Browser Agent Detection via Passive and Active Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting automated browser agents are inadequate as they rely on passive metrics that can be matched by both human and automated bot activities, leading to false positives and inability to differentiate effectively.
Innovation Solution
The system inserts code snippets into web page code to collect client execution environment data, comparing it against databases of human and bot patterns, and employs active probing to differentiate between human and automated interactions, including detection of emulated input, JavaScript event loops, and network modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passive detection systems are used to monitor network traffic, then the system can be implemented without interfering with network operations, but the detection accuracy deteriorates because legitimate users and bots both match the same passive metrics
Solution Approach 1:
The patent segments bot detection into two distinct phases: passive detection (non-intrusive monitoring of network traffic) and active detection (intrusive analysis of client execution environment). This segmentation allows the system to first identify suspicious traffic passively, then apply more accurate but intrusive active detection only when needed, thereby maintaining ease of operation while improving measurement precision.
Solution Approach 2:
The system performs preliminary passive detection to identify potentially malicious traffic before initiating active detection. This preliminary action filters out legitimate traffic early in the process, allowing the more intrusive active detection mechanisms to be applied only to suspicious cases, thus maintaining both ease of operation and measurement precision.
2Measurement precision
If active probing is used to collect client execution environment data, then the detection accuracy improves by identifying bot-specific characteristics, but the system complexity increases due to code injection and multiple detection channels
Solution Approach 1:
The patent segments the detection system into distinct modules: passive detection component, active detection component, code injection module, and multiple analysis channels. Each module has a specific function, and they are combined in a staged approach. This segmentation manages device complexity by creating modular, maintainable components while achieving high measurement precision through their coordinated operation.
Solution Approach 2:
The system performs preliminary passive detection to identify suspicious traffic before initiating the more complex active detection processes. This preliminary filtering reduces the volume of traffic that requires complex active analysis, thereby managing device complexity while maintaining high detection accuracy for bot identification.
3Measurement precision
If multiple detection channels and code snippets are inserted into web pages, then the ability to differentiate bots from humans improves, but the ease of operation deteriorates due to required page modifications
Solution Approach 1:
The system performs preliminary passive detection to identify suspicious traffic before requiring web page modifications. This allows the majority of legitimate traffic to be handled without page insertion, and only suspicious cases trigger the need for code snippets. This preliminary action maintains ease of operation for normal sites while achieving high measurement precision when bot detection is actually needed.
4Reliability
If the system performs both passive and active detection in stages, then the false positive rate reduces by eliminating typical human browsing patterns, but the detection time increases due to multi-stage analysis
Solution Approach 1:
The patent segments detection into two rapid stages: passive detection (quick network traffic analysis) and active detection (faster client-side environment analysis). Each stage is optimized for speed, and the staged approach eliminates false positives by cross-validating results across both stages, thereby maintaining reliability while minimizing time loss through efficient segmentation rather than sequential processing.
Data Source
AI summary
Disclosed herein are methods and systems for evaluating web browser behavior to report on human versus non-human activity, based on varying analyses of detectable properties. By passively detecting the code of a webpage engaged by a browsing user, the present invention evaluates the browsing user's activity in order to predict the type of user with a degree of confidence. The predictions are formed by acquiring information on how a user loads, navigates, and interacts with a webpage and comparing that information with known and unknown properties in various control groups. If the prediction yields a high likelihood of automated activity, additional active detection may be performed. Reports are compiled by analysis servers and made available to the operators of webpages. By compiling performance metrics and informing operators of fraudulent versus normal activity, the invention combats malicious automated traffic directed at any aspect of a given webpage.