Accurately classifying a computer program interacting with a computer system using questioning and fingerprinting
View Patent ↗Methods, systems, and computer program products for accurately classifying a computer program interacting with a computer system using questioning and fingerprinting are provided. A computer-implemented method may include issuing a challenge to an application interacting with a computer system to determine whether activity performed by the application is scripted, analyzing data associated with a result of the challenge to determine whether the result is at least partially correct, and computing a reputation score for the application based on the result of the challenge. A computer-implemented method also may include comparing the reputation score for the application to a threshold for identifying non-scripted activity, and determining that the activity performed by the application is scripted when the reputation score for the application does not meet the threshold for identifying non-scripted activity.
1. A computer system, comprising:
a non-transitory memory; and
one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the computer system to perform operations comprising:
issuing a challenge to an application interacting with the computer system to determine whether activity performed by the application is scripted, wherein the challenge is a web browser challenge issued for processing by the application without human user involvement based on, at least in part, user agent data associated with the application identifying the application as a web browser;
receiving a response from the application comprising an answer to the issued web browser challenge, the answer being determined by the application without human user involvement in response to the issued challenge;
analyzing the answer to the issued web browser challenge received from the application in view of an expected answer to determine whether the application is imitating the web browser; and
classifying the application as scripted based on a reputation score computed for the application and based on determining from the answer that the application is imitating the web browser.
2. The computer system of claim 1 , the operations further comprising:
computing the reputation score for the application based on the analyzing of the answer; and
comparing the reputation score for the application to a threshold for identifying scripted activity.
3. The computer system of claim 1 , wherein the issued web browser challenge involves the application performing an activity directly without human user involvement using computer code provided by the computer system.
4. The computer system of claim 3 , wherein the issued web browser challenge issued to the application comprises JavaScript® computer language code to test whether the application is a non-web browser script in view of the application claiming to be a web browser.
5. The computer system of claim 1 , wherein the application is classified as scripted when the answer determined by the application is at least partially incorrect in view of an application type claimed by the application.
6. The computer system of claim 1 , wherein the application is classified as scripted when the answer determined by the application is at least partially incorrect in view of identifying information provided by the application.
7. The computer system of claim 1 , wherein the issued web browser challenge involves the application analyzing one or more words without human user involvement.
8. The computer system of claim 1 , wherein the issued web browser challenge involves the application analyzing one or more sentences without human user involvement.
9. The computer system of claim 1 , wherein the issued web browser challenge involves the application solving one or more mathematical problems without human user involvement.
10. The computer system of claim 1 , wherein the issued web browser challenge involves the application solving a mathematical problem having at least two answers without human user involvement.
11. The computer system of claim 1 , wherein the issued web browser challenge involves the application demonstrating awareness of a fact without human user involvement.
12. The computer system of claim 1 , the operations further comprising:
determining one or more fonts associated with the application; and
adjusting the reputation score computed for the application in view of the one or more fonts associated with the application.
13. The computer system of claim 1 , the operations further comprising:
determining one or more add-ons associated with the application; and
adjusting a reputation score computed for the application in view of the one or more add-ons associated with the application.
14. The computer system of claim 1 , the operations further comprising:
analyzing one or more cached objects associated with the application; and
adjusting the reputation score computed for the application in view of analyzing the cached objects.
15. The computer system of claim 1 , the operations further comprising:
analyzing speed for each of one or more responses the application provides to the computer system; and
adjusting the reputation score computed for the application in view of analyzing the speed of the one or more responses provided by the application.
16. The computer system of claim 15 , wherein the speed of the one or more responses is compared to a preexisting baseline of related computer system activity performed by a human.
17. The computer system of claim 1 , the operations further comprising:
analyzing header information provided by the application; and
adjusting the reputation score computed for the application in view of analyzing the header information provided by the application.
18. A computer-implemented method, comprising:
issuing, by a processor device, a challenge to an application interacting with a computer system to determine whether activity performed by the application is scripted, wherein the challenge is a web browser challenge issued for processing by the application without human user involvement based on, at least in part, user agent data associated with the application identifying the application as a web browser;
receiving, by the processor device, a response from the application comprising an answer to the issued web browser challenge, the answer being determined by the application without human user involvement in response to the issued challenge;
analyzing, by the processor device, the answer to the issued web browser challenge received from the application in view of an expected answer to determine whether the application is imitating the web browser; and
classifying the application as scripted based on a reputation score computed for the application and based on determining from the answer that the application is imitating the web browser.
19. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
issuing a challenge to an application interacting with a computer system to determine whether activity performed by the application is scripted, wherein the challenge is a web browser challenge issued for processing by the application without human user involvement based on, at least in part, user agent data associated with the application identifying the application as a web browser;
receiving a response from the application comprising an answer to the issued web browser challenge, the answer being determined by the application without human user involvement in response to the issued challenge;
analyzing the answer to the issued web browser challenge received from the application in view of an expected answer to determine whether the application is imitating the web browser; and
classifying the application as scripted based on a reputation score computed for the application and based on determining from the answer that the application is imitating the web browser.