Detecting attacks against a server computer based on characterizing user interactions with the client computing device

Abstract

A computer-implemented method includes providing, for use by a third-party, injectable computer code that is capable of being served with other code provided by the third-party to client computing devices; receiving data from client computing devices that have been served the code by the third-party, the data including data that characterizes (a) the client computing devices and (b) user interaction with the client computing devices; classifying the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices; and providing to the third party one or more reports that characterize an overall level of automated software activity among client computing devices that have been served code by the third party.

What is claimed is: 
     
         1 . A computer-implemented method comprising:
 providing, from a first server computer to a client computing device, and in response to a first request for a first set of code, a second set of code which, when executed on the client computing device, causes the client computing device to generate a set of data that characterizes the client computing device;   wherein the first set of code and the second set of code are different;   receiving the set of data from the client computing device;   determining, based on the set of data, a screen resolution of the client computing device;   classifying the client computing device as being controlled by automated software or not based on analyzing of the set of data and based on the screen resolution;   wherein the method is performed using one or more computing devices.   
     
     
         2 . The method of  claim 1  wherein the set of data includes data that characterizes a software configuration of the client computing device, and wherein determining the screen resolution is based on the software configuration. 
     
     
         3 . The method of  claim 2  wherein analyzing the set of data comprises analyzing the software configuration of the client computing device. 
     
     
         4 . The method of  claim 2  wherein the set of data identifies a user agent and wherein classifying the client computing device as being controlled by automated software or not is further based on the user agent. 
     
     
         5 . The method of  claim 2  wherein the set of data identifies a user agent and wherein analyzing the set of data comprises determining whether the software configuration matches the user agent. 
     
     
         6 . The method of  claim 2  further comprising:
 determining, based on the set of data, a window size of a browser executing on the client computing device; 
 wherein classifying the client computing device as being controlled by automated software or not is further based on the window size. 
 
     
     
         7 . The method of  claim 1  wherein the set of data includes data that characterizes a hardware configuration of the client computing device, and wherein determining the screen resolution is based on the hardware configuration. 
     
     
         8 . The method of  claim 7  wherein analyzing the set of data comprises analyzing the hardware configuration of the client computing device. 
     
     
         9 . The method of  claim 7  wherein hardware configuration identifies display hardware installed with the client computing device and wherein classifying the client computing device as being controlled by automated software or not is further based on the display hardware. 
     
     
         10 . A computer system comprising:
 one or more processors;   one or more non-transitory computer-readable media storing instructions which, when executed by the one or more processors, cause the one or more processors to perform:   providing, from a first server computer to a client computing device, and in response to a first request for a first set of code, a second set of code which, when executed on the client computing device, causes the client computing device to generate a set of data that characterizes the client computing device;   wherein the first set of code and the second set of code are different;   receiving the set of data from the client computing device;   determining, based on the set of data, a screen resolution of the client computing device;   classifying the client computing device as being controlled by automated software or not based on analyzing of the set of data and based on the screen resolution.   
     
     
         11 . The system of  claim 10  wherein the set of data includes data that characterizes a software configuration of the client computing device, and wherein determining the screen resolution is based on the software configuration. 
     
     
         12 . The system of  claim 11  wherein analyzing the set of data comprises analyzing the software configuration of the client computing device. 
     
     
         13 . The system of  claim 11  wherein the set of data identifies a user agent and wherein classifying the client computing device as being controlled by automated software or not is further based on the user agent. 
     
     
         14 . The system of  claim 11  wherein the set of data identifies a user agent and wherein analyzing the set of data comprises determining whether the software configuration matches the user agent. 
     
     
         15 . The system of  claim 11 , wherein the instructions, when executed by the one or more processors, further cause:
 determining, based on the software configuration, a window size of a browser executing on the client computing device;   wherein classifying the client computing device as being controlled by automated software or not is further based on the window size.   
     
     
         16 . The system of  claim 10  wherein the set of data includes data that characterizes a hardware configuration of the client computing device, and wherein determining the screen resolution is based on the hardware configuration. 
     
     
         17 . The system of  claim 16  wherein analyzing the set of data comprises analyzing the hardware configuration of the client computing device. 
     
     
         18 . The system of  claim 16  wherein the hardware configuration identifies display hardware installed with the client computing device and wherein classifying the client computing device as being controlled by automated software or not is further based on the display hardware.