PASSIVE AUTOMATED CONTENT ENTRY DETECTION SYSTEM

An automated content entry detection system to identify inputs received automated agents. Aspects of the automated content entry system include various functional components to perform operations that include: receiving entries that comprise inputs into one or more data entry fields from user accounts; determining behavioral data of the entries based on one or more input attributes of the entries; generating a prediction to be assigned to the user accounts based on the one or more attributes of the entries; and performing operations that include denying further requests received from the automated agents based on the prediction.

TECHNICAL FIELD

The subject matter of the present disclosure generally relates methods and systems supporting network security.

BACKGROUND

Millions of computer systems worldwide are infected by malware that cause the computer systems to function as automated agents which may be controlled by malicious actors, forming “bot-nets.” The infected computer systems may be coordinated and used by the malicious actors to perform a variety of illegal activities, including perpetrating identity theft, sending billions of spam messages, launching denial of service (DoS) attacks, committing click fraud, and so on. The infected computer system also may experience a significant waste in resources that result in a loss of performance. Thus, without verification checks, automated agents can place incorrect data into product reviews or ratings. If that is done the reviews and ratings may be inaccurate.

Completely Automated Public Turing tests, or “CAPTCHA,” may be used to identify and prevent such automated agents from performing actions which reduce the overall quality of services supported by a networked system, whether due to outright abuse or resource expenditure. For example, a common type of CAPTCHA involves a user typing letters or digits from a distorted image that appears at a portion of an interface displayed at a device.

While such tests have been effective in the past, advances in automated software technology have made the detection of such software increasingly difficult under existing security protocols. Furthermore, CAPTCHA and other similar tests to identify automated software are often inconvenient or burdensome to many genuine users. It is therefore an object of the present invention to provide an improved system for the detection of such automated agents and malicious actors.

DETAILED DESCRIPTION

Humans have a pattern of data entry that is different and distinguishable from automated agents (e.g., bots). Historically, Morse code operators could be identified based on their characteristic pattern of signal clicks, referred to as a Morse code operator's “fist.” Conversely, automated agents tend to enter data in predictable, repeatable, and consistent patterns, or patterns that could be determined that are being entered algorithmically. For example, when a human being is entering the fields on an online entry form, they will click in each form field and type in their response. The response will typically have errors, and the process of typing the response will have backspaces, deletions, pauses, and sequential typing entries. An automated agent on the other hand, will have a pre-programmed repository of responses that may be used to populate a form in one action—like a “copy-paste.” The automated agent may enter whole blocks of text at once, in rapid succession.

Thus, a system may passively monitor input attributes and characteristics in order to calculate a likelihood that a particular user is actually an automated agent. In response to determining that the user is an automated agent, the system may perform follow up operations to prevent abuse of a networked system, that include: blocking further inputs from the user identified as the automated agent; directing the user to a dead-end interface (i.e., a honeypot); building an automated agent profile in order to more quickly identify subsequent automated agents; and notifying an administrator with information about the automated agent.

A system that monitors input attributes and characteristics solves a technical problem of ensuring accuracy of data input into a database or computer system. In addition, a technical problem exists around solving the problem in a computationally efficient way. For example, traditional CAPTCHA tests may involve sending a puzzle to be solved to the client, receiving a response, and processing the response. Still further, traditional CAPTCHA tests involve using the human operator's time and efficiency by presenting the puzzle and require interaction. By monitoring input, and processing inputs, technical problems of accuracy in data is solved (ensuring it is valid data), and efficiency of the machines is improved by decreased round trips in the network and decreased presentation and processing of puzzles to be solved on the client and server. Monitoring of input involves technical solutions, such as monitoring pressure measurements, measuring and determining frequency of phrases or characters within strings, measurements of time between keypresses, and other computational tasks. Technical effects include improvement of network bandwidth, reduction of computational processor cycles used to solve the problems, and increased operator efficiency.

Reference will now be made in detail to specific example embodiments for carrying out the inventive subject matter of the present disclosure. In the following description, specific details are set forth in order to provide a thorough understanding of the subject matter. It shall be appreciated that embodiments may be practiced without some or all of these specific details.

Below are described various aspects of an automated content entry detection system to identify inputs received automated agents. According to certain example embodiments, aspects of the automated content entry system include various functional components to perform operations that include: receiving entries that comprise inputs into one or more data entry fields from user accounts; determining behavioral data of the entries based on one or more input attributes of the entries; generating scores to be assigned to the user accounts based on the one or more attributes of the entries; identifying automated agents based on the scores; and performing operations that include denying further requests received from the automated agents.

