DETAILED DESCRIPTION OF THE INVENTION

[0007] 1. Mouse Movement Analysis

[0008] In this detector mouse actions are recorded and processed on a real time basis, movement characteristics being analyzed to produce a set of factors characterizing the behavior, the aim of the research work in this area is to produce what is called a mouse dynamics signature for each registered user.

[0009] This signature is constructed from a set of factors describing the user behavior, using this signature the system will be able to detect if unauthorized user is using the system.

[0010] 2. Classification of Actions

[0011] Mouse input actions can be classified as follows:

[0012] Movement (General Movement)

[0013] Drag and Drop (the action starts with mouse button down, movement, then mouse button up)

[0014] Point & Click (mouse movement followed by a click or double click)

[0015] Silence (No Movement)

[0016] From the above mentioned classification, the analysis can be divided into two categories, movement analysis, and silence analysis; different approaches are used in each category to collect the factors characterizing it.

[0017] Following are some examples on the type of factors collected from each analysis.

[0018] Movement Analysis Examples:

[0019] Calculating the average speed compared to the traveled distance, this produces three graphs for the 3 types of movement actions

[0020] Calculating average speed compared to the movement direction, 8 different directions are considered

[0021] Calculating the average traveled distance for a specific period of time, with regards to different movement directions; from this data we can build a pattern for the use of different directions.

[0022] Silence Analysis Examples:

[0023] Calculating the average of silence periods between movements

[0024] Calculating amount of silence in a period of time

[0025] Comparing the percentage of the silence time to movement time in a period of time

[0026] Determining weights for different movement directions to answer the following questions:

[0027] What is the major movement direction to start movement after a silence period

[0028] What is the major movement direction to end with before a silence period

[0029] Factors collected from the above mentioned analysis are passed to a detection unit which uses neural networks to compare the collected input data against a pre analyzed heuristic information, produce what we call ‘suspicious ratio’, and apply a decision making algorithm to propose the proper action.

[0030] An example of the mouse dynamics signature is the traveled distance/movement speed curve (FIG. 1), a neural network is used to model this curve, the network is trained with the collected raw data, mouse dynamics signature is a curve generated from the output (movement speed) of the trained network against an input presenting the full spectrum of the traveled distances.

[0031] A learning/tuning algorithm is used to improve the efficiency of the system for a reliable and accurate detection, and decrease the false acceptance/rejection ratios.

[0032] FIG. 2 shows an example of the comparison process for two different cases, FIG. 2a shows a recorded mouse dynamics signature compared to reference signature of the same user, and FIG. 2b shows a recorded mouse dynamics signature of an intruder compared to reference signature of the logged in user.

[0033] Intrusion is detected if the difference between the curves is over a pre calculated threshold limit.