Analyzing client application behavior to detect anomalies and prevent access

A non-transitory computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform steps comprising:

• selecting and sending over a network, by a security verification system to a plurality of client devices executing user-agent applications accessing content from an application server, sets of security tests which, when executed by the user-agent applications, are indicative of whether behaviors of the user-agent applications are consistent with expected behaviors for user-agent applications accessing content from the application server and wherein the user's actions for accessing the content are not changed by whether or not the security tests are executed;
• receiving, at the security verification system from the client devices, sets of test results from the execution of the sets of security tests by the user-agent applications;
• generating and sending, by the security verification system to the client devices, security tokens based on the sets of test results, wherein the security tokens verify security of the user-agent applications and security policies at the application server are enforced based on the security tokens.

A method comprising:

• selecting and sending over a network, by a security verification system to a plurality of client devices executing user-agent applications accessing content from an application server, sets of security tests which, when executed by the user-agent applications, are indicative of whether the user-agent application's interaction with the application server is consistent with expected interactions for user-agent applications accessing content from the application server without the security tests;
• receiving, at the security verification system from the client devices, sets of test results from the execution of the sets of security tests by the user-agent applications;
• generating and sending, by the security verification system to the client devices, security tokens based on the sets of test results, wherein the security tokens verify security of the user-agent applications and security policies at the application server are enforced based on the security tokens.

A method comprising:

• selecting and sending over a network, by a security verification system to a plurality of client devices executing user-agent applications accessing content from an application server, sets of security tests which, when executed by the user-agent applications, are indicative of whether the user-agent application's interaction with a user when accessing the content is consistent with expected interactions for user-agent applications accessing content from the application server without the security tests;
• receiving, at the security verification system from the client devices, sets of test results from the execution of the sets of security tests by the user-agent applications;
• generating and sending, by the security verification system to the client devices, security tokens based on the sets of test results, wherein the security tokens verify security of the user-agent applications and security policies at the application server are enforced based on the security tokens.