Bot Signature Detection

Quantifies the randomness of cursor movements to distinguish human motor control from scripted trajectories. Low entropy indicates automation.

• Human Movement: Exhibits natural micro-jitters, variable acceleration, and curved paths.
• Bot Movement: Displays perfectly linear lines, constant velocity, and instant teleportation.
• Entropy Scoring: Algorithms calculate the Shannon entropy of the movement vector series.

Example: A cursor moving in a perfectly straight line at a constant speed of 500px/s has near-zero entropy and is a definitive bot signature.

Creates a client identifier from the specific parameters advertised during the Transport Layer Security handshake, independent of the IP address.

• Client Hello Analysis: Inspects the ordered list of cipher suites, TLS extensions, and elliptic curves.
• Signature Uniqueness: Different operating systems, browsers, and libraries (e.g., Python requests, Go http) produce distinct fingerprints.
• Impersonation Detection: Flags mismatches where a TLS fingerprint doesn't match the claimed User-Agent.

Example: A User-Agent claiming to be Firefox but presenting a Python urllib3 TLS fingerprint is a clear indicator of a scripted client.

Identifies browser automation frameworks like Selenium, Puppeteer, and Playwright by probing for specific JavaScript properties injected by the automation driver.

• navigator.webdriver: A standard property set to true in automated browsers.
• Chrome DevTools Protocol: Checks for debugging flags like --remote-debugging-port.
• Shadow DOM Artifacts: Detects inconsistencies in the Document Object Model structure.

Example: The presence of document.querySelector('html').__driver_evaluate or window.cdc_adoQpoasnfa76pfcZLmcfl_Array is a definitive Puppeteer signature.

Exploits the HTML5 Canvas API to render a hidden graphic and capture subtle variations in the device's graphics hardware and driver stack to create a unique identifier.

• Rendering Differences: Subtle anti-aliasing and pixel rounding vary across GPU and OS combinations.
• Hash Generation: The rendered image data is hashed into a stable fingerprint.
• Bot Consistency: Bots often render identical canvases due to running on homogeneous virtualized infrastructure.

Example: Thousands of sessions sharing an identical canvas hash from a known cloud provider's virtual GPU is a strong signal of a bot farm.

Measures the timing variability within a typing stream to detect automated key injectors. Human typists exhibit natural inconsistencies, while bots display highly regular, low-entropy patterns.

• Dwell Time: The duration a key is held down. Humans vary; bots are constant.
• Flight Time: The interval between key releases and presses. Bots inject text with near-zero flight time.
• Rhythm Analysis: Models the cadence of typing bursts.

Example: A login form filled in 50ms with uniform 1ms flight times between all keystrokes is a definitive signature of a scripted paste or key injector, not a human typist.

Quantifies the randomness of cursor trajectories to distinguish human from scripted movement. Key metrics include:

• Angular deviation: Humans produce curved paths; bots generate straight lines
• Velocity variance: Natural acceleration/deceleration vs. constant speed
• Jitter patterns: Micro-corrections absent in automated movements Low entropy scores indicate deterministic, programmatic cursor control typical of automation frameworks like Selenium.

Creates a client identity signature from the Transport Layer Security handshake parameters independent of IP address. The specific combination of cipher suites, TLS version, elliptic curves, and extension ordering forms a unique fingerprint. Automated tools like Python's requests library and curl produce distinct, identifiable TLS signatures that differ from genuine browser stacks.

Measures the timing variability within typing streams to detect automated key injection. Human typists exhibit natural inconsistencies in dwell time (key hold duration) and flight time (inter-key interval). Bots and credential stuffing scripts inject keystrokes with:

• Near-zero variance between key events
• Identical inter-key delays
• Absence of typo correction patterns Low entropy typing is a strong bot signature.

Exploits the HTML5 Canvas API to render a hidden graphic and capture subtle hardware and driver variations. Different GPU/driver/OS combinations produce slightly different pixel outputs due to anti-aliasing and font rendering differences. Bots often return null or uniform canvas hashes when running headlessly, or produce signatures inconsistent with their claimed User-Agent, revealing automation.