The one or more attributes of the entries include behavioral and biometric data, such as keystroke dynamics, as well as device attributes (eg., device identifier, device type), and user attributes (e.g., user identifier, IP address). Keystroke dynamics provide an indication of the manner and rhythm in which any given user types characters on a keyboard of keypad. This keystroke rhythm may be measured to develop a unique biometric template of a user's typing pattern for future authentication. In some embodiments, data needed to analyze keystroke dynamics may be obtained through keystroke logging in order to identify attributes such as the time it takes to get to and depress a key (i.e., seek-time), the time that any given key is held-down (i.e., hold-time), a speed of entry for a given sequence of keys, and a consistency of the speed of entry of the given sequence of keys, a pressure of a tactile input and a consistency of the pressure of the tactile input, as well as common errors and corrections of errors (i.e., frequently typing “fo” rather than “of” before making a correction).

In some example embodiments, the one or more attributes of the entries may include a time of day in which an entry was received by the system. For example, the automated content entry detection system may assign timestamps to entries received from a user account, and analyze the timestamps to determine regular patterns of activity. For example, the patterns may indicate that a particular user account is most active during specific hours of a day, certain days of a week, or even seasonally. Thus, if an entry is received and assigned a timestamp outside of the regular period of activity, the automated content entry detection system may generate a score that reflects uncertainty that the user account is currently being operated by the genuine user, and may instead be an automated agent.

In some example embodiments, the one or more attributes of the entries may include motion and image data captured by a client device. For example, the motion and image data may be collected via an accelerometer, altimeter, gyroscope, camera/front facing camera. Automated agents utilizing a compromised user account often provide entries to data entry forms from a server, or stationary device, whereas a user of a user account may instead provide inputs into a mobile device. As a result, it may be possible to infer whether a user is providing inputs into their usual mobile device based on the amount and type of movement recorded by the mobile device through the accelerometer, gyroscope, and altimeter of the mobile device. Similarly, a front facing camera may be utilized to capture images to determine whether or not a genuine user of the mobile device is providing the entries into the mobile device or not.

The automated content entry detection system generates one or more scores to be assigned to a user account dynamically based on the one or more attributes of the inputs received from the user account, in real-time. The scores may comprise a likelihood (e.g., a percent likelihood) that: the entries received from the user account were generated by a genuine human user; a likelihood that the entries received from the user account were generated by an automated agent; as well as a likelihood that the user account is compromised and may be executed by a malicious user. In some example embodiments, the score may be generated based on various learning algorithms that compare a similarity or exactness between various attributes of the entries into data entry fields.

Consider an illustrative example for purposes of explanation. The cadence or rhythm in which a user types certain letters, or certain combinations of letters (e.g., words, phrases) may have an associated score. For example, a user may provide an entry comprising an input that includes the text string “SAMPLE.” Based on an evaluation of the attributes of repeated entries of the text string “SAMPLE,” the automated content entry detection system may determine attributes of the entry that include: the speed of the entry as a whole, as well as a speed of successive sequences of keys (i.e., that the input is consistently typed out at a certain speed, or that “S” and “A” are pressed at a consistent speed); specific selection of keys for the entry (i.e., the use of the left shift-key rather than Caps Lock or the right shift-key); and an identification of consistent misspelling and corrections of the misspelling. Each of these attributes may be assigned to a corresponding user account, as well as to the inputs themselves. Thus, as subsequent entries are received from the user account, or subsequent entries that include similar inputs are received from the user account, the automated content entry detection system may utilize a learning algorithm to perform a comparison between the subsequent entries received from the user account, and the entry attributes assigned to the user account or the inputs in order to identify similarities and patterns. The automated content entry detection system may thereby generate the score to be assigned to the user account based on the identified similarities and patterns.

In some embodiments, the automated content entry detection system may define a threshold value (e.g., 60%), wherein the threshold indicates a user is likely to be an automated agent or malicious actor. In other embodiments, a threshold may not be entered by a user—instead, a machine may determine an output prediction of whether entry was from an automated agent or not. In the case of a threshold, the score assigned to the user account based on the entries received from the user account may be compared to the threshold value. In response to detecting the score assigned to the user account transgress the threshold value, the automated content entry detection system may flag or otherwise indicate that entries from the user account may be generated by an automated agent, or a malicious actor that has hi-jacked the user account. Subsequent entries received from the user account may thereby be denied, or the user account may be blocked from accessing resources of a network at all.

In some embodiments, a threshold is not explicitly set, and machine learning techniques may instead be employed to generate an output that comprises a prediction of whether or not an entry may or may not have been generated by an automated agent. For example, a machine learning model associated with the automated content entry detection system is initially trained using a training dataset that comprises inputs received from a user account, and in some embodiments from a plurality of user accounts that may include automated agents.

