System and method for processing user interface events
A system and method to detect and prevent non-human interaction between a client and a web server invokes an effect to change the event generation behavior at the client. Subsequent event streams from the client to the server are analyzed to determine whether the event streams contain events corresponding to expected reactions of a human operator at the client to the effect. Indications of non-human behavior may invoke more direct human testing, for example using a dynamic CAPTCHA application, or may cause a termination of the client/URL interaction.
1. A method of processing an event stream, the method comprising:
receiving at least one event stream message;
recording an arrival time of the at least one event stream message;
determining whether a sampling function, which specifies times at which an event will be recorded, is being used to determine arrival times of corresponding events included in the at least one event stream message; and
when it is determined that a client is using the sampling function, recording the at least one event stream message in a message stream buffer.
2. The method of claim 1 , wherein determining whether the sampling function is being used further comprises:
determining that a corresponding timestamp for at least one event matches a valid sample time determined by the sampling function.
3. The method of claim 1 , wherein determining whether the sampling function is being used further comprises:
determining that a corresponding timestamp for at least one event does not match a valid sample time provided by the sampling function;
setting a flag to indicate a failure to use the sampling function; and
recording at least one of the corresponding timestamp for the event and the arrival time of the event stream message prior to buffering the events of the at least one event stream message in the message stream buffer.
4. The method of claim 1 , wherein determining whether the sampling function is being used further comprises:
determining whether a message rate of the messages in the message stream buffer match a message rate specified by a sampling function, the message rate based on a timestamp analysis of the received event stream messages.
5. The method of claim 4 , further comprising:
determining the message rate of the buffered messages exceeds a message rate associated with the sampling function; and
setting a flag for each of the events analyzed in the event stream message to indicate a message rate mismatch.
6. The method of claim 5 , wherein the message rate mismatch is indicative of a non-human interaction.
7. The method of claim 5 , wherein the message rate mismatch is indicative of a malicious computer program attack.
8. An apparatus configured to process an event stream, the apparatus comprising:
a receiver that receives at least one event stream message;
a memory that records an arrival time of the at least one event stream message; and
a processor that:
determines whether a sampling function, which specifies times at which an event will be recorded, is being used to determine arrival times of corresponding events included in the at least one event stream message; and
when it is determined that a client is using the sampling function, records the at least one event stream message in a message stream buffer.
9. The apparatus of claim 8 , wherein the processor being configured to determine whether the sampling function is being used further comprises the processor being configured to determine that a corresponding timestamp for at least one event matches a valid sample time determined by the sampling function.
10. The apparatus of claim 8 , wherein the processor being configured to determine whether the sampling function is being used further comprises the processor being configured to
determine that a corresponding timestamp for at least one event does not match a valid sample time provided by the sampling function,
set a flag to indicate a failure to use the sampling function, and
record at least one of the corresponding timestamp for the event and the arrival time of the event stream message prior to the events of the at least one event stream message being buffered in the message stream buffer.
11. The apparatus of claim 8 , wherein the processor being configured to determine whether the sampling function is being used further comprises the processor being configured to determine whether a message rate of the messages in the message stream buffer match a message rate specified by a sampling function, the message rate based on a timestamp analysis of the received event stream messages.
12. The apparatus of claim 11 , wherein the processor is further configured to determine whether the message rate of the buffered messages exceeds a message rate associated with the sampling function, and set a flag for each of the events analyzed in the event stream message to indicate a message rate mismatch.
13. The apparatus of claim 12 , wherein the message rate mismatch is indicative of a non-human interaction.
14. The apparatus of claim 12 , wherein the message rate mismatch is indicative of a malicious computer program attack.
15. A non-transitory computer readable storage medium configured to store instructions that when executed cause a processor to perform processing an event stream, the processor being further configured to perform:
receiving at least one event stream message;
recording an arrival time of the at least one event stream message;
determining whether a sampling function, which specifies time at which an event will be recorded, is being used to determine arrival times of corresponding events included in the at least one event stream message; and
when it is determined that a client is using the sampling function, recording the at least one event stream message in a message stream buffer.
16. The non-transitory computer readable storage medium of claim 15 , wherein determining whether the sampling function is being used further comprises:
determining that a corresponding timestamp for at least one event matches a valid sample time determined by the sampling function.
17. The non-transitory computer readable storage medium of claim 15 , wherein determining whether the sampling function is being used further comprises:
determining that a corresponding timestamp for at least one event does not match a valid sample time provided by the sampling function;
setting a flag to indicate a failure to use the sampling function; and
recording at least one of the corresponding timestamp for the event and the arrival time of the event stream message prior to buffering the events of the at least one event stream message in the message stream buffer.
18. The non-transitory computer readable storage medium of claim 15 , wherein determining whether the sampling function is being used further comprises:
determining whether a message rate of the messages in the message stream buffer match a message rate specified by a sampling function, the message rate based on a timestamp analysis of the received event stream messages.
19. The non-transitory computer readable storage medium of claim 18 , wherein the processor is further configured to perform:
determining the message rate of the buffered messages exceeds a message rate associated with the sampling function; and
setting a flag for each of the events analyzed in the event stream message to indicate a message rate mismatch.
20. The non-transitory computer readable storage medium of claim 19 , wherein the message rate mismatch is indicative of a non-human interaction.