System and method for processing user interface events

• US 9,942,228 B2
• Filed: 06/06/2014
• Issued: 04/10/2018
• Est. Priority Date: 05/05/2009
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Oracle America, Inc. (Oracle Corporation)
• Inventors: Hauser, Robert R.
• Primary Examiner(s): Chan, Wing F
• Assistant Examiner(s): Tseng, Leon Y
• Application Number:
  US14/298,465
• Publication Number:
  US 20140289869A1
• Time in Patent Office: 1,404 Days
• Field of Search: 726 28
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A system and method to detect and prevent non-human interaction between a client and a web server invokes an effect to change the event generation behavior at the client. Subsequent event streams from the client to the server are analyzed to determine whether the event streams contain events corresponding to expected reactions of a human operator at the client to the effect. Indications of non-human behavior may invoke more direct human testing, for example using a dynamic CAPTCHA application, or may cause a termination of the client/URL interaction.

Claims

1. A method, comprising:

receiving a first event stream by a web server and from a first client device, wherein the web server is configured to receive uniform resource locator (URL) requests from client devices and respond to the URL requests with web-based content, wherein the first event stream received by the web server includes one or more events collected in response to interactions detected with a user interface application executing on the first client device;

transmitting, by the web server, a message to the first client device including instructions to the user interface application to change the event streaming behavior performed by the user interface application executing at the first client device;

receiving, by the web server, a second event stream from the first client device, the second event stream including one or more additional events collected in response to interactions detected with the user interface application, wherein the second event stream is received by the web server after the transmission of the message to the first client device;

processing, by the web server, the second event stream to determine whether events in the second event stream correspond to the changed event streaming behavior;

determining, by the web server, an event generator type, based on the determining of whether the received event stream corresponds to the changed event streaming behavior; and

in response to determining a non-human event generator type, performing at least one of;

causing an error to be communicated to the first client device via the user interface application, initiating further testing for human interaction via the user interface application, or terminating the interaction with the first client device via the user interface application.

2. The method according to claim 1 further comprising:

analyzing the first event stream and determining based on the first event stream that the message is required to be provided to the first client device.

3. The method according to claim 2, further comprising determining an event generator type of the first event stream, wherein the message is provided to the first client device in response to determining that the event generator type of the first event stream is a non-human event generator type.

4. The method according to claim 2 wherein analyzing the first event stream comprises determining whether a rate of event messages from the first client device is greater than an allowable rate.

5. The method according to claim 2 wherein analyzing the first event stream comprises determining whether the first client device is generating events at a rate greater than an allowable rate.

6. The method according to claim 1 wherein transmitting the message to the first client device comprises changing an event sampling function that controls how events are sampled at the first client device.

7. The method according to claim 6 wherein changing the event sampling function comprises changing at least one of an event observer mask, a sampling interval, or a sampling area of a user interface browser application executing on the first client device.

8. The method according to claim 1 wherein determining the event generator type based on the processing of the second event stream comprises:

analyzing the second event stream to determine a response to the message; and

determining an event generator type based on the response.

9. The method according to claim 1 wherein the transmitting the message comprises providing a visual effect to the first client device to be rendered within the user interface application, wherein the visual effect is unnoticeable to a human operator at the first client device.

10. The method according to claim 9 wherein the visual effect comprises at least one of a mouse pointer shift, a freeze of a mouse pointer, a change of a view-port size, a cursor shift, or addition of a new frame to shift a current viewport.

11. The method according to claim 1 wherein transmitting the message comprises providing a visual effect to the first client device to be rendered within the user interface application, wherein the visual effect comprises a nontransparent effect that invokes an effect at the first client device that is noticeable to a human operator.

12. The method according to claim 11 wherein the nontransparent visual effect comprises at least one of a mouse pointer shift, a freeze of a mouse pointer, a change of the viewport size, a cursor shift, or addition of a new frame to shift a current viewport.

13. The method according to claim 6 wherein determining a response to the message comprises determining whether the client is honoring the change to the event sampling function.

14. The method according to claim 1 wherein determining whether events in the second event stream correspond to the changed event streaming behavior comprises determining whether the second event stream is human dependent.

15. The method according to claim 14 comprising terminating the interaction in response to determining that the second event stream is not human dependent.

16. The method according to claim 1, wherein processing the second event stream comprises determining whether the user interface application executing on the first client device supports event bubbling and event capturing.

17. The method according to claim 16, further comprising inferring, by the web server, one or more events not present in the second event stream, by comparing a received bubble event stream to corresponding bubble event streams received from other client devices having matching capture event streams.

18. A system, comprising:

a client device;

a web server comprising one or more processors, and memory storing computer-readable instructions that, when executed by the one or more processors, cause the web server to execute an event software module to;

receive a first event stream from the client device, wherein the first event stream includes one or more events collected in response to interactions detected with a user interface application executing on the client device;

transmit a message to the client device including instructions to the user interface application to change the event streaming behavior performed by the user interface application executing at the client device;

receive a second event stream from the client device, the second event stream including one or more additional events collected in response to interactions detected with the user interface application, wherein the second event stream is received after the transmission of the message to the client device;

process the second event stream to determine whether events in the second event stream correspond to the changed event streaming behavior;

analyze the second event stream received from the client device to determine an event generator type; and

in response to determining a non-human dependent event generator type, performing at least one of causing an error to be communicated to the client device via the user interface application, initiating further testing for human interaction via the user interface application, or terminating the interaction with the client device via the user interface application.

19. The system according to claim 18, wherein transmitting the message comprises providing a visual effect to the client device to be rendered within the user interface application, and wherein the event module is further configured to analyze the second event stream to determine whether the second event stream comprises a series of events that correspond to an expected response to the invoked visual effect.

20. The system according to claim 19 further comprising a prerecorded dataset comprising event streams corresponding to the expected response to the invoked visual effect.