How Do Websites Detect Bot-Like Cursor Movement

Question

How the cursor moves on a website can tell a big story. It could be used to determine if someone is a human or not.

Is the mousemove event the only way to track cursor movement?

Something like this:

jQuery(document).ready(function(){

   $(document).mousemove(function(e){
      $('#status').html(e.pageX +', '+ e.pageY);
   }); 
})

Then I could have some algorithm to detect if the mouse is actually being moved. That's it's not moving in a 100% straight line all the time. Is this all I've got to work with?

Is this how Websites like Facebook would do this?

Answer 1

I like your idea about detecting mouse movements! It's also the first post I've seen (with the selenium tag) that talks detecting selenium instead of just getting around detection.

I think the reality of bot detection is much less exciting.

Standing on the shoulders of giants - a clever method of detection is done by identifying global javascript variables used by selenium/chromedriver.

That post also talks about how to modify your chromedriver with a hex-editor to update your variable name in order to avoid detection - with lots of mixed responses.

There are also companies out there which sell bot-protection-systems. And even a forrester report which outlines many companies in this market. There is even an open source version. You can potentially investigate some of those companies if you need bot protection ideas/approaches.