In such embodiments, the automated content entry detection system may determine behavioral data of a first entry, wherein the behavioral data includes one or more attributes of the first entry. The one or more attributes may be placed into a machine prediction module configured by the machine learning model trained by the training dataset. The automated content entry detection system inputs the one or more attributes of the first entry into the machine prediction module in response to receiving the first entry. The machine prediction module may then generate a prediction as an output based on the one or more attributes of the first entry, wherein the output comprises an indication of a likelihood that the first entry was generated by an automated agent. The automated content entry detection system receives the output from the machine prediction module, and associates the output with the user account. For example, the output may indicate that the first entry received from the user account is received from an automated agent. Based on the output indicating that the first entry was received from an automated agent, subsequent entries received from the user account may be denied.

In some embodiments, the determination of whether the user account is an automated agent may be generated at a client device, separate from the automated content entry detection system, and subsequently distributed to the automated content entry detection system for comparison with the threshold value. For example, the client device may itself collect and determine attributes of entries into data in order to generate a score and profile of a user account. The profile of the user account may be hosted and maintained entirely at the client device, such that the automated content entry detection system itself may only receive access to the score itself, and not to the attributes utilized to generate the score.

In further embodiments, the determination of whether the user account is an automated agent may be generated and maintained locally to the automated content entry detection system. In such embodiments, attributes of entries may be collected and hosted at a database of the automated content entry detection system, and utilized to generate a score to be assigned to the user account locally.

FIG. 1is a block diagram illustrating components of an automated content entry detection system140that provide functionality to identify applications utilizing out of date keys, and to automatically update the out of date keys, according to certain example embodiments. The automated content entry detection system140is show as including an input module105to receive entries into data entry fields from a client device160, a behavioral data module110to determine behavioral data of the entries into the data entry fields, a scoring module115to generate a score to be assigned to a user account based on attributes of the behavioral data, and in some embodiments, a machine prediction module120configured by a machine learning model, all configured to communicate with each other (e.g., via a bus, shared memory, or a switch). Any one or more of these modules may be implemented using one or more processors130(e.g., by configuring such one or more processors to perform functions described for that module) and hence may include one or more of the processors130.

Any one or more of the modules described may be implemented using dedicated hardware alone (e.g., one or more of the processors130of a machine) or a combination of hardware and software. For example, any module described of the automated content entry detection system140may physically include an arrangement of one or more of the processors130(e.g., a subset of or among the one or more processors of the machine) configured to perform the operations described herein for that module. As another example, any module of the automated content entry detection system140may include software, hardware, or both, that configure an arrangement of one or more processors130(e.g., among the one or more processors of the machine) to perform the operations described herein for that module. Accordingly, different modules of the automated content entry detection system140may include and configure different arrangements of such130or a single arrangement of such processors130at different points in time. Moreover, any two or more modules of the automated content entry detection system140may be combined into a single module, and the functions described herein for a single module may be subdivided among multiple modules. Furthermore, according to various example embodiments, modules described herein as being implemented within a single machine, database, or device may be distributed across multiple machines, databases, or devices.

In some example embodiments, one or more modules of the automated content entry detection system140may be implemented within the client device160. For example, the behavioral data module110and scoring module115may reside within the client device160, and may determine behavioral data and generate a score to be assigned to a user account based on attributes of the behavioral data at the client device160.

FIG. 2Ais a flowchart illustrating a method200A for detecting an automated agent based, according to an example embodiment. The method200A may be embodied in computer-readable instructions for execution by one or more processors (e.g., processors130ofFIG. 1) such that the steps of the method200A may be performed in part or in whole by functional components (e.g., modules) of a client device or the automated content entry detection system140; accordingly, the method200A is described below by way of example with reference thereto. However, it shall be appreciated that the method200A may be deployed on various other hardware configurations and is not intended to be limited to the functional components of the client device or the automated content entry detection system140.

At operation205A, the input module105receives a first entry from a user account, wherein the first entry includes an input that comprises one or more attributes into a data entry field. The data entry field may be presented to the user account via a client device160within a presentation of a graphical user interface (GUI). A user may provide the input by the client device160and into the data entry field. The data entry field may for example include a field presented within a GUI configured for receiving a text based entry or a numerical based entry. A user of the client device160may select the data entry field and provide an input into the data entry field, whereby the entry is received by the input module105.

At operation210A, the behavioral data module110determines behavioral data of the first entry based on the one or more attributes of the first entry. In some embodiments, the behavioral data module110may be implemented by one or more processors of the client device160itself. In further embodiments, the behavioral data module110may be implemented by the one or more processors130of the automated content entry detection system140.

