat the process for N times or N iterations, N being a pre-defined number of iterations (e.g., five iterations), to generate a list which may have thousands or even millions of related transactions, that are N-times removed relative to the original Initial Transaction P0.

[0052] Accordingly, the system of the present invention may perform an iterative process of link analysis and/or transaction analysis and/or usage-session analysis, which iterative expands or grows the list or tree or web of related transactions or usage-sessions , and repeat itself as long as some transactions have common elements with previously-flagged transactions; and in some embodiments, only if such additional transactions feature one or more fraud-related indicators exhibited via negative behavioral characteristics. The list expansion is performed by adding incoming transactions as they are received by the system (e.g., upon their submission by users), and/or by going backwards and searching the database of transactions for past transactions (which had occurred prior to an already-flagged transaction; or which occurred subsequent to an already-flagged transaction), thereby performing a continuous back-looking and forward-looking search and flagging of transactions.

[0053] In accordance with the iterative behaviorally- validated link analysis or session analysis or transaction analysis or fraud detection process of the present invention, once a new transaction is recorded or received or submitted to the system, the process checks (i) whether one or more of the transaction elements are the same as those of another transaction that already appears in any already-flagged transaction on the current link analysis list, and further checks (ii) whether the new transaction demonstrates one or more behavioral characteristics that are pre-defined in the system as being fraud-related or as being risk factors (e.g., in the fresh transaction, the user pasted his first name instead of typing it manually); and upon positive results of these checks, the process adds the new transactions to the list of fraud candidates; and all of its elements that might be potentially linked to other transactions are checked and analyzed: those that have already been recognized before as known to be fraud-related may be ignored, while elements that are new and were not yet used (e.g. the usage-session of the fresh transaction was performed by the same end-device as an already-flagged transaction on the list, but the IP address of the fresh transaction was not seen in any other transaction on the list are then added as fraud candidates and are utilized for further iterative linking and coloring, searching back in the transaction history to find all transactions that were submitted from that new IP address of the new transaction (and which also exhibited at least one behavioral characteristic that is pre-defined as risky behavior or as fraud-related). Then, in an iterative manner, the process analyzes the elements of those newly-added transactions, to further expand the list and to grow the list or tree or web of fraud-candidate transactions or usage-sessions.

[0054] A List Filtering Unit 125 may then operate on the generate list, to filter-out (discard, remove, delete) certain transactions and/or to filter-in (keep, maintain) certain other transactions, based on one or more pre-defined Filtering Rules 126. Optionally, a Filtering- Out Unit 125 A may be responsible for performing filtering-out (discarding) of candidate transactions; whereas, a Filtering-In Unit 125B may be responsible for performing filtering-in (keeping) of candidate transactions.

[0055] For example, the enforcement of the filtering rules may cause the system to keep only candidate transactions that exhibit the same behavioral characteristics and/or device properties that were identified in the Initial Transaction P0; and to discard candidate transactions that do not exhibit those. Additionally or alternatively, the filtering rules may enforce filtering-in and keeping candidate transactions that exhibit criminal indictors or fraud-related indicators, and filtering-our or discarding of transactions that lack any criminal indicators or fraud-related indicators.

[0056] A Filtered List Generator 127 may then output a filtered list, which is shorter or significantly shorter relative to the initial list(s), which now reflects linked transactions and/or linked sessions and/or back-colored transactions and/or forward-colored transactions that are estimated to have Fiigh Probability of being fraudulent.

[0057] The Filtered List may be transferred to a Fraud Mitigation Unit 128 or other module or component, which may perform one or more operations, such as: generating and sending notification(s) to the user and/or account owner and/or bank and/or retailer and/or merchant and/or credit card company; flagging a transaction and/or an account as Fraudulent; blocking or suspending or freezing a transaction or an account or a user; reversing a transaction, canceling a transaction, modifying a transaction; requiring a user (e.g., via email, text message email) to contact a customer service representative or a fraud department in order to authenticate and to approve or dispute a transaction; triggering a two-factor or multi-factor authentication with regard to a transaction or an account; sending a notification to a law enforcement agency or a loss prevention department; or the like.

