Dynamic data signal collection to prevent telemetry spoofing in a bot detection system
The subject matter herein provides a platform and mechanism to enable dynamic control over data signal collection telemetry in a bot detection-based access control system executing, for example, in associated with a multi-tenant shared network infrastructure. The approach herein leverages the ability of a native SDK running in a mobile device application to launch and use a webview that controls the data collection process. The techniques make it harder for bad actors to send spoofed telemetry from their mobile devices to an overlay network edge platform having an associated bot detection system back-end.
1 . A method of enabling an application executing on a client-side device to access a protected endpoint executing on a remote node, the remote node comprising an edge server from which the protected endpoint is accessible, the remote node associated with a back-end server that provides a bot detection, the client-side device executing a code library in association with the application, comprising:
within an operating context initiated by the application:
initiating a webview;
issuing a request from the webview to the remote node, the request having associated therewith first data collected by the code library;
in response to the request, receiving from the remote node a script, the script having been generated at the remote node and identifying one or more signals for data collection;
run-time executing the script in the webview and, as a result, collecting second data as specified by the one or more signals;
delivering telemetry to the remote node, the telemetry facilitating the bot detection and including at least the second data; and
based at least in part on the telemetry, enabling access to the protected endpoint.
2 . The method as described in claim 1 , wherein the code library is a Software Development Kit (SDK).
3 . The method as described in claim 2 , wherein the telemetry also includes sensor data collected by the SDK.
4 . The method as described in claim 3 , wherein the telemetry is encrypted.
5 . The method as described in claim 1 , the script having been selected from a set of scripts available from the remote node.
6 . The method as described in claim 1 , the one or more signals having been selected from a set of signals.
7 . The method as described in claim 6 , wherein the one or more signals comprise a plurality of signals with an order having been specified for the script.
8 . The method as described in claim 1 wherein the first data comprises information about the client-side device.
9 . The method as described in claim 1 , wherein access to the protected endpoint is based on a determination at the remote node that the client-side device is associated with a human user, wherein the determination is based at least in part on the telemetry.
10 . An apparatus, comprising:
one or more hardware processors; and
computer memory holding computer program instructions executed by the one or more hardware processors, the computer program instructions configured to provide dynamic control over a data collection mechanism, the data collection mechanism operating on a client-side device running application, the application having an associated code library, the computer program instructions having program code configured to:
receive a request, the request having been issued from a webview running in the client-side device in association with the code library;
in response to the request, identifying a script, and one or more signals for data collection to be evaluated on the client-side device;
return the script to the webview;
receive telemetry from the client-side device, the telemetry facilitating a bot detection and including data having been collected at the client-side device based on runtime execution of the script in the webview; and
based at least in part on the telemetry, enabling access to a protected endpoint.
11 . The apparatus as described in claim 10 , wherein the code library is a Software Development Kit (SDK).
12 . The apparatus as described in claim 10 , wherein the program code is further configured to select the script from a set of scripts.
13 . The apparatus as described in claim 12 , wherein the program code is further configured to select the one or more signals from a set of signals.
14 . The apparatus as described in claim 13 , wherein the one or more signals comprise a plurality of signals with an order, and wherein the program code is further configured to specify the order.
15 . The apparatus as described in claim 10 , wherein the protected endpoint is associated with an edge server.
16 . The apparatus as described in claim 10 , wherein access to the protected endpoint is permitted based on a determination that the client-side device is associated with a human user.
17 . A method to control data collection, comprising:
configuring an application with a native code library;
initiating a webview;
issuing from the webview a request for a data collection script;
receiving the data collection script in in the webview, the data collection script having associated therewith a set of control signals having an ordering;
runtime-executing the data collection script in the webview to collect data associated with the set of control signals; and
outputting the data to facilitate a bot detection;
the identification of the set of control signals and their ordering having been determined on-the-fly in response to the request issued from the webview.
18 . The method as described in claim 17 , wherein the native code library is a Software Development Kit (SDK).
19 . The method as described in claim 17 , the data collection script having been selected from a set of data collection scripts in response to the request issued from the webview.