According to some example embodiments, the attributes of the first entry may include keystroke dynamics, temporal data, location data, biometric data, as well as motion data and image data. For example, one or more of the attributes of the first entry may be determined based on keystroke logging to identify attributes such as the time it takes to get to and depress a key (i.e., seek-time), the time that any given key is held-down (i.e., hold-time), a speed of entry for a given sequence of keys, and a consistency of the speed of entry of the given sequence of keys, a pressure of a tactile input and a consistency of the pressure of the tactile input, as well as common errors and corrections of errors.

At operation215A, according to one example embodiment, the scoring module115generates an output to be assigned to the user account, based on the one or more attributes of the entry determined by the behavioral data module110. The output may for example a score that includes a percentage value, wherein the percentage may indicate a likelihood that: the entries received from the user account were generated by a genuine human user; a percentage likelihood that the entries received from the user account were generated by an automated agent; as well as a percentage likelihood that the user account is compromised and may be executed by a malicious user. Equally, the output may simply comprise an affirmative indication of whether the user account is an automated agent or a legitimate user of the user account.

In some example embodiments, the score may be generated by the scoring module115dynamically, as entries are received from the user account, in real-time. The score generated by the scoring module115may be based on a similarity or exactness of various attributes of the entry with prior entries received from the user account, or in some embodiments a similarity or exactness of the various attributes of the entry to entry attributes received from automated agents. For example, the user account may include a record that indicates an expected input pressure, typing speed, or seek time for a particular input. Similarly, the behavioral data module110may also maintain a database of entry attributes of inputs received from automated agents. The scoring module115may compare the attributes of the entry to prior attributes of similar inputs of the user account and the database of attributes associated with automated agents to determine a similarity, and generate the score of the entry based on the similarity (e.g., more similar to what is expected from the user, or more similar to what is expected from the automated agents). The score of the entry may thereby be assigned to the user account, wherein a composite, or cumulative score, of all inputs received from the user account may be generated and maintained.

At operation220A, the scoring module115determines that the score associated with the user account transgresses a threshold value. The threshold value may indicate a likelihood that entries received from the user account may have been generated by an automated agent. In response to detecting the score assigned to the user account transgress the threshold value, the scoring module115flags or otherwise indicates that the user account may be compromised, and subsequent entries received from the user account may thereby be denied, or the user account may be blocked from accessing resources of a network at all.

At operation225A, the input module105receives a second entry from the user account. The second entry may for example comprise an input into a second data entry field presented within the GUI displayed at the client device160. In response to receiving the second entry from the user account, and based on the score assigned to the user account, at operation230A, the input module105denies the second entry from the user account. In some embodiments, the input module105may notify an administrator of the automated content entry detection system140of the user account, based on the score assigned to the user account.

FIG. 2Bis a flowchart illustrating a method200B for detecting an automated agent based, according to an example embodiment. The method200B may be embodied in computer-readable instructions for execution by one or more processors (e.g., processors130ofFIG. 1) such that the steps of the method200B may be performed in part or in whole by functional components (e.g., modules) of a client device or the automated content entry detection system140; accordingly, the method200B is described below by way of example with reference thereto. However, it shall be appreciated that the method200B may be deployed on various other hardware configurations and is not intended to be limited to the functional components of the client device or the automated content entry detection system140.

At operation205B, as in operation205A, the input module105receives a first entry from a user account, wherein the first entry includes an input that comprises one or more attributes into a data entry field. The data entry field may be presented to the user account via a client device160within a presentation of a graphical user interface (GUI). A user may provide the input by the client device160and into the data entry field. The data entry field may for example include a field presented within a GUI configured for receiving a text based entry or a numerical based entry. A user of the client device160may select the data entry field and provide an input into the data entry field, whereby the entry is received by the input module105.

At operation210B, the behavioral data module110determines behavioral data of the first entry based on the one or more attributes of the first entry. In some embodiments, the behavioral data module110may be implemented by one or more processors of the client device160itself. In further embodiments, the behavioral data module110may be implemented by the one or more processors130of the automated content entry detection system140.

According to some example embodiments, the attributes of the first entry may include keystroke dynamics, temporal data, location data, biometric data, as well as motion data and image data. For example, one or more of the attributes of the first entry may be determined based on keystroke logging to identify attributes such as the time it takes to get to and depress a key (i.e., seek-time), the time that any given key is held-down (i.e., hold-time), a speed of entry for a given sequence of keys, and a consistency of the speed of entry of the given sequence of keys, a pressure of a tactile input and a consistency of the pressure of the tactile input, as well as common errors and corrections of errors.