[0058] In some embodiments, the filtering of linked transaction may be performed retroactively or in retrospect, with regard to already-performed or already-submitted transactions, that were submitted and/or performed hours or days or even months before the Initial Transactions; thereby back-coloring certain past transaction as fraudulent, based on their relation to an Initial Transaction that was recently determined to be fraudulent. In other embodiments, forward-coloring may be performed by the system; for example, the system operates on July 1, and determines that an Initial Transaction that occurred on June 14 was fraudulent; the system may perform back-coloring of related transactions performed before June 14, and the system may perform forward-coloring of related transactions performed after June 14, based on the relation of those transactions to the Initial Transaction of June 14, and while enforcing the filtering-in and filtering-out rules as described. In some embodiments, optionally, the system may operate in real-time or in near-real-time; such that, for example, a fresh transaction is submitted (e.g., a fresh wire transfer request towards a banking website); the fresh transaction is immediately determined to be fraudulent (e.g., since the beneficiary name and address appear in a pre-defined black-list of known criminals); then, immediately, a database of past transactions is searched for related past transactions, that feature one or more similarities to the fresh transaction (e.g., same IP address, same device, same paying entity, same amount, same textual description of the wire transfer, same geo-location or venue, or the like); then, a rapid analysis is performed, in near-real-time, of the behavioral characteristics and device properties and fraud indicators of the fresh transaction; and filtering-in and filtering- out is performed rapidly by the system with regard to related past transactions; thereby enabling the system to generate, within few seconds of blocking a fresh fraudulent transaction, a filtered concise list of past transactions that are similarly estimate to be fraudulent.

[0059] In some embodiments, the tracking and/or monitoring and/or recording and/or logging of user-gestures and/or user interactions and/or device properties, may be performed or implemented by utilizing client-side / device-side components or modules or units, and/or server-side components or modules or units, and/or based on a combination thereof. For example, in some embodiments, an application or“app” or“mobile app” of a bank or an online retailer, may be implemented to comprise a client-side module or code or program that tracks and logs user-gestures and user interactions and device properties (e.g., recording keystrokes, screen taps, device tilting, device acceleration, or the like); and such collected data may then be stored and/or analyzed locally within the end-device itself, and/or may be transmitted or uploaded to a remote server for remote storage and/or analysis there. In other embodiments, the tracking and logging functionality may be built-in into a smartphone or tablet, or may be part of an Operating System, to provide a secure or a more secure user experience that protects users against fraudulent transactions in their accounts; for example, legitimate user Charles may concur that his smartphone and/or his banking application would track his user-gestures and interactions, in order to better protect his bank account against fraudulent transactions by third party attackers. In other embodiments, the tracking and logging may be implemented via program code, such as using HTML5 and/or JavaScript and/or CSS, which may be injected or inserted or embedded into a web-page or web-site (e.g., a banking website), thereby performing such client-side tracking and monitoring; and optionally also uploading or sending the recorded data to a remote server for further storage and/or analysis there. In some embodiments, additionally or alternatively, some functionalities may be implemented as using server-side components or architecture; for example, a“Submit” button may be originally served to the browser as a set of three button-parts, thereby enabling the remote server to detect by itself whether the user clicked on the right side or the left side or the middle side of the Submit button, thereby enabling the server to later perform session linking and/or back-coloring and/or forward-coloring by taking into account the region within the Submit button that was tapped or clicked. In other embodiments, some functionalities may be integrated into a web browser, or may be part of a browser extension or plug-in or add-on; or may be a stand-alone software application or a companion application (similar to the way that an anti-virus application is a stand-alone application that provides auxiliary protection). Other suitable implementations may be used.

[0060] In some embodiments, a Population Scarcity Unit 129 may optionally operate to ensure that the system utilizes only behavioral characteristics and/or device features and/or fraud- related features, that are relatively rare or scarce (e.g., below a pre-defined threshold value or ratio) in the general population of users, or in the general population of legitimate users (e.g., associated with a pool of past transactions that are known to be legitimate or non-fraudulent; since, for example, they occurred N years ago and were not disputed by any customer). In a first example, the system may detect that during the submission of the Initial Transaction (P0), the criminal user had moved the on-screen pointer in curved counter-clockwise motions when moving from field to field in the form; however, the system may also know, based on data collected from tracking user-gestures across numerous (e.g., thousands, or tens-of-thousands) of legitimate sessions, that such movement characterizes 45 percent of users in the general population; therefore, the system may determine that this feature, which is still unique to the criminal that performed the Initial Transaction, would not be utilized as a differentiator or as a filtering rule for deciding whether a candidate-fraud transaction should be maintained or discarded, since the Scarcity or Rareness of this behavioral feature is beyond a pre-defined threshold value; for example, the system may be configured to utilize only behavioral features that appear in N percent or less of the general population of users, such as, 15 or 10 or 5 percent or less of the general population of users. In a second example, the system may determine that the Initial Transaction (P0) was performed by the Opera web browser on a Linux operating system; and that this combination of browser type and OS type characterizes only two percent of the general population of legitimate users; and that this combination of browser type and OS type characterizes 34 percent of fraudulent transactions; and therefore, the system may determine to indeed utilize this combination of device features in order to filter-in candidate- fraud transactions that exhibit them. In contrast, if the Initial Transaction was submitted via a Chrome web browser on Microsoft (RTM) Windows (RTM) operating system, then the system may determine not to utilize this combination of features as a filtering rule, since they are known by the system to be non-rare or non-scarce in the general population of users, or since they are not sufficiently rare to enable reliable reliance on them.

