A method comprising: receiving, by a security server, an initial request from an application executing on a client device, wherein the application includes a security component comprising security code; in response to the initial request, generating, by the security server, a key component comprising one or more parameters from which a valid security key can be generated at the client device by executing the security code; determining by the security server, a secret cryptographic key corresponding to the one or more parameters of the key component, wherein the secret cryptographic key is not transmitted to the client device; providing, by the security server, the key component to the client device; generating, by the security component of the application at the client device, the secret cryptographic key based on the one or more parameters of the key component; receiving by the security server, a security key associated with a first subsequent request from the client device to an application server, wherein the security key received from the client device is generated by the security component, which is configured to process the one or more parameters of the key component with other data available at the client device and use the secret cryptographic key to encrypt data corresponding to the first subsequent request with the secret cryptographic key to thereby sign the first subsequent request; checking by the security server, if the security key is valid, comprising using the secret cryptographic key to decrypt the security key and analyzing the security key to determine whether the security key contains data collected at the client device that does not match a pattern of data collected when the request is generated by malware; in response to determining that the security key is valid, causing the application server to process the first subsequent request; wherein the method is performed by two or more processors. receiving, by a security server, an initial request from an application executing on a client device, wherein the application includes a security component comprising security code; in response to the initial request, generating, by the security server, a key component comprising one or more parameters from which a valid security key can be generated at the client device by executing the security code; determining by the security server, a secret cryptographic key corresponding to the one or more parameters of the key component, wherein the secret cryptographic key is not transmitted to the client device; providing, by the security server, the key component to the client device; generating, by the security component of the application at the client device, the secret cryptographic key based on the one or more parameters of the key component; receiving by the security server, a security key associated with a first subsequent request from the client device to an application server, wherein the security key received from the client device is generated by the security component, which is configured to process the one or more parameters of the key component with other data available at the client device and use the secret cryptographic key to encrypt data corresponding to the first subsequent request with the secret cryptographic key to thereby sign the first subsequent request; checking by the security server, if the security key is valid, comprising using the secret cryptographic key to decrypt the security key and analyzing the security key to determine whether the security key contains data collected at the client device that does not match a pattern of data collected when the request is generated by malware; in response to determining that the security key is valid, causing the application server to process the first subsequent request; wherein the method is performed by two or more processors.