At operation215B, the behavioral data module110inputs the one or more attributes of the first entry into the machine prediction module120, wherein the machine prediction module120includes a machine learning model trained using a training dataset that comprises inputs received from a user account, and in some embodiments from a plurality of user accounts that may include automated agents.

At operation220B, the machine prediction module120generates an output based on the machine learning model and the one or more input attributes of the first entry, wherein the output comprises an indication of whether or not the first entry is received from an automated agent. For example, in some embodiments, the output may simply comprise a binary statement of whether or not the first entry was received from an automated agent, while in further embodiments the output may include a score such as a percentage likelihood (e.g., 80% automated agent).

At operation225B, the input module105receives a second entry from the user account, subsequent to the machine prediction module120generating the output that indicates the first entry was received from an automated agent. The second entry may for example comprise an input into a second data entry field presented within the GUI displayed at the client device160. In response to receiving the second entry from the user account, at operation230B, the input module105denies the second entry from the user account, based on the output received from the machine prediction module120. In some embodiments, the input module105may notify an administrator of the automated content entry detection system140of the user account, based on the output.

FIG. 3is a flowchart illustrating a method300for generating a score for an entry into a data entry field, according to an example embodiment. The method300may be embodied in computer-readable instructions for execution by one or more processors (e.g., processors130ofFIG. 1) such that the steps of the method300may be performed in part or in whole by functional components (e.g., modules) of a client device160or the automated content entry detection system140; accordingly, the method300is described below by way of example with reference thereto. The method300may be performed as a subroutine or subsequent to the method200, according to an example embodiment.

At operation305, as in operation205of the method200, the input module105receives a first entry from a user account, wherein the first entry comprises an input into a data entry field. The data entry field may be presented to the user account via a client device160within a presentation of a graphical user interface (GUI). A user may provide the input by the client device160and into the data entry field, wherein the input includes input attributes such as an input type. The data entry field may for example include a field presented within a GUI configured for receiving a text based entry or a numerical based entry. A user of the client device160may select the data entry field and provide an input into the data entry field, whereby the entry is received by the input module105.

At operation310, the behavioral data module110determines that the first input of the first entry includes a machine generated input from an allowed user input tool, based on one or more attributes of the first entry. For example, the machine generated input may include a copy-paste command, or a seller tool input. In response to receiving the input from the client device in operation305, the automated content entry detection system140may compare attributes of the first input to a user account of the user, or to a database of entries received from automated agents to identify similarities. Based on the comparison, the various modules of the automated content entry detection system140determine that the machine generated input includes a machine generated input from an allowed user input tool.

At operation315, the scoring module115generates a score to be assigned to the user account based on the one or more attributes of the first entry. For example, the scoring module115may access the user account to retrieve one or more attributes of similar inputs to the machine generated input. The scoring module115generates the score based on a similarity of the one or more attributes of the similar inputs to the one or more attributes of the machine generated input.

FIG. 4is a flowchart illustrating a method400for generating a score for an entry into a data entry field, according to an example embodiment. The method400may be embodied in computer-readable instructions for execution by one or more processors (e.g., processors130ofFIG. 1) such that the steps of the method400may be performed in part or in whole by functional components (e.g., modules) of a client device160or the automated content entry detection system140; accordingly, the method400is described below by way of example with reference thereto. The method400may be performed as a subroutine or subsequent to the operations of the method200, according to an example embodiment.

At operation405, as in operation205of the method200, the input module105receives a first entry from a user account, wherein the first entry comprises an input into a data entry field. The data entry field may be presented to the user account via a client device160within a presentation of a graphical user interface (GUI). In some embodiments, the client device160may be configured to receive tactile entries, and the first entry from the user account may include a tactile entry.

At operation410, the behavioral data module110determines an input pressure of the tactile entry, based on the one or more attributes of the first entry. For example, in some embodiments, the client device160may be configured to measure and record an input pressure amount of tactile entries. This may involve measuring pressure applied to a key across the time of a keypress, measuring a maximum pressure applied to a key, a minimum pressure applied to a key during a keypress, or other similar pressure measurement. It is especially useful on touch screens and operating systems that allow the pressure applied to a key to be derived from operating system events.

At operation415, the scoring module115generates a score to be assigned to the user account based on the input pressure of the tactile entry. For example, the scoring module115may access the user account to retrieve input pressures of similar inputs to the first entry, in order to determine a similarity between the input pressures of the similar inputs to the input pressure of the first entry. The scoring module115generates the score based on the similarity, and assigned the score to the user account, whereby the scoring module may calculate a composite, or cumulative score to be compared to the threshold value.

