Mouse Entropy

Applies information theory to cursor coordinate streams by discretizing the movement plane into a grid and calculating the probability distribution of directional changes. A human user generates high entropy values due to micro-corrections and non-deterministic pathing, while a bot or script produces low entropy with highly predictable, straight-line vectors. The formula H = -Σ p(x) log p(x) quantifies this unpredictability as bits per symbol.

Measures the inter-event timing between mouse samples. Human motor control exhibits 1/f noise characteristics—a natural fractal pattern of pauses and bursts. Automated scripts generate unnaturally consistent polling intervals or perfectly uniform acceleration curves. Key metrics include:

• Inter-click interval variance: Humans show high variance; bots show near-zero variance
• Dwell-to-transition ratio: The proportion of stationary time versus movement time
• Jitter amplitude: Microscopic oscillations from physiological hand tremor (8-12 Hz in humans)

Analyzes the third derivative of position (jerk) to quantify movement smoothness. Human cursor paths exhibit bounded jerk with natural overshoot and correction arcs due to the biomechanics of the wrist and forearm. Scripted movements produce minimum-jerk trajectories that follow mathematically optimal Bézier curves. Detection features include:

• Curvature variability: Standard deviation of path curvature over a sliding window
• Overshoot frequency: Count of target overshoots requiring corrective submovements
• Acceleration asymmetry: The ratio of acceleration to deceleration phases

Entropy is not evaluated in isolation but normalized against the UI context. A user navigating a dense form field will naturally exhibit different entropy than one moving across a sparse landing page. Contextual entropy builds a baseline per page element type—buttons, text fields, dropdowns—and flags deviations. A bot may display human-like entropy on a simple page but collapse to low entropy when confronted with a complex, dynamic layout that lacks pre-scripted coordinates.

Entropy is calculated over sliding time windows (typically 200-500ms) rather than entire sessions to enable real-time intervention. A sudden entropy collapse mid-session—where a human hands off control to an automated script—is a critical signal for session hijacking. The system maintains a running z-score comparing current window entropy against the session's historical distribution, triggering a risk escalation when the deviation exceeds a configurable threshold.

Mouse entropy is fused with keystroke entropy and scroll entropy to create a multi-dimensional behavioral signature. A human exhibits correlated entropy across modalities—hesitant typing aligns with erratic mouse hovering. Bots often fail to synchronize these channels, showing high keystroke entropy (randomized injection) alongside low mouse entropy (straight-line automation). Cross-modal correlation coefficients below a learned threshold indicate synthetic behavior.

The parent discipline that captures and analyzes the unique characteristics of a user's cursor movements. While mouse entropy quantifies the randomness of a trajectory, mouse dynamics also measures velocity, acceleration, jerk, and click patterns to build a holistic behavioral profile. A genuine user exhibits smooth, curved arcs with micro-corrections, whereas a script produces perfectly linear or unnaturally jagged paths.

The process of identifying automated traffic by analyzing non-human behavioral patterns. Low mouse entropy is a primary signal: bots generate cursor movements with near-zero timing variance and deterministic geometric paths. Detection engines combine entropy scores with other signals like superhuman click speed, missing browser environmental attributes, and perfectly linear trajectories to flag scripted sessions.

A parallel concept that quantifies the timing variability within a typing stream. Human typists exhibit natural inconsistencies in dwell time and flight time, producing high entropy. Automated key injectors or bots display highly regular, low-entropy patterns. When combined with mouse entropy, these two signals create a robust cross-modal behavioral fingerprint that is extremely difficult for attackers to spoof simultaneously.

A security mechanism that persistently validates a user's identity throughout an entire session by passively analyzing behavioral signals. Mouse entropy serves as a continuous biometric stream: a sudden drop in entropy mid-session may indicate a session hijacking event where an automated script takes over. This allows security systems to trigger step-up authentication or terminate the session without disrupting the legitimate user.

The process of collecting and analyzing the sequence of page views and click events to build a behavioral profile. Mouse entropy adds a critical kinetic layer to clickstream data: - Navigation patterns: Which elements are hovered before clicking - Hesitation signals: Micro-pauses indicating human decision-making - Scroll behavior: Natural vs. mechanical scrolling cadence Together, these signals distinguish a genuine user exploring a page from a scraper executing a pre-programmed DOM traversal.

The identification of an attack where a valid user session is compromised. Abrupt changes in mouse entropy are a leading indicator: a session that transitions from high-entropy human movements to low-entropy scripted behavior signals a takeover. This is combined with other signals like device fingerprint mismatch, geovelocity violations, and impossible travel to trigger automated remediation before financial damage occurs.