Injectable Code for Bot Detection via User Interaction Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively identify and mitigate malicious software (malware) operating on computing devices, particularly in web environments, leading to unauthorized access and data theft, as they often rely on manual detection methods that are inefficient and prone to false positives/negatives.
Innovation Solution
Incorporating injectable code into web pages that collects characterization data from client devices, analyzing user interactions to distinguish between human and automated activity, and providing obfuscation mechanisms to thwart malware, such as polymorphic code that randomizes each serving to evade detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If manual detection methods are used to identify malware, then system complexity is reduced, but detection accuracy and efficiency deteriorate
Solution Approach 1:
The patent replaces manual detection methods with automated computer-based analysis systems that collect, process, and analyze characterization data automatically. The system uses software agents to gather device information, interaction patterns, and behavioral data, then processes this data through computational algorithms to identify malware, eliminating the need for manual inspection while significantly improving detection accuracy and consistency.
Solution Approach 2:
The patent introduces characterization data as an intermediary between the malware detection system and the actual malware behavior. Instead of directly analyzing complex malware operations, the system collects simplified characterization data points (device configuration, interaction patterns, timing information) that serve as mediators for identification. This intermediary layer reduces the complexity of direct malware analysis while maintaining high detection accuracy.
2Extent of automation
If automated bot detection is implemented, then malware identification improves, but false positives and negatives increase
Solution Approach 1:
The patent changes the parameters used for detection from simple binary classifications to multi-dimensional characterization data that includes device configuration, interaction timing, patterns, and contextual information. By analyzing multiple parameters simultaneously (e.g., combination of device type, interaction frequency, timing variations, and behavioral patterns), the system improves reliability while maintaining automation. The system adjusts detection thresholds and analysis depth based on the complexity of the data being processed.
Solution Approach 2:
The patent implements feedback mechanisms where the system continuously refines its detection algorithms based on analyzed data patterns and outcomes. The characterization data collection and analysis process provides feedback that improves the system's ability to distinguish between legitimate users and bots over time. The system learns from detected patterns and adjusts its detection criteria, reducing false positives and negatives while maintaining high automation levels.
3Difficulty of detecting and measuring
If injectable code is added to web pages for data collection, then detection capability improves, but web page complexity and potential performance degradation increase
Solution Approach 1:
The patent extracts the data collection and characterization functionality from the main web page content and separates it into distinct injectable code modules. These modules are independently developed, tested, and can be selectively added to web pages only where needed for security analysis. This extraction allows the detection capability to be added without fundamentally redesigning the entire web page structure, minimizing the increase in overall complexity.
Solution Approach 2:
The patent implements partial data collection by selectively gathering only the specific characterization data points necessary for malware detection rather than collecting all possible device and interaction information. The system focuses on key parameters (device configuration, interaction patterns, timing) that are most indicative of malware behavior, avoiding excessive data collection that would increase complexity and processing requirements while maintaining effective detection capability.
Data Source
AI summary
A computer-implemented method includes providing, for use by a third-party, injectable computer code that is capable of being served with other code provided by the third-party to client computing devices; receiving data from client computing devices that have been served the code by the third-party, the data including data that characterizes (a) the client computing devices and (b) user interaction with the client computing devices; classifying the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices; and providing to the third party one or more reports that characterize an overall level of automated software activity among client computing devices that have been served code by the third party.