FIG. 5is a flowchart illustrating a method500for generating a score for an entry into a data entry field, according to an example embodiment. The method500may be embodied in computer-readable instructions for execution by one or more processors (e.g., processors130ofFIG. 1) such that the steps of the method500may be performed in part or in whole by functional components (e.g., modules) of a client device160or the automated content entry detection system140, accordingly, the method500is described below by way of example with reference thereto. The method500may be performed as a subroutine or subsequent to operations of the method200, according to an example embodiment.

At operation505, as in operation205of the method200, the input module105receives a first entry from a user account, wherein the first entry comprises an input into a data entry field. The data entry field may be presented to the user account via a client device160within a presentation of a graphical user interface (GUI). In some embodiments, the client device160may be configured to receive tactile entries, and the first entry from the user account may include a tactile entry.

At operation510, the behavioral data module110detects a fluctuation of an input pressure of the tactile entry, based on the one or more attributes of the first entry. For example, in some embodiments, the client device160may be configured to measure and record an input pressure of tactile entries. The behavioral data module110may detect a fluctuation in input pressures of the tactile entries. For example, the tactile entries may include text inputs, wherein the text inputs comprise a series of tactile inputs into the client device160. The behavioral data module110may determine that one or more of the tactile inputs that comprise the text inputs represent a fluctuation (e.g., a significant increase or decrease) in input pressure.

As an illustrative example, consider a user providing an input into the client device160to spell the world “example.” The user may press harder on some letters than others. Because automated agents typically provide inputs that may record a minimum input pressure, or at least a uniform input pressure, a fluctuation in input pressure may indicate that the user account is not being used by an automated agent. At operation515, the scoring module115generates a score to be assigned to the user account based on the fluctuation of the input pressure.

FIG. 6is a flowchart600illustrating a method for generating a score for an entry into a data entry field, according to an example embodiment. The method600may be embodied in computer-readable instructions for execution by one or more processors (e.g., processors130ofFIG. 1) such that the steps of the method600may be performed in part or in whole by functional components (e.g., modules) of a client device160or the automated content entry detection system140, accordingly, the method600is described below by way of example with reference thereto. The method600may be performed as a subroutine or subsequent to operations of the method200, according to an example embodiment.

At operation605, the input module105receives a first entry from a user account, wherein the first entry includes an input into a data entry field. In some embodiments, the first input comprises one or more attributes that include keystroke dynamics, wherein the keystroke dynamics provide an indication of the manner and rhythm in which any given user types characters on a keyboard of keypad.

In response to the input module105receiving the first entry, at operation610, the behavioral data module110detects a correction of an error within the first input based on the one or more attributes that include the keystroke dynamics. For example, the keystroke dynamics may indicate a specific keystroke pattern that the user applied to correct the error that may for example include the backspace key, or the delete key, or a mouse/cursor to select, delete, and correct the error within the first input.

At operation615, in response to detecting the correction of the error, the scoring module115generates a score to be assigned to the user account based on the correction of the error. In some embodiments, the score may be generated based on a comparison of the keystroke pattern applied by the user to the user account, in order to determine whether or not a similar keystroke pattern has been applied by the user in the past to correct similar errors. In further embodiments, the mere application of the keystroke pattern may be sufficient to generate the score.

FIG. 7is a flowchart700illustrating a method for generating a score for an entry into a data entry field, according to an example embodiment. The method700may be embodied in computer-readable instructions for execution by one or more processors (e.g., processors130ofFIG. 1) such that the steps of the method700may be performed in part or in whole by functional components (e.g., modules) of a client device160or the automated content entry detection system140, accordingly, the method700is described below by way of example with reference thereto. The method700may be performed as a subroutine or subsequent to operations of the method200, according to an example embodiment.

At operation705, in response to receiving the first entry that comprises the first input into the data entry field, the behavioral data module110accesses the user account, wherein the user account comprises a record of prior inputs received from the user account, and the corresponding attributes of the prior inputs. For example, the behavioral data module110may maintain a record of entries received from the user account, such that the record comprises indications of attributes of the entries.

At operation710, the scoring module115performs a comparison of the first input of the first entry to the record of entries of the user account. At operation715, the scoring module115identifies one or more duplicate inputs among the record of entries to the first input of the first entry into the data entry field.

At operation720, the scoring module115generates the score to be assigned to the user account based on a comparison of the attributes of the duplicate inputs to the one or more attributes of the first entry. As discussed above, the score may be based on a similarity of the attributes, such that a greater degree of similarity may indicate that the user of the user account is the genuine user, whereas a lesser degree of similarity may indicate that the user account is compromised. In some embodiments, however, an extremely high degree of exactness between the attributes of the one or more duplicate inputs and the first input may be an indication that the user account is being utilized by an automated agent.

