SYSTEM AND METHOD FOR PROCESSING USER INTERFACE EVENTS

• US 20100287229A1
• Filed: 05/05/2009
• Published: 11/11/2010
• Est. Priority Date: 05/05/2009
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Paul A. Lipari, Suboti, LLC
• Inventors: Hauser, Robert R.
• Granted Patent: US 8,751,628 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A system and method to detect and prevent non-human interaction between a client and a web server invokes an effect to change the event generation behavior at the client. Subsequent event streams from the client to the server are analyzed to determine whether the event streams contain events corresponding to expected reactions of a human operator at the client to the effect. Indications of non-human behavior may invoke more direct human testing, for example using a dynamic CAPTCHA application, or may cause a termination of the client/URL interaction.

Claims

1. A method for determining an event generator type of an interaction between a client and a web server, the method comprising:

providing an effect to the client to invoke an event stream response in events generated at the client;

receiving an event stream from the client;

analyzing the event stream to determine a response to the effect; and

determining an event generator type from the response.

2. The method according to claim 1 further comprising:

receiving a first event stream from the client; and

analyzing the first event stream to determine whether the effect is required to be provided to the client.

3. The method according to claim 2 comprising determining an event generator type of the first event stream, wherein the effect is provided to the client if the event generator type of the first event stream is a non-human event generator type.

4. The method according to claim 2 wherein analyzing the first event stream comprises determining whether a rate of event messages from the client is greater than an allowable rate.

5. The method according to claim 2 wherein analyzing the first event stream comprises determining whether the client is generating events at a rate greater than an allowable rate.

6. The method according to claim 1 wherein providing the effect comprises changing an event sampling function that controls how events are sampled at the client.

7. The method according to claim 6 wherein changing the event sampling function comprises changing at least one of an event observer mask, a sampling interval, or a sampling area of a browser on the client.

8. The method according to claim 6 wherein determining a response to the effect comprises determining whether the client is honoring the change to the event sampling function.

9. The method according to claim 1 wherein the effect comprises a transparent effect that invokes an effect at the client that is substantially unnoticeable to a human operator at the client.

10. The method according to claim 9 wherein the transparent effect comprises at least one of a mouse pointer shift, a freeze of a mouse pointer, a change of a viewport size, a cursor shift, or addition of a new frame to shift a current viewport.

11. The method according to claim 1 wherein the effect comprises a nontransparent effect that invokes an effect at the client that is noticeable to a human operator at the client.

12. The method according to claim 11 wherein the nontransparent effect comprises at least one of a mouse pointer shift, a freeze of a mouse pointer, a change of the viewport size, a cursor shift, or addition of a new frame to shift a current viewport.

13. The method according to claim 1 wherein the effect invokes a CAPTCHA application.

14. The method according to claim 1 wherein determining a response to the effect comprises determining whether an event stream generated in response to the effect is human dependent.

15. The method according to claim 14 comprising terminating the interaction if the event stream generated in response to the effect is not human dependent.

16. A system for testing an interaction between a client and a web server, the system comprising:

an event module configured to;

invoke an effect in the client; and

analyze an event stream received from the client to determine whether a response to the effect is a human dependent response.

17. The system according to claim 16 wherein the event module is configured to analyze the event stream to determine whether the event stream comprises a series of events that correspond to an expected response to the invoked effect.

18. The system according to claim 17 further comprising a prerecorded dataset comprising event streams corresponding to the expected response to the invoked effect, wherein each event stream of the dataset comprises an associated known event generator type.

19. A computer-readable medium comprising computer-executable instructions for execution by a first processor and a second processor in communication with the first processor, that, when executed:

cause the first processor to;

determine if a message to invoke a change in event generation behavior is required;

generate the message; and

send the message to the second processor; and

cause the second processor to;

receive the message; and

invoke the change in the event generation behavior.

20. The computer readable medium according to claim 19 comprising instructions, that, when executed, cause the second processor to:

generate an event stream comprising a change in the event generation behavior;

send the event stream to the first processor; and

cause the first processor to;

receive the event stream; and

determine whether the change in the event generation behavior is an expected change.