[0061] In some embodiments, the behavioral-validated filtering or selecting of transactions, may be performed, for example, by filtering-in only transactions that feature one or more behavioral characteristics that are a-prior defined in the system (e.g., in a list of rules, or a lookup table) as being Frequent among the population of hackers or criminals or“fraudsters” or fraudulent transactions (e.g., known to characterize at least N1 percent of that population and/or of transactions that are Known to be fraudulent; such as, appearing in at least 50 or 25 percent), and at the same time, are a-priori defined in the system (e.g., in a list of rules, or a lookup table) as being Rare or Scarce among the population of legitimate users and/or legitimate transactions (e.g., known to characterize not more than N2 percent of that populations and/or of transactions that are Known to be legitimate, such as, appearing in no more than 5 or 7 percent of such transactions). For example, the characteristic of“utilization of Linux” may not be sufficiently rare in the population of legitimate users or legitimate transactions, and thus may Not be utilized By Itself as a filtering rule; however, the Combined set of characteristics of, for example,“utilization of Linux, and also utilization of Firefox browser version 64, and also utilization of a VPN, and also utilization of a TOR client”, may be defined in the system as a-priori characterizing 36 percent of fraudulent transactions yet also characterizing only 1 percent of legitimate users; and therefore this Set of Characteristics may be used as a filtering rule. In another example, performing a Paste operation of the Family Name of the user, together with using a keyboard shortcut of Shift + Tab to move the on-screen cursor to a previous on-screen field, may be defined by the system as a-priori being associated with fraudulent transactions and not with legitimate transaction; Not because 90% of hackers or fraudsters do it, but rather, because the system may had already observed that in 98 of the transactions in which those characteristics were detected, it was determined that the transaction was fraudulent; whereas, in only 2 percent of the transactions in which those characteristics were detected, it was determined that the transaction was legitimate. Therefore, the Scarcity or Frequency of a set of characteristics, need not necessarily be checked relative to the general population of users (legitimate or fraudulent); but rather, may be checked against a pre-defined lookup table that indicates that a particular characteristic, or a particular Set of Characteristics, that had been detected in 100 transactions, was such that 99 of those 100 transactions were fraudulent; and therefore this characteristic or this set of characteristics is suitable for basing behavioral-validation filtering (or discarding) of transactions.

[0062] In some embodiments, a method comprises: (a) receiving an indicator of a seed transaction known to be fraudulent; (b) selecting, from a database of transactions, multiple transactions that share at least one common property with said seed transaction; and generating a list of candidate fraudulent transactions; (c) filtering the candidate fraudulent transactions, by applying a transaction filtering rule that is based on one or more behavioral characteristics; and generating a filtered list of candidate fraudulent transactions. In some embodiments, step (b) may be optional, such that the system may be pre-provided with a Single seed transaction that is known to be fraudulent, and with a Group of candidate transactions that may or may not be fraudulent; and then, behavioral-validation filtering of such transactions may be performed, to generate a Subset from that original Group of transactions.

[0063] In some embodiments, the filtering of claim (c) comprises: (cl) determining a behavioral characteristic that characterized user-gestures during entry of said seed transaction; (c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that lack said behavioral characteristic.

[0064] In some embodiments, the filtering of claim (c) comprises: (cl) determining a behavioral characteristic that characterized user-gestures during entry of said seed transaction; wherein said behavioral characteristic indicates that a user of the seed transaction utilized a particular keyboard shortcut for data-entry during the seed transaction; (c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that lack said behavioral characteristic.

[0065] In some embodiments, the filtering of claim (c) comprises: (cl) determining a behavioral characteristic that characterized user-gestures during entry of said seed transaction; wherein said behavioral characteristic indicates that a user of the seed transaction utilized a particular way for submitting an online form during the seed transaction; (c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that lack said behavioral characteristic.

[0066] In some embodiments, the filtering of claim (c) comprises: (cl) determining a behavioral characteristic that characterized user-gestures during entry of said seed transaction; wherein said behavioral characteristic indicates that a user of the seed transaction utilized a particular way for moving between fields of an online form during the seed transaction; (c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that lack said behavioral characteristic.

[0067] In some embodiments, the filtering of claim (c) comprises: (cl) determining spatial device properties that characterized an electronic device during entry of said seed transaction through said electronic device; (c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that do not exhibit said spatial device properties.

[0068] In some embodiments, the filtering of claim (c) comprises: (cl) determining spatial device-acceleration properties that characterized an electronic device during entry of said seed transaction through said electronic device; (c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that do not exhibit said spatial device- acceleration properties.

[0069] In some embodiments, the filtering of claim (c) comprises: (cl) determining spatial device-orientation properties that characterized an electronic device during entry of said seed transaction through said electronic device; (c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that do not exhibit said spatial device-orientation properties.

