Detection of client-side malware activity
A computer-implemented method includes providing, for use by a third-party, injectable computer code that is capable of being served with other code provided by the third-party to client computing devices; receiving data from client computing devices that have been served the code by the third-party, the data including data that characterizes (a) the client computing devices and (b) user interaction with the client computing devices; classifying the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices; and providing to the third party one or more reports that characterize an overall level of automated software activity among client computing devices that have been served code by the third party.
1. A computer-implemented method, comprising:
providing, for use by a content serving organization that operates one or more web servers, injectable computer code of a security service organization that is separate from the content serving organization, wherein the provided injectable computer code is capable of being served with other code provided by the content serving organization to client computing devices;
receiving, by the security service organization and from client computing devices that have been served the code by the one or more web servers of the content serving organization, data generated by the injectable computer code executing on the client computing devices that characterizes (a) the client computing devices and (b) user interaction with the client computing devices;
classifying, by the security service organization, the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices; and
providing to the content serving organization one or more reports that characterize an overall level of automated software activity among client computing devices that have been served code by the content serving organization.
2. The computer-implemented method of claim 1 , wherein the injectable code is served from a domain that matches a domain to which the client computing devices transmit the data that characterizes the client computing devices and the user interaction with the client computing devices.
3. The computer-implemented method of claim 1 , wherein the injectable code is served by a system operated by the content serving organization and the data that characterizes the client computing devices and the user interaction with the client computing devices is submitted by the client computing devices to an organization that provided the injectable computer code for use by the content serving organization.
4. The computer-implemented method of claim 1 , wherein the data that characterizes the client computing devices comprises data obtained from document object models created on respective ones of the client computing devices from execution of code served to the respective ones of the client computing devices by the content serving organization.
5. The computer-implemented method of claim 1 , wherein the data that characterizes user interaction with the client computing devices comprises mouse and keystroke events.
6. The computer-implemented method of claim 5 , wherein the data that characterizes user interaction with the client computing devices is generated using code that hooks onto mouse and keystroke handlers for the client computing devices.
7. The computer-implemented method of claim 1 , wherein the data that characterizes user interaction with the client computing devices comprises form submission activity for one or more web forms served to the client computing devices by the content serving organization.
8. The computer-implemented method of claim 1 , further comprising
providing the content serving organization with a mechanism for obfuscating code served by the content serving organization to the client computing devices;
receiving data from client computing devices that have been served the code by the content serving organization using the mechanism for obfuscating code; and
classifying the client computing devices that have been served the code by the content serving organization using the mechanism for obfuscating code, as being controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices,
wherein at least one of the one or more reports provided to the content serving organization compare automated software activity among the client computing devices from before the mechanism for obfuscating code was provided to the content serving organization to automated software activity among the client computing devices from after the mechanism for obfuscating code was provided to the content serving organization.
9. The computer-implemented method of claim 1 , wherein classifying the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices, comprises identifying actions that definitely indicate an absence of a human user in performance of the actions.
10. A computer-implemented method, comprising:
providing, for use by a third-party, injectable computer code that is capable of being served with other code provided by the third-party to client computing devices;
receiving data from client computing devices that have been served the code by the third-party, the data including data that characterizes (a) the client computing devices and (b) user interaction with the client computing devices;
classifying the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices;
providing to the third-party one or more reports that characterize an overall level of automated software activity among client computing devices that have been served code by the third-party, wherein
a first subset of the received data is provided by client computing devices that have been served original code from the third-party; and
a second subset of the received data is provided by client computing devices that have been served code from the third-party that has been obfuscated by altering original code from the third in a different manner for each serving of the original code from the third-party, the altering in a different manner for each serving interfering with an ability of malware to identify a manner in which the code from the third-party operates.
11. A computer-implemented system, comprising:
a first computer system operated for a security service organization and storing copies of injectable code for provision to content serving organizations that do not operate the first computer system;
one or more second computer systems comprising web server systems operated by the content serving organization and programmed to serve the injectable code with code produced by respective ones of the one or more content serving organizations;
an activity analyzer sub-system executed by one or more servers that are operated in coordination with the first computer system, and arranged to receive activity data from injectable code served by the one or more second computer systems and to analyze the activity data to determine whether particular ones of clients executing the injectable code are operated by humans or by computer bots; and
a report generator associated with the first computer system, operated by the security service organization, and arranged to generate electronic reports for provision to the third-parties indicating levels of bot activity in clients served by respective ones of the third-parties, wherein the reports are generated using data aggregated across multiple clients to show a level of bot activity in an aggregated group of the clients.
12. The computer-implemented system of claim 11 , wherein the injectable code is served from a domain that matches a domain to which the injectable code causes the clients to transmit the activity data.
13. The computer-implemented system of claim 11 , wherein the activity data comprises data obtained from document object models created on respective ones of the clients from execution of code served to respective ones of the clients by the content serving organizations.
14. The computer-implemented system of claim 11 , wherein the activity data comprises data that characterizes mouse and keystroke events.
15. The computer-implemented system of claim 14 , wherein the activity data is generated using code executed on the clients that hooks onto mouse and keystroke handlers for the clients.
16. The computer-implemented system of claim 11 , wherein the system is programmed to identify definitive indications of an absence of a human user in performance of a defined action.
17. The computer-implemented system of claim 11 , wherein the activity data comprises form submission activity for one or more web forms served to the clients by the content serving organizations.
18. The computer-implemented system of claim 11 , further comprising a sub-system arranged to cooperate with the first computer system to:
provide the content serving organizations with a mechanism for obfuscating code served by the content serving organizations to the clients;
receive data from clients that have been served the code by the content serving organization using the mechanism for obfuscating code; and
classifying the clients that have been served the code by the content serving organization using the mechanism for obfuscating code, as being controlled by actual users or instead by automated software, based on analysis of the received data from the clients,
wherein at least one of the electronic reports for provision to the content serving organization compares automated software activity among the clients from before the mechanism for obfuscating code was provided to the content serving organization, to automated software activity among the clients from after the mechanism for obfuscating code was provided to the content serving organization.
19. One or more tangible, non-transient computer-readable devices having stored thereon instructions, that when executed by one or more processors, perform actions comprising:
providing, for use by a content serving organization that operates one or more web servers, injectable computer code of a security service organization that is separate from the content serving organization, wherein the provided injectable code is capable of being served with other code provided by the content serving organization to client computing devices;
receiving, by the security service organization and from client computing devices that have been served the code by the one or more web servers of the content serving organization, data that characterizes (a) the client computing devices and (b) user interaction with the client computing devices;
classifying, by the security service organization, the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices; and
providing to the content serving organization one or more reports that characterize an overall level of automated software activity among client computing devices that have been served code by the content serving organization.
20. The one or more computer-readable devices of claim 19 , wherein the injectable code is served by a system operated by the content serving organization and the data that characterizes the client computing devices and the user interaction with the client computing devices is submitted by the client computing devices to an organization that provided the injectable computer code for use by the content serving organization.
21. The one or more computer-readable devices of claim 19 , wherein the data that characterizes user interaction with the client computing devices comprises form submission activity for one or more web forms served to the client computing devices by the content serving organization.