FIG. 8is a flowchart illustrating a method800for generating a score for an entry into a data entry field, according to an example embodiment. The method800may be embodied in computer-readable instructions for execution by one or more processors (e.g., processors130ofFIG. 1) such that the steps of the method800may be performed in part or in whole by functional components (e.g., modules) of a client device160or the automated content entry detection system140: accordingly, the method800is described below by way of example with reference thereto. The method800may be performed as a subroutine or subsequent to operations of the method200, according to an example embodiment.

At operation805, the input module105receives a first entry from a user account, wherein the first entry includes a first input that comprises one or more attributes, wherein the one or more attributes include temporal data. The temporal data includes a timestamp that indicates a time of day in which the first entry was received by the input module105.

At operation810, in response to the input module105receiving the first entry from the user account, the behavioral data module110accesses the user account to retrieve user activity data. In some embodiments, the user activity data of the user account may provide an indication of regular hours of activity of the user. For example, the user activity data may indicate that the user is most active at specific times of the day, or days of the week, or seasonally.

In some embodiments, the user activity data may provide an indication of regular hours of activity based on input type. For example, the user activity data may indicate that a first input type are primarily received from the user account at a first time, whereas a second input type are primarily received from the user account at a second time.

At operation815, the behavioral data module110determines a time period based on the user activity data of the user account and the first input of the first entry. For example, the time period may indicate an expected period of activity for the first input.

At operation820, the scoring module115performs a comparison of the temporal data from the first entry with the expected period of activity retrieved from the user account. Based on the comparison, at operation825, the scoring module generates a score to be assigned to the user account. In such embodiments, if the temporal data of the first entry is far outside of the expected period of activity, the score may reflect that the user account may be compromised. For example, “far outside,” may mean that the first entry was received twelve hours off schedule of what is normal for the user.

FIG. 9is an interaction diagram900illustrating various operations performed by the automated content entry detection system140, according to an example embodiment. The interaction diagram900depicts embodiments of the automated content entry detection system140, wherein attributes of entries are passed from the client device160to a server executing the automated content entry detection system140. In such embodiments, measurements and attributes may be collected and passed from the client device160to the automated content entry detection system140in real-time, such that the automated content entry detection system140may generate scores based on entries dynamically.

According to the interaction diagram900, at operation905, the client device160receives or otherwise generates an input into a first data entry field that may be presented within a GUI at the client device160, and wherein the input comprises one or more attributes.

At operation910, the client device160passes the first input and the one or more attributes of the first input, to a server executing the automated content entry detection system140as a first entry that comprises the first input. In some embodiments, the automated content entry detection system140may maintain a constant, real-time stream of communication with the client device160, in order to continually receive attributes of inputs measured and collected by the client device160.

At operation915, the automated content entry detection system140determines behavioral data of the first entry based on the one or more attributes of the first input, collected at the client device160.

At operation920, the automated content entry detection system140generates a score to be assigned to the user account based on the one or more attributes of the first input, and at operation925, the automated content entry detection system140determines the score of the user account transgresses the threshold value.

FIG. 10is an interaction diagram1000illustrating various operations performed by the automated content entry detection system140, according to an example embodiment. The interaction diagram1000depicts embodiments of the automated content entry detection system140, wherein attributes of entries collected and maintained at the client device160in order to generate a score to be assigned to a user account. In such embodiments, the score may ultimately be passed from the client device160to the automated content entry detection system140, wherein the automated content entry detection system140may determine whether or not the score of the user account transgresses a threshold value.

According to interaction diagram1000, at operation1005, the client device160receives the first input into a data entry field. For example, the data entry field may be presented within a GUI at the client device160. The first input may comprise one or more attributes collected and measured by the client device160, including for example, keystroke dynamics, motion data, image data, as well as temporal data.

At operation1010, the client device160determines behavioral data of the first entry based on the one or more attributes of the first input, and at operation1015, generates a score to be assigned to the user account based on the behavioral data.

At operation1020, the client device160passes the score to the automated content entry detection system140, wherein the automated content entry detection system140may determine that the score transgresses a threshold value.

In such embodiments, the client device160may dynamically generate and pass on scores in real-time, as inputs are received by the client device160, and attributes of the inputs are collected by the client device160.