[0070] In some embodiments, the filtering of claim (c) comprises: (cl) determining that user- gestures in said seed transaction, exhibited a first behavioral characteristic and a second behavioral characteristic; (c2) determining that the first behavioral characteristic that was exhibited in the seed transaction, is sufficiently scarce in the general population of users, based on a pre-defined threshold value of scarcity; (c3) determining that the second behavioral characteristic that was exhibited in the seed transaction, is not sufficiently scarce in the general population of users, based on the pre-defined threshold value of scarcity; (c4) performing filtering of candidate fraudulent transactions, based only on said first behavioral characteristic which is sufficiently scarce, and not based on said second behavioral characteristic that is not sufficiently scarce.

[0071] In some embodiments, the filtering of claim (c) comprises: (cl) determining that device properties in said seed transaction, exhibited a first device-characteristic and a second device characteristic; (c2) determining that the first device-characteristic that was exhibited in the seed transaction, is sufficiently scarce in the general population of users, based on a pre-defined threshold value of scarcity; (c3) determining that the second device-characteristic that was exhibited in the seed transaction, is not sufficiently scarce in the general population of users, based on the pre-defined threshold value of scarcity; (c4) performing filtering of candidate fraudulent transactions, based only on said first device-characteristic which is sufficiently scarce, and not based on said second device-characteristic that is not sufficiently scarce.

[0072] In some embodiments, the filtering of claim (c) comprises: (cl) analyzing user-gestures that were collected during said seed transaction, and detecting a particular set of behavioral features that are pre-defined as characterizing fraudulent usage-sessions; (c2) filtering-in said list of candidate fraudulent transactions, to maintain therein only candidate fraudulent transactions that exhibit said particular set of behavioral features.

[0073] In some embodiments, the filtering of claim (c) comprises: (cl) analyzing session properties that characterized a usage-session in which said seed transaction was entered; and detecting a particular set of device properties that are pre-defined as characterizing fraudulent usage-sessions; (c2) filtering-in said list of candidate fraudulent transactions, to maintain therein only candidate fraudulent transactions that exhibit said particular set of device properties.

[0074] In some embodiments, the method comprises: based on a table of pre-defined fraud indicators, that characterize online behavior of users that perform fraudulent activity, filtering- out from said list of candidate fraudulent transactions, one or more candidate transactions that lack any pre-defined fraud indicator other than being related to said seed transaction.

[0075] In some embodiments, the method comprises: filtering-out, from said list of candidate fraudulent transactions, one or more candidate fraud transactions whose user-gestures exhibit a level of computer savviness that is smaller than a pre-defined threshold value.

[0076] In some embodiments, the method comprises: based on analysis of user-gestures and user interactions of said seed transaction, determining a level of computer savviness of a user that performed said seed transaction; filtering-out, from said list of candidate fraudulent transactions, one or more candidate fraud transactions that exhibit a level of computer savviness that is smaller than said level of computer savviness that said user exhibited in said seed transaction.

[0077] In some embodiments, the selecting of step (b) comprises: iteratively expanding said list of candidate fraudulent transactions, by selecting from said database of transactions, an additional transaction that shares with said seed transaction at least one of: same Internet Protocol (IP) address, same device, same MAC address, same cookie, same beneficiary, same shipping address, same billing address, same first name and same family name, same geo location venue. [0078] In some embodiments, the selecting of step (b) comprises: iteratively expanding said list of candidate fraudulent transactions, by selecting from said database of transactions, an additional transaction that shares with said seed transaction at least one of: same Internet Protocol (IP) address, same device, same MAC address, same cookie, same beneficiary, same shipping address, same billing address, same first name and same family name, same geo location venue; wherein said additional transaction is added to said list of candidate fraudulent transactions only if a usage-session of said additional transaction comprises at least one behavioral characteristic that is pre-defined as being fraud-related.

[0079] In some embodiments, the selecting of step (b) comprises: iteratively expanding said list of candidate fraudulent transactions, by selecting from said database of transactions, an additional transaction that shares with said seed transaction at least one of: same Internet Protocol (IP) address, same device, same MAC address, same cookie, same beneficiary, same shipping address, same billing address, same first name and same family name, same geo location venue; wherein said additional transaction is added to said list of candidate fraudulent transactions only if a usage-session of said additional transaction comprises at least one behavioral characteristic that was also extracted from the usage-session of the seed transaction.

[0080] In some embodiments, the selecting of step (b) comprises: iteratively expanding said list of candidate fraudulent transactions, by selecting from said database of transactions, an additional transaction that shares with said seed transaction at least one of: same Internet Protocol (IP) address, same device, same MAC address, same cookie, same beneficiary, same shipping address, same billing address, same first name and same family name, same geo location venue; wherein said additional transaction is added to said list of candidate fraudulent transactions only if a usage-session of said additional transaction comprises at least one device usage property that is pre-defined as being fraud-related.

