Detection of client-side malware activity

A computer-implemented method, comprising:

• providing, for use by a third-party, injectable computer code that is capable of being served with other code provided by the third-party to client computing devices;
• receiving data from client computing devices that have been served the code by the third-party, the data including data that characterizes (a) the client computing devices and (b) user interaction with the client computing devices;
• classifying the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices;
• providing to the third-party one or more reports that characterize an overall level of automated software activity among client computing devices that have been served code by the third-party, wherein
• a first subset of the received data is provided by client computing devices that have been served original code from the third-party;
• and
• a second subset of the received data is provided by client computing devices that have been served code from the third-party that has been obfuscated by altering original code from the third in a different manner for each serving of the original code from the third-party, the altering in a different manner for each serving interfering with an ability of malware to identify a manner in which the code from the third-party operates.

A computer-implemented system, comprising:

• a first computer system operated for a security service organization and storing copies of injectable code for provision to content serving organizations that do not operate the first computer system;
• one or more second computer systems comprising web server systems operated by the content serving organization and programmed to serve the injectable code with code produced by respective ones of the one or more content serving organizations;
• an activity analyzer sub-system executed by one or more servers that are operated in coordination with the first computer system, and arranged to receive activity data from injectable code served by the one or more second computer systems and to analyze the activity data to determine whether particular ones of clients executing the injectable code are operated by humans or by computer bots;
• and
• a report generator associated with the first computer system, operated by the security service organization, and arranged to generate electronic reports for provision to the third-parties indicating levels of bot activity in clients served by respective ones of the third-parties, wherein the reports are generated using data aggregated across multiple clients to show a level of bot activity in an aggregated group of the clients.

One or more tangible, non-transient computer-readable devices having stored thereon instructions, that when executed by one or more processors, perform actions comprising:

• providing, for use by a content serving organization that operates one or more web servers, injectable computer code of a security service organization that is separate from the content serving organization, wherein the provided injectable code is capable of being served with other code provided by the content serving organization to client computing devices;
• receiving, by the security service organization and from client computing devices that have been served the code by the one or more web servers of the content serving organization, data that characterizes (a) the client computing devices and (b) user interaction with the client computing devices;
• classifying, by the security service organization, the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices;
• and
• providing to the content serving organization one or more reports that characterize an overall level of automated software activity among client computing devices that have been served code by the content serving organization.