FIG. 11illustrates a diagrammatic representation of a machine1100in the form of a computer system within which a set of instructions may be executed for causing the machine to perform any one or more of the methodologies discussed herein, according to an example embodiment. Specifically,FIG. 11shows a diagrammatic representation of the machine1100in the example form of a computer system, within which instructions1116(e.g., software, a program, an application, an applet, an app, or other executable code) for causing the machine1100to perform any one or more of the methodologies discussed herein may be executed. In some embodiments, the instructions1116of the processors1114are specially configured to execute the modules of the automated content entry detection system140. In such embodiments, the instructions1116may cause at least the processors1114of the machine1100to execute the methods depicted inFIGS. 2A-10. Additionally, or alternatively, the instructions1116may implementFIGS. 2A-10, and so forth. The instructions1116transform the general, non-programmed machine1100into a particular machine1100programmed to carry out the described and illustrated functions in the manner described. In alternative embodiments, the machine1100operates as a standalone device or may be coupled (e.g., networked) to other machines. In a networked deployment, the machine1100may operate in the capacity of a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine1100may comprise, but not be limited to, a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (STB), a PDA, an entertainment media system, a cellular telephone, a smart phone, a mobile device, a wearable device (e.g., a smart watch), a smart home device (e.g., a smart appliance), other smart devices, a web appliance, a network router, a network switch, a network bridge, or any machine capable of executing the instructions1116, sequentially or otherwise, that specify actions to be taken by the machine1100. Further, while only a single machine1100is illustrated, the term “machine” shall also be taken to include a collection of machines1100that individually or jointly execute the instructions1116to perform any one or more of the methodologies discussed herein.

The machine1100may include processors1110, memory1130, and I/O components1150, which may be configured to communicate with each other such as via a bus1102. In an example embodiment, the processors1110(e.g., a Central Processing Unit (CPU), a Reduced Instruction Set Computing (RISC) processor, a Complex Instruction Set Computing (CISC) processor, a Graphics Processing Unit (GPU), a Digital Signal Processor (DSP), an ASIC, a Radio-Frequency Integrated Circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, a processor1112and a processor1114that may execute the instructions1116. The term “processor” is intended to include multi-core processors that may comprise two or more independent processors (sometimes referred to as “cores”) that may execute instructions contemporaneously. AlthoughFIG. 11shows multiple processors, the machine1100may include a single processor with a single core, a single processor with multiple cores (e.g., a multi-core processor), multiple processors with a single core, multiple processors with multiples cores, or any combination thereof.

The memory1130may include a main memory1132, a static memory1134, and a storage unit1136, both accessible to the processors1110such as via the bus1102. The main memory1130, the static memory1134, and storage unit1136store the instructions1116embodying any one or more of the methodologies or functions described herein. The instructions1116may also reside, completely or partially, within the main memory1132, within the static memory1134, within the storage unit1136, within at least one of the processors1110(e.g., within the processor's cache memory), or any suitable combination thereof, during execution thereof by the machine1100.

Communication may be implemented using a wide variety of technologies. The I/O components1150may include communication components1164operable to couple the machine1100to a network1180or devices1170via a coupling1182and a coupling1172, respectively. For example, the communication components1164may include a network interface component or another suitable device to interface with the network1180. In further examples, the communication components1164may include wired communication components, wireless communication components, cellular communication components, Near Field Communication (NFC) components, Bluetooth® components (e.g., Bluetooth® Low Energy), Wi-Fi® components, and other communication components to provide communication via other modalities. The devices1170may be another machine or any of a wide variety of peripheral devices (e.g., a peripheral device coupled via a USB).

The various memories (i.e.,1130,1132,1134, and/or memory of the processor(s)1110) and/or storage unit1136may store one or more sets of instructions and data structures (e.g., software) embodying or utilized by any one or more of the methodologies or functions described herein. These instructions, when executed by processor(s)1110cause various operations to implement the disclosed embodiments.

The instructions1116may be transmitted or received over the network1180using a transmission medium via a network interface device (e.g., a network interface component included in the communication components1164) and utilizing any one of a number of well-known transfer protocols (e.g., hypertext transfer protocol (HTTP)). Similarly, the instructions1116may be transmitted or received using a transmission medium via the coupling1172(e.g., a peer-to-peer coupling) to the devices1170. The terms “transmission medium” and “signal medium” mean the same thing and may be used interchangeably in this disclosure. The terms “transmission medium” and “signal medium” shall be taken to include any intangible medium that is capable of storing, encoding, or carrying the instructions1116for execution by the machine1100, and includes digital or analog communications signals or other intangible media to facilitate communication of such software. Hence, the terms “transmission medium” and “signal medium” shall be taken to include any form of modulated data signal, carrier wave, and so forth. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a matter as to encode information in the signal.