[0081] In some embodiments, the method comprises: iteratively expanding said list of candidate fraudulent transactions, by performing: back-coloring of transactions, that occurred prior to said seed transactions, as behaviorally-validated prior fraudulent transactions; and forward-coloring of transactions, that occurred subsequent to said seed transactions, as behaviorally-validated subsequent fraudulent transactions.

[0082] In some embodiments, the method comprises: iteratively expanding said list of candidate-fraud transactions; and iteratively filtering expanded lists of candidate-fraud transactions by applying behavioral validation rules.

[0083] Although portions of the discussion herein relate, for demonstrative purposes, to wired links and/or wired communications, some embodiments of the present invention are not limited in this regard, and may include one or more wired or wireless links, may utilize one or more components of wireless communication, may utilize one or more methods or protocols of wireless communication, or the like. Some embodiments may utilize wired communication and/or wireless communication.

[0084] The present invention may be implemented by using hardware units, software units, processors, CPUs, DSPs, integrated circuits, memory units, storage units, wireless communication modems or transmitters or receivers or transceivers, cellular transceivers, a power source, input units, output units, Operating System (OS), drivers, applications, and/or other suitable components.

[0085] The present invention may be implemented by using a special-purpose machine or a specific -purpose that is not a generic computer, or by using a non-generic computer or a non general computer or machine. Such system or device may utilize or may comprise one or more units or modules that are not part of a“generic computer” and that are not part of a“general purpose computer”, for example, cellular transceivers, cellular transmitter, cellular receiver, GPS unit, location-determining unit, accelerometer(s), gyroscope(s), device-orientation detectors or sensors, device-positioning detectors or sensors, or the like.

[0086] The present invention may be implemented by using code or program code or machine- readable instructions or machine -readable code, which is stored on a non-transitory storage medium or non-transitory storage article (e.g., a CD-ROM, a DVD-ROM, a physical memory unit, a physical storage unit), such that the program or code or instructions, when executed by a processor or a machine or a computer, cause such device to perform a method in accordance with the present invention.

[0087] The present invention may enable machines and/or computerized systems to have new capabilities and/or new functions that were not available to such machines or systems so far; including, for example: a new capability to correctly differentiate among multiple human users; a new capability for machines or computerized systems to differentiate between (I) a legitimate or“naive” user, and (II) a fraudster or a human user having criminal intent or an illegitimate user; a new capability for machines or computerized systems allowing the machine or the computerized system to defend itself or to protect itself against cyber-attacks and/or illegitimate operations, and/or against impostors or identity-thieves or dishonest users; a new capability for machines or computerized systems to correctly identify and/or detect that a current user of an online resource or an online destination, is not the same human user that had accessed the same resource previously, even if the two access sessions were performed via the same device and/or via the same browser or application and/or from the same IP address and/or when the user/s are already logged-in and/or are already authenticated; a new capability for machines or computerized systems to defend or protect themselves against fraudulent transactions or criminal behavior or against hackers, crackers, human hackers, automated hacking tools,“hot” or other automated scripts; a new capability for machines or computerized systems to initiate and to perform fraud-mitigation operations based on analysis of user interactions; improved security and/or integrity and/or reliability of machines and computerized systems; and/or other new capabilities that conventional machines and conventional computerized systems do not have and that the present invention provides.

[0088] Embodiments of the present invention may be utilized with a variety of devices or systems having a touch-screen or a touch-sensitive surface; for example, a smartphone, a cellular phone, a mobile phone, a smart-watch, a tablet, a handheld device, a portable electronic device, a portable gaming device, a portable audio/video player, an Augmented Reality (AR) device or headset or gear, a Virtual Reality (VR) device or headset or gear, a“kiosk” type device, a vending machine, an Automatic Teller Machine (ATM), a laptop computer, a desktop computer, a vehicular computer, a vehicular dashboard, a vehicular touch-screen, or the like.

[0089] Although portions of the discussion herein relate, for demonstrative purposes, to wired links and/or wired communications, some embodiments of the present invention are not limited in this regard, and may include one or more wired or wireless links, may utilize one or more components of wireless communication, may utilize one or more methods or protocols of wireless communication, or the like. Some embodiments may utilize wired communication and/or wireless communication.

[0090] The system(s) and/or device(s) of the present invention may optionally comprise, or may be implemented by utilizing suitable hardware components and/or software components; for example, processors, processor cores, Central Processing Units (CPUs), Digital Signal Processors (DSPs), circuits, Integrated Circuits (ICs), controllers, memory units, registers, accumulators, storage units, input units (e.g., touch-screen, keyboard, keypad, stylus, mouse, touchpad, joystick, trackball, microphones), output units (e.g., screen, touch-screen, monitor, display unit, audio speakers), acoustic microphone(s) and/or sensor(s), optical microphone(s) and/or sensor(s), laser or laser-based microphone(s) and/or sensor(s), wired or wireless modems or transceivers or transmitters or receivers, GPS receiver or GPS element or other location-based or location-determining unit or system, network elements (e.g., routers, switches, hubs, antennas), and/or other suitable components and/or modules.

