# US 8,751,628 B2 · System and method for processing user interface events > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,628 B2 - Document ID: US8751628B2 - Status: Granted - Kind: B2 - Application number: 12/435,751 - Filed: 2009-05-05 - Published: 2010-11-11 - Granted: 2014-06-10 - Earliest claimed: 2009-05-05 - Assignees: Suboti, LLC; Paul A Lipari - Applicants: Robert R Hauser - Inventors: Robert R Hauser - Web page: https://patentgrep.com/patent/US8751628B2 ## CPC - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 21/36: by graphic or iconic representation - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method to detect and prevent non-human interaction between a client and a web server invokes an effect to change the event generation behavior at the client. Subsequent event streams from the client to the server are analyzed to determine whether the event streams contain events corresponding to expected reactions of a human operator at the client to the effect. Indications of non-human behavior may invoke more direct human testing, for example using a dynamic CAPTCHA application, or may cause a termination of the client/URL interaction. ## Claims ### Claim 1 A method for determining an event generator type of an interaction between a client and a web server, the method comprising: providing an effect to the client to invoke a change in event stream generation at the client wherein the affect is a message sent from the web server; receiving an event stream from the client; recording the affects as well as any expected reactions to the event stream; processing future events in the event stream to determine whether the expected reactions occurred within a timeout period; analyzing the event stream to determine a response to the effect; and determining an event generator type from the response; wherein the generator type is set based on at least one of: whether an expected human-dependent reaction has occurred and if an expected human-dependent reaction has not occurred. ### Claim 2 (depends on 1) The method according to claim 1 further comprising: receiving a first event stream from the client; and analyzing the first event stream to determine whether the effect is required to be provided to the client. ### Claim 3 (depends on 2) The method according to claim 2 comprising determining an event generator type of the first event stream, wherein the effect is provided to the client if the event generator type of the first event stream is a non-human event generator type. ### Claim 4 (depends on 2) The method according to claim 2 wherein analyzing the first event stream comprises determining whether a rate of event messages from the client is greater than an allowable rate. ### Claim 5 (depends on 2) The method according to claim 2 wherein analyzing the first event stream comprises determining whether the client is generating events at a rate greater than an allowable rate. ### Claim 6 (depends on 1) The method according to claim 1 wherein providing the effect comprises changing an event sampling function that controls how events are sampled at the client. ### Claim 7 (depends on 6) The method according to claim 6 wherein changing the event sampling function comprises changing at least one of an event observer mask, a sampling interval, or a sampling area of a browser on the client. ### Claim 8 (depends on 6) The method according to claim 6 wherein determining a response to the effect comprises determining whether the client is honoring the change to the event sampling function. ### Claim 9 (depends on 1) The method according to claim 1 wherein the effect is substantially unnoticeable to a human operator at the client. ### Claim 10 (depends on 9) The method according to claim 9 wherein the effect comprises at least one of a mouse pointer shift, a freeze of a mouse pointer, a change of a viewport size, a cursor shift, or addition of a new frame to shift a current viewport. ### Claim 11 (depends on 1) The method according to claim 1 wherein the effect comprises a nontransparent effect that invokes an effect at the client that is noticeable to a human operator at the client. ### Claim 12 (depends on 11) The method according to claim 11 wherein the nontransparent effect comprises at least one of a mouse pointer shift, a freeze of a mouse pointer, a change of the viewport size, a cursor shift, or addition of a new frame to shift a current viewport. ### Claim 13 (depends on 1) The method according to claim 1 wherein determining a response to the effect comprises determining whether an event stream generated in response to the effect is human dependent. ### Claim 14 (depends on 13) The method according to claim 13 comprising terminating the interaction if the event stream generated in response to the effect is not human dependent. ### Claim 15 A system for testing an interaction between a client and a web server, the system comprising: the client; the web server; an event module within the web server and configured to: invoke an effect in a web browser of the client to produce a change in event stream generation at the client, wherein the effect is a message sent from the web server; record the effect as well as any expected reactions to the event stream; process future events in the event stream to determine whether the expected reactions occurred within a timeout period; and analyze an event stream received from the client to determine whether a response to the effect is a human dependent response wherein the human dependent response is based on at least one of: whether an expected human-dependent reaction has occurred and if an expected human-dependent reaction has not occurred. ### Claim 16 (depends on 15) The system according to claim 15, wherein the event module is configured to analyze the event stream to determine whether the event stream comprises a series of events that correspond to an expected response to the invoked effect. ### Claim 17 (depends on 16) The system according to claim 16 further comprising a prerecorded dataset comprising event streams corresponding to the expected response to the invoked effect, wherein each event stream of the dataset comprises an associated known event generator type.