US20100287132A1

US20100287132A1 - System, method and computer readable medium for recording authoring events with web page content

Info

Publication number: US20100287132A1
Application number: US12/435,758
Authority: US
Inventors: Robert R. Hauser
Original assignee: Suboti LLC
Current assignee: Oracle America Inc
Priority date: 2009-05-05
Filing date: 2009-05-05
Publication date: 2010-11-11
Also published as: US9336191B2; US20120047426A1; US9524284B2

Abstract

A web page that includes content form fields may be modified to include an event observer module and an authored content module. The authored content module adds a hidden “events observed” field to the form fields. Events generated during the authoring of content by a user are recorded by the event observer module. When the content is submitted from a client browser to the web server, the events generated during the authoring of the content are added to the events observed field and submitted with the content. The web server uses the events to determine a DOM of the web page and compare the observed DOM with a stored DOM for that web page and that particular interaction. The page structure may be optionally modified by the web server to enhance the analysis of the DOM comparison. The web server analysis facilitates detection of non-human content submission at a client browser.

Description

FIELD OF THE INVENTION

This invention relates to a system, method and computer readable medium for providing and processing user content generated in web pages.

BACKGROUND OF THE INVENTION

In many web based applications, it may be necessary to verify that a human is using a computer, rather than an automated computer program, as one example. One well known solution for use with web based forms, is to use an application such as CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart). A CAPTCHA is a type of challenge-response test presented on screen to determine if the user is a human. A problem with using CAPTCHAs is that they can be automatically solved by computer algorithms. Further, humans can be used to solve CAPTCHAs the first time, with the response being recorded with the original challenge so if the same challenge is reused later a computer program can respond without assistance from a human. CAPTCHAs can be annoying to users and can typically only be used at predetermined locations within an application (e.g. a web form during user logon).
An alternative solution, often used in video games is to insert random events. Random events interrupt some otherwise predictable order of events by presenting new activities to the player/user. These are usually used to discourage players from using automated means to artificially gain experience within a gaming environment. Random events are annoying to users/players unless well crafted within the web page/game. Random events do not occur at predetermined locations but may require ongoing background analysis to estimate when a user/player may be using automated means of control.
An alternative system and method for determining whether web page interactions are human or non-human is described in the Applicant's co-pending application Attorney Docket No. Hauser001, the contents of which are herein incorporated by cross reference. In the Applicant's solution, event streams generated at the client device are analyzed by a server, such as the web server or a classification server, in order to determine whether the event streams that have been generated match known human or non-human derived event streams. As event stream processing becomes more and more commonplace, it is inevitable that computer programs will be created that attempt to generate human-like event streams.
What is required is a system, method and computer readable medium for recording entry of content into a web page that facilitates detection of a non-human presence at a client browser.

SUMMARY OF THE INVENTION

In one aspect of the disclosure, there is provided a method for recording web page content into a web page comprising at least one user entry element. The method comprises receiving content into the at least one user entry element, recording one or more events that occurred during entry of the content, and submitting the content and the one or more events to a web server.
In one aspect of the disclosure, there is provided a web server configured to:
generate a web page and provide the web page to a client browser. The web page comprises at least one user entry element, an event observer module that records events generated when content is added to the at least one user entry element, and an authored content module that writes the recorded events into a hidden events field associated with the at least one user entry element.
In one aspect of the disclosure, there is provided a computer-readable medium comprising computer-executable instructions for execution by a processor, that, when executed, cause the processor to receive a content submission from a web browser comprising content of a user entry element of a web page, and one or more events generated in the web browser during authoring of the content. The processor is further caused to determine a document object model of the web page from the events, and compare the determined document object model with a stored document object model for the web page.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will now be described, by way of example only, with reference to specific embodiments and to the accompanying drawings in which :

FIG. 1 illustrates a system for providing a web page and recording web page content;

FIG. 2 illustrates a method for modifying a web page structure;

FIG. 3 illustrates a method for recording web page content;

FIG. 4 illustrates a process of an authored content module;

FIG. 5 illustrates a method for processing a content submission;

FIG. 6 illustrates a processor and memory of an web server;

FIG. 7 illustrates an instruction set that may be executed on the processor and memory of FIG. 6; and

FIG. 8 illustrates the processor and memory of FIG. 9 in association with a processor and memory of a client browser.