[0091] The system(s) and/or devices of the present invention may optionally be implemented by utilizing co-located components, remote components or modules, “cloud computing” servers or devices or storage, client/server architecture, peer-to-peer architecture, distributed architecture, and/or other suitable architectures or system topologies or network topologies.

[0092] In accordance with embodiments of the present invention, calculations, operations and/or determinations may be performed locally within a single device, or may be performed by or across multiple devices, or may be performed partially locally and partially remotely (e.g., at a remote server) by optionally utilizing a communication channel to exchange raw data and/or processed data and/or processing results.

[0093] Some embodiments may be implemented by using a special-purpose machine or a specific -purpose device that is not a generic computer, or by using a non-generic computer or a non-general computer or machine. Such system or device may utilize or may comprise one or more components or units or modules that are not part of a“generic computer” and that are not part of a “general purpose computer”, for example, cellular transceivers, cellular transmitter, cellular receiver, GPS unit, location-determining unit, accelerometer(s), gyroscope(s), device-orientation detectors or sensors, device-positioning detectors or sensors, or the like.

[0094] Some embodiments may be implemented as, or by utilizing, an automated method or automated process, or a machine-implemented method or process, or as a semi-automated or partially-automated method or process, or as a set of steps or operations which may be executed or performed by a computer or machine or system or other device.

[0095] Some embodiments may be implemented by using code or program code or machine- readable instructions or machine-readable code, which may be stored on a non-transitory storage medium or non-transitory storage article (e.g., a CD-ROM, a DVD-ROM, a physical memory unit, a physical storage unit), such that the program or code or instructions, when executed by a processor or a machine or a computer, cause such processor or machine or computer to perform a method or process as described herein. Such code or instructions may be or may comprise, for example, one or more of: software, a software module, an application, a program, a subroutine, instructions, an instruction set, computing code, words, values, symbols, strings, variables, source code, compiled code, interpreted code, executable code, static code, dynamic code; including (but not limited to) code or instructions in high-level programming language, low-level programming language, object-oriented programming language, visual programming language, compiled programming language, interpreted programming language, C, C++, C#, Java, JavaScript, SQL, Ruby on Rails, Go, Cobol, Fortran, ActionScript, AJAX, XML, JSON, Lisp, Eiffel, Verilog, Hardware Description Language (HDL, BASIC, Visual BASIC, Matlab, Pascal, HTML, HTML5, CSS, Perl, Python, PHP, machine language, machine code, assembly language, or the like.

[0096] Discussions herein utilizing terms such as, for example,“processing”,“computing”, “calculating”, “determining”, “establishing”, “analyzing”, “checking”, “detecting”, “measuring”, or the like, may refer to operation(s) and/or process(es) of a processor, a computer, a computing platform, a computing system, or other electronic device or computing device, that may automatically and/or autonomously manipulate and/or transform data represented as physical (e.g., electronic) quantities within registers and/or accumulators and/or memory units and/or storage units into other data or that may perform other suitable operations.

[0097] Some embodiments of the present invention may perform steps or operations such as, for example,“determining”,“identifying”,“comparing”,“checking”,“querying”,“searching”, “matching”, and/or“analyzing”, by utilizing, for example: a pre-defined threshold value to which one or more parameter values may be compared; a comparison between (i) sensed or measured or calculated value(s), and (ii) pre-defined or dynamically-generated threshold value(s) and/or range values and/or upper limit value and/or lower limit value and/or maximum value and/or minimum value; a comparison or matching between sensed or measured or calculated data, and one or more values as stored in a look-up table or a legend table or a list of reference value(s) or a database of reference values or ranges; a comparison or matching or searching process which searches for matches and/or identical results and/or similar results and/or sufficiently-close results, among multiple values or limits that are stored in a database or look-up table; utilization of one or more equations, formula, weighted formula, and/or other calculation in order to determine similarity or a match between or among parameters or values; utilization of comparator units, lookup tables, threshold values, conditions, conditioning logic, Boolean operator(s) and/or other suitable components and/or operations.

[0098] The terms“plurality” and“a plurality”, as used herein, include, for example,“multiple” or“two or more”. For example,“a plurality of items” includes two or more items.

[0099] References to“one embodiment”,“an embodiment”,“demonstrative embodiment”, “various embodiments”,“some embodiments”, and/or similar terms, may indicate that the embodiment(s) so described may optionally include a particular feature, structure, or characteristic, but not every embodiment necessarily includes the particular feature, structure, or characteristic. Repeated use of the phrase“in one embodiment” does not necessarily refer to the same embodiment, although it may. Repeated use of the phrase“in some embodiments” does not necessarily refer to the same set or group of embodiments, although it may. [00100] As used herein, and unless otherwise specified, the utilization of ordinal adjectives such as“first”,“second”,“third”,“fourth”, and so forth, to describe an item or an object, merely indicates that different instances of such like items or objects are being referred to; and does not intend to imply as if the items or objects so described must be in a particular given sequence, either temporally, spatially, in ranking, or in any other ordering manner.

