SYSTEM AND METHOD FOR DETECTING INTERNET BOTS

• US 20100070620A1
• Filed: 09/16/2008
• Published: 03/18/2010
• Est. Priority Date: 09/16/2008
• Status: Active Grant

• Current Assignee: R2 Solutions LLC (Acacia Research Corporation)
• Original Assignee: Yahoo! Inc. (Apollo Global Management, Inc.)
• Inventors: Awadallah, Amr, Thampy, Sajjit, Ferrante, Daniel
• Granted Patent: US 8,433,785 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3485 for I/O devices
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Apparatuses, methods, and systems directed to detect Internet bots in communication networks. Some embodiments of the present invention allow an agent of a server to periodically record interaction events on a client system. The recorded interaction events are sent to a server and validated by a statistical test. Some embodiments of the present invention may be used to detect bots using server logs. In other embodiments, an agent of a server is able to detect and validate interaction events on a client system and the server periodically polls the agent to determine whether bots are detected on the client system.

Claims

1. A method comprising:

transmitting a web page to a remote host, the web page including an agent operative to register as a listener for mouse movement events on the remote host;

receiving interaction event data from the agent, wherein the interaction event data comprises positional coordinate data detected by the agent as the listener for mouse movement events;

extracting one or more positional movement parameter values from the interaction event data; and

determining, by applying the one or more extracted positional movement parameter values to a statistical model, whether the interaction event data associated with the mouse movement events resulted from human interaction or from an automated process executing on the remote host.

2. The method of claim 1 wherein the web page comprises an activatable interface element, and wherein the method further comprises

receiving a request from the remote host caused by activation of the activatable interface element;

validating the request from the remote host based on whether the interaction event data associated with the mouse movement events resulted from human interaction or from an automated process executing on the remote host.

3. The method of claim 1 wherein one of the one or more positional parameter values comprises a value of an attribute derived from analysis of two or more positional coordinates of the positional coordinate data detected by the agent.

4. The method of claim 1 further comprising correlating the interaction event data to one or more events of a session between the remote host and a server, and validating the one or more events based on the determination whether the interaction event data associated with the mouse movement events resulted from human interaction or from an automated process executing on the remote host.

5. A method comprising

receiving interaction event data from an agent executing on a remote host, wherein the interaction event data characterizes positional movement of an input device operably associated with the remote host;

extracting one or more positional movement parameter values from the interaction event data; and

determining, by applying the one or more extracted positional parameter values to a statistical model, whether the interaction with the input device resulted from human interaction or from an automated process executing on the remote host.

6. The method of claim 5 further comprising correlating the interaction event data to one or more events of a session between the remote host and a server, and validating the one or more events based on the determination whether the interaction with the input device resulted from human interaction or from an automated process executing on the remote host.

7. The method of claim 5 wherein the input device is a mouse device and the one or more positional parameter values comprise one or more positional coordinates of a mouse input device attached to the remote host.

8. The method of claim 7 wherein the agent records the positional coordinates at regular intervals of time.

9. The method of claim 5 wherein the determining step comprises

deriving a signature value based on the one or more positional movement parameter values;

selecting a statistical test to test a hypothesis that the interaction events are a result of human interaction with the input device or a result of an automated process executing on the remote host;

computing a statistical value based on the selected statistical test and the signature value; and

deciding, based on the value of the computed statistical value, whether to accept or reject the hypothesis.

10. The method of claim 9 wherein the selected statistical test is a likelihood ratio test and the computing step comprises

calculating, using the signature value, a first probability density function value based on a known distribution of the signature value when the interaction events are a result of human interaction with the input device;

calculating, using the signature value, a second probability density function value based on a known distribution of the signature value when the interaction events are a result of non-human interaction with the input device;

calculating a likelihood ratio statistic using the first and the second probability density function values.

11. The method of claim 10 wherein the likelihood ratio statistic is compared with a threshold value to determine whether the interaction with the input device resulted from human interaction.

12. The method of claim 11 wherein the threshold value is determined by historical distribution data of the signature value.