How to detect random clicks on a page?

Question

I have been tasked with detecting if a bot is clicking randomly around a web page. I was thinking of splitting up the web page into 20 by 20 pixel squares, and then assigning each click to a square from the x and y coordinates of the click. I can then take a sample of clicks, and use Chi-Square to determine if the click sample is from the the random distribution or the human distribution. What do you guys think? Is there a more clever way to do this for clicks?

Answer 1

I presume your intent is to identify the agent as human or random by choosing the one with the smaller chi-square (assuming you can get an expected human pattern), essentially treating it as a classification problem. If you are treating it as one, you might want to consider the costs of the two types of misclassification error.

Your approach might be sufficient (if you can get data for the human case), but I have some comments:

1) the same size of clicks is unlikely to be high enough to pick anything up with a chi-square especially on a 20x20; it would suggest you would need something well over 500 clicks, probably more like a couple of thousand. That's a lot of clicks.

2) if you instead want instead to treat it as a hypothesis testing problem then you'd need to either

a) only identify the agent as human if the behavior is inconsistent with random clicking. The problem with this is that it by default says you're a bot ... which if there's only a few clicks may classify a lot of humans as bots.

b) only act as if they aren't human when the clicking behavior is inconsistent with human behavior even when the match with random clicking is better, then you'd just check for consistency with a previously known human pattern --- the problem is different humans may exhibit different patterns

Again, if this is done with a chi-square, sample size may be a problem.

3) there's information in a sequence of clicks that may help to pin down non-randomness much better. That is, I suggest you consider instead the serial-dependence in human clicks compared to random clicking.

4) Perhaps even easier, you might consider the distribution of the average distance between consecutive clicks, compared to random clicking, or the distribution of time between clicks (e.g. a bot may click fast, or a bot may well have time between clicks unrelated to distance, where a human has to move a mouse-cursor from place to place, so may have distinctive relationship between time and distance). This is likely to show up an issue at relatively smaller sample sizes.

[It may also be that humans and robots have very different numbers of clicks. That might be useful]

5) If you do get data on humans, you might consider trying to identify some tell-tale characteristics, then use those to construct a good test statistic to apply to the random-case (i.e. something that rarely happens in random data but often happens in the human data).

6) if you do want the classification route, and you have a substantial amount of human data, it may help to do some sample splitting to use some of the data to try to identify some suitable characteristics that would better distinguish the two than the chi-square approach.

7) You may want to consider a Bayesian approach.