[00101] Some embodiments may comprise, or may be implemented by using, an“app” or application which may be downloaded or obtained from an“app store” or“applications store”, for free or for a fee, or which may be pre-installed on a computing device or electronic device, or which may be transported to and/or installed on such computing device or electronic device.

In some embodiments, a method comprises: (a) monitoring user interactions of a user that [00102] Functions, operations, components and/or features described herein with reference to one or more embodiments of the present invention, may be combined with, or may be utilized in combination with, one or more other functions, operations, components and/or features described herein with reference to one or more other embodiments of the present invention. The present invention may comprise any possible combinations, re-arrangements, assembly, re-assembly, or other utilization of some or all of the modules or functions or components that are described herein, even if they are discussed in different locations or different chapters of the above discussion, or even if they are shown across different drawings or multiple drawings, or even if they are depicted in any drawing(s) without necessarily being connected via a line or an arrow.

[00103] While certain features of the present invention have been illustrated and described herein, many modifications, substitutions, changes, and equivalents may occur to those skilled in the art. Accordingly, the claims are intended to cover all such modifications, substitutions, changes, and equivalents.

Claims

CLAIMS What is claimed is:

1. A method comprising:

(a) receiving an indicator of a seed transaction known to be fraudulent;

(b) selecting, from a database of transactions, multiple transactions that share at least one common property with said seed transaction; and generating a list of candidate fraudulent transactions;

(c) filtering the candidate fraudulent transactions, by applying a transaction filtering rule that is based on one or more behavioral characteristics; and generating a filtered list of candidate fraudulent transactions.

2. The method of claim 1,

wherein the filtering of claim (c) comprises:

(cl) determining a behavioral characteristic that characterized user-gestures during entry of said seed transaction;

(c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that lack said behavioral characteristic.

3. The method of any one of claims 1-2,

wherein the filtering of claim (c) comprises:

(cl) determining a behavioral characteristic that characterized user-gestures during entry of said seed transaction; wherein said behavioral characteristic indicates that a user of the seed transaction utilized a particular keyboard shortcut for data-entry during the seed transaction; (c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that lack said behavioral characteristic.

4. The method of any one of claims 1-3,

wherein the filtering of claim (c) comprises:

(cl) determining a behavioral characteristic that characterized user-gestures during entry of said seed transaction; wherein said behavioral characteristic indicates that a user of the seed transaction utilized a particular way for submitting an online form during the seed transaction; (c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that lack said behavioral characteristic.

5. The method of any one of claims 1-4,

wherein the filtering of claim (c) comprises:

(cl) determining a behavioral characteristic that characterized user-gestures during entry of said seed transaction; wherein said behavioral characteristic indicates that a user of the seed transaction utilized a particular way for moving between fields of an online form during the seed transaction;

6. The method of any one of clai s 1-5,

wherein the filtering of claim (c) comprises:

(cl) determining spatial device properties that characterized an electronic device during entry of said seed transaction through said electronic device;

(c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that do not exhibit said spatial device properties.

7. The method of any one of claims 1-6,

wherein the filtering of claim (c) comprises:

(cl) determining spatial device-acceleration properties that characterized an electronic device during entry of said seed transaction through said electronic device;

(c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that do not exhibit said spatial device-acceleration properties.

8. The method of any one of claims 1-7,

wherein the filtering of claim (c) comprises:

(cl) determining spatial device-orientation properties that characterized an electronic device during entry of said seed transaction through said electronic device;

(c2) filtering-out from said list of candidate fraudulent transactions, one or more candidate fraudulent transactions that do not exhibit said spatial device-orientation properties.

9. The method of any one of clai s 1-8,

wherein the filtering of claim (c) comprises:

(cl) determining that user-gestures in said seed transaction, exhibited a first behavioral characteristic and a second behavioral characteristic;

(c2) determining that the first behavioral characteristic that was exhibited in the seed transaction, is sufficiently scarce in the general population of users, based on a pre-defined threshold value of scarcity;

(c3) determining that the second behavioral characteristic that was exhibited in the seed transaction, is not sufficiently scarce in the general population of users, based on the pre defined threshold value of scarcity;

(c4) performing filtering of candidate fraudulent transactions, based only on said first behavioral characteristic which is sufficiently scarce, and not based on said second behavioral characteristic that is not sufficiently scarce.

10. The method of any one of claims 1-9,

wherein the filtering of claim (c) comprises:

(cl) determining that device properties in said seed transaction, exhibited a first device characteristic and a second device-characteristic;

(c2) determining that the first device-characteristic that was exhibited in the seed transaction, is sufficiently scarce in the general population of users, based on a pre-defined threshold value of scarcity;

(c3) determining that the second device-characteristic that was exhibited in the seed transaction, is not sufficiently scarce in the general population of users, based on the pre defined threshold value of scarcity;

(c4) performing filtering of candidate fraudulent transactions, based only on said first device-characteristic which is sufficiently scarce, and not based on said second device characteristic that is not sufficiently scarce.

