System and method for detecting classes of automated browser agents

• US 9,313,213 B2
• Filed: 10/18/2013
• Issued: 04/12/2016
• Est. Priority Date: 10/18/2012
• Status: Active Grant

• Current Assignee: HUMAN Security, Inc.
• Original Assignee: White Ops, Inc.
• Inventors: Kaminsky, Daniel, Tiffany, Michael J. J.
• Primary Examiner(s): Chen, Alan
• Application Number:
  US14/057,730
• Publication Number:
  US 20150112892A1
• Time in Patent Office: 907 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: G06N 7/00 Computing arrangements based on specific mathematical models
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method for determining if a web browser is being operated by a human or a non-human agent, based on analysis of certain aspects of how a user interacts with a webpage. By placing a code snippet into the code of a webpage prior to a given user accessing that webpage, one is able to evaluate the user'"'"'s actions in order to predict the type of user. The predictions are made by acquiring information on how the user loads, navigates, and interacts with the webpage and comparing that information with statistics taken from a control group. Performance metrics from all webpages containing similar code elements are compiled by analysis servers and made available to the operator of a webpage through a variety of reporting mediums. By compiling such performance metrics, the method helps combat and prevent malicious automated traffic directed at advertisements and other aspects of a given webpage.

Claims

1. A method for detecting automated browser agents, comprising:

inserting a means for detecting information into a page code before a page is sent to a user'"'"'s browser, sending said page to a user'"'"'s browser, wherein said means sends emissions from one or more plugins via one or more channels, said emissions capturing client execution environment data without requiring a browser interaction and causing immediate and continued data collection of said client execution environment data, and transmitting via asynchronous HTTP posts said client execution environment data to an analysis server, wherein said analysis server compares said client execution environment data with a first database storing pattern characteristics for humans, a second database storing pattern characteristics for automated browser agents, and a third database storing pattern characteristics which are unclear as to whether performed by a human or a bot, thus forming a report on automated browser agent activity based on a qualitative evaluation of performance metrics collected,

and making a conclusion on a probability of the user being an automated browser agent (a bot), said probability being based on which of said three databases has the highest match to said data.

2. The method of claim 1, wherein said means for detecting comprise a code snippet and said client execution environment data comprises HTML5 standards compliance.

3. The method of claim 2, further comprising:

registering a handler and a listener for a given browser event, wherein said handler receives client execution environment data associated with said browser event and said listener enables recovery of otherwise unidentifiable data.

4. The method of claim 2, wherein said report is made available via a password protected interactive HTML dashboard, an exportable spreadsheet document, or a subscription based email or PDF report.

5. The method of claim 2, wherein said report is generated within one minute of a given user action.

6. The method of claim 2, wherein said data collection, comparing, and report is implemented via batch processing.

7. The method of claim 2, wherein said data collection, comparing, and report is implemented via stream processing.

8. The method of claim 2, further comprising integration with financial anti-fraud technology.

9. The method of claim 2, further comprising integration with a pre-CAPTCHA signup auditor.

10. The method of claim 2, wherein said client execution environment data further comprises mismatching communication channels.

11. The method of claim 2, wherein said client execution environment data further comprises a Flash update rate.

12. The method of claim 2, wherein said client execution environment data further comprises a syncing of Flash stages.

13. The method of claim 2, wherein said client execution environment data further comprises bot-specific injected configurations.

14. The method of claim 2, wherein said client execution environment data further comprises scroll events.

15. The method of claim 2, wherein said client execution environment data further comprises average read and visit time.

16. The method of claim 2, wherein said client execution environment data further comprises error handling information.

17. The method of claim 1, wherein said client execution environment data comprises information, generated over time, regarding the amount of time a given browser operation takes to update a graphic on a web age.

18. A non-transitory computer readable medium storing a program causing a computer to execute a process, comprising:

a first stage of identification, comprising grouping browsing activity based on origin,

a second stage of data collection, comprising sending a page containing a pre-inserted code snippet for recording of particular client execution environment data, at page load and after page load, and transmitting said client execution environment data to an analysis server,

a third stage of evaluation within said analysis server, comprising comparing said client execution environment data against control groups comprising a first database storing pattern characteristics for humans, a second database storing pattern characteristics for automated browser agents, and a third database storing pattern characteristics which are unclear as to whether performed by a human or a bot,

and a fourth stage of reporting, comprising compiling a predictive report on bot activity based on a qualitative evaluation of performance metrics collected, said predictive report disclosing the highest matching database of said three databases.

19. The medium of claim 18, wherein said client execution environment data comprises an interaction with invisible elements of a page, missing properties of an interaction, atypical interface behavior, a wrong page element property, mismatching communication channels, a Flash update rate, syncing of Flash stages, a graphical update rate, error handling information, HTML5 standards compliance, bot-specific injected configurations, keyboard activity, accelerometer data, scroll events, and average read and visit time.

20. The medium of claim 18, wherein said client execution environment data comprises the amount of time a given browser operation takes to update a graphic on a given web page.