11. The method of any one of claims 1-10, wherein the filtering of claim (c) comprises:

(cl) analyzing user-gestures that were collected during said seed transaction, and detecting a particular set of behavioral features that are pre-defined as characterizing fraudulent usage- sessions;

(c2) filtering-in said list of candidate fraudulent transactions, to maintain therein only candidate fraudulent transactions that exhibit said particular set of behavioral features.

12. The method of any one of claims 1-11, wherein the filtering of claim (c) comprises:

(cl) analyzing session properties that characterized a usage-session in which said seed transaction was entered; and detecting a particular set of device properties that are pre-defined as characterizing fraudulent usage-sessions;

(c2) filtering-in said list of candidate fraudulent transactions, to maintain therein only candidate fraudulent transactions that exhibit said particular set of device properties.

13. The method of any one of claims 1-12, comprising:

based on a table of pre-defined fraud indicators, that characterize online behavior of users that perform fraudulent activity, filtering-out from said list of candidate fraudulent transactions, one or more candidate transactions that lack any pre-defined fraud indicator other than being related to said seed transaction.

14. The method of any one of claims 1-13, further comprising:

filtering-out, from said list of candidate fraudulent transactions, one or more candidate fraud transactions whose user-gestures exhibit a level of computer savviness that is smaller than a pre-defined threshold value.

15. The method of any one of claims 1-14, further comprising:

based on analysis of user-gestures and user interactions of said seed transaction, determining a level of computer savviness of a user that performed said seed transaction; filtering-out, from said list of candidate fraudulent transactions, one or more candidate fraud transactions that exhibit a level of computer savviness that is smaller than said level of computer savviness that said user exhibited in said seed transaction.

16. The method of any one of claims 1-15, wherein the selecting of step (b) comprises: iteratively expanding said list of candidate fraudulent transactions, by selecting from said database of transactions, an additional transaction that shares with said seed transaction at least one of:

same Internet Protocol (IP) address, same device,

same MAC address, same cookie,

same beneficiary, same shipping address,

same billing address, same first name and same family name, same geo-location venue.

17. The method of any one of clai s 1-16,

wherein the selecting of step (b) comprises:

iteratively expanding said list of candidate fraudulent transactions, by selecting from said database of transactions, an additional transaction that shares with said seed transaction at least one of:

same Internet Protocol (IP) address, same device,

same MAC address, same cookie,

same beneficiary, same shipping address,

same billing address, same first name and same family name, same geo-location venue;

wherein said additional transaction is added to said list of candidate fraudulent transactions only if a usage-session of said additional transaction comprises at least one behavioral characteristic that is pre-defined as being fraud-related.

18. The method of any one of claims 1-17,

wherein the selecting of step (b) comprises:

same Internet Protocol (IP) address, same device,

same MAC address, same cookie,

same beneficiary, same shipping address,

wherein said additional transaction is added to said list of candidate fraudulent transactions only if a usage-session of said additional transaction comprises at least one behavioral characteristic that was also extracted from the usage-session of the seed transaction.

19. The method of any one of claims 1-18,

wherein the selecting of step (b) comprises:

iteratively expanding said list of candidate fraudulent transactions, by selecting from said database of transactions, an additional transaction that shares with said seed transaction at least one of: same Internet Protocol (IP) address, same device,

same MAC address, same cookie,

same beneficiary, same shipping address,

wherein said additional transaction is added to said list of candidate fraudulent transactions only if a usage-session of said additional transaction comprises at least one device usage property that is pre-defined as being fraud-related.

20. The method of any one of claims 1-19, comprising:

iteratively expanding said list of candidate fraudulent transactions, by performing: back-coloring of transactions, that occurred prior to said seed transactions, as behaviorally-validated prior fraudulent transactions; and

forward-coloring of transactions, that occurred subsequent to said seed transactions, as behaviorally-validated subsequent fraudulent transactions.

21. The method of any one of claims 1-20, comprising:

iteratively expanding said list of candidate-fraud transactions; and

iteratively filtering expanded lists of candidate-fraud transactions by applying behavioral validation rules.

22. A system comprising:

a memory unit to store code;

a hardware processor to execute said code;

wherein the hardware processor is configured or adapted

(a) to receive an indicator of a seed transaction known to be fraudulent;

(b) to select, from a database of transactions, multiple transactions that share at least one common property with said seed transaction; and generating a list of candidate fraudulent transactions;

(c) to filter the candidate fraudulent transactions, by applying a transaction filtering rule that is based on one or more behavioral characteristics; and to generate a filtered list of candidate fraudulent transactions.