DETAILED DESCRIPTION OF THE INVENTION

In the Applicant's co-pending patent application Attorney Docket No. HAUSER007, the contents of which are incorporated herein by reference, there was described a system for binding authored content from a web page with the events that were generated during the creation of the authored content. In that system, an authored content module was provided within a web page and used to modify form fields and similar user entry elements of a web page to include hidden data fields. An event observer module recorded the events such as mouse clicks, mouse moves, key strokes etc that were generated when a user entered content to the form fields. When the content was submitted from a client browser to a web server, the authored content module updated the hidden field with an interaction identifier provided by the event observer module. The authored content and the event stream were thus commonly identified by the interaction identifier, enabling the authored content and the event stream to be later associated, such as at the web server or some offsite server.
A system 10 in accordance with the present disclosure is illustrated in FIG. 1. In the system 10, a client 18 provides web page requests 13 to a web server 14, in response to which, the web server 14 provides page content 11 for display in a browser 15 of the client 18. Typically, the web page 11 will include visible content and may include code 27 for content submission to the web server 14 via user entry elements such as an HTML form element. Many alternative user entry elements and content submissions methods will be known to a person skilled in the art. For example, AJAX methods may be used in place of the form elements. However, the specific content submission technique is considered irrelevant for the purposes of the present disclosure and all appropriate user entry elements and content submission methods are considered to be equivalent and are intended to be encompassed herein.
The web server 14 may include a page repository 17 from which the web server 14 retrieves page content for generating the web pages 11 in response to page requests from the client 18. In one embodiment, the page that the web server 14 gets from the page repository 25, which may be a simple file system or a more complex repository, may optionally undergo a structural change by a page modification module 21, The page modification module 12 may insert or delete elements to change the structure of the page without changing the behavior and without changing, or minimally changing, the viewport rendering of the page. In one embodiment, the structural change may simply be an insertion of attributes to existing elements, which does not actually change the Document Object Model (DOM) structure.
A process 100 for page modification by the page modification module 21 will be described with reference to FIG. 2. At step 101, the web server 14, having received a page request from the client 18, determines whether page modification is active. In one embodiment, the web page may be altered on each delivery instance in order to prevent replay attacks (e.g. replaying a previously recorded human generated event stream). If active, the web server 14 then determines whether the page structure is to be altered (step 102), in which case, the web server retrieves the page from the page repository 25 and inserts, or possibly deletes, one or more page elements (step 103). One example of a page structure change would add an extra element. If the original web page had the following elements, <span id=“span1”> <input name=“field1” id=“field1”/> </span>, then a modified page may have inserted a <div>element as follows, <div id=“div8328”> <span id=“span1”> <input name=“field1” id=“field1”/> </span> </div>. If the original page has been constructed with extra <div>, <span>, or other elements then another suitable page structure change would remove one of the extra elements. The page elements are typically added in a way that does not significantly alter the display of the web page, and are provided non-reversibly, e.g. randomly, for this particular page request. At step 104, unique value attributes are inserted into the page elements, e.g. the attribute id=“div8328” in the example above. In one embodiment, the value attributes may be randomly generated or they may be derived from other available parameters. At step 105, the changes made to the page structure, including the values added, are captured and associated with an InteractionID for the particular page request. At step 106, the captured changes and data are provided to the Response Processing Module for storing in a locally accessible data store in association with the InteractionID.
As described in the Applicant's co-pending patent application Attorney Docket No. HAUSER007 referenced above, an authored content module 24 and event observer module 26 are generated as part of the web page 11. The event observer module 26 observes events generated in a user interaction with the web page 27 at the client 18. The event observer module 26 records events generated within the web browser 15, such as mouse clicks, mouse moves, text entries etc. However, in the present disclosure, the function of the event observer module is modified such that the event information is stored locally until all the information of the form is submitted to the web server 14.
The authored content module 24 processes the web page content and adds hidden form fields so that when user content is created, the events generated during the content creation can be associated with the content in a process to be described in greater detail below. In one embodiment, the authored content module 24 adds a hidden “events observed” field to each user entry element of the web page 27.
During an interaction with the web page 11, a user enters content where appropriate, such as in the HTML form elements described above. During content creation, various events are generated and recorded by the event observer module 26. Events may include mouse clicks, mouse moves, key strokes etc. At some stage during the user interaction, the client will submit content 29, e.g. via an HTML form element field, to the web server 14. When the content is submitted, the hidden form fields, such as the “events observed” field, may be dynamically updated with recorded events from the event observer module 26. Thus the content submission carries additional elements. The content submission process is illustrated in the flowchart 200 of FIG. 3. At step 201, the user enters content into the user entry elements, i.e. form fields, of the web page. During the entry of the content, one or more events are recorded by the event observer module (202). At step 203, the content and the events are submitted to the web server 14.
The operation of the authored content module 24 will now be described with reference to the flowchart 400 of FIG. 4. The authored content module 24 is provided within the web page content 11 in a manner that is invisible to the user. When a user interfaces with a web page 11, in a first step 401, the authored content module 24 determines whether authored content tracking is enabled for that web page. If enabled, the authored content module 24 then dynamically adds hidden input elements, such as “events observed” field to forms or other user content areas on the page (step 402) as will be described in greater detail below. The authored content module 24 then registers callback with the event observer module 26 (step 403). At this stage, the authored content module is set to awaiting callbacks (step 404). The event observer module 26 observes events generated in a user interaction with the web page 27 at the client 18. The event observer module 26 records events generated within the web browser 15, such as mouse clicks, mouse moves, text entries etc. When a user submits the content 29 to the web server 14, a callback to the authored content module 24 is triggered, (step 405). The authored content module 24 then updates the events observed component of each user entry field (step 406) prior to submission of the web page content 29 to the web server 14.
In accordance with an embodiment of the invention, the authored content module 24 can use the function below to add a hidden input field that will be updated dynamically. The example function discovers the form by id but forms can also be discovered by traversing the structure of the Document Object Model (DOM).


	function insertformtracker( ) {
	// Insert a hidden form element to send observed events
	// to the web-server.
	var x = document.getElementById(‘commentform’);
	if (!!x) {
	var y = document.createElement(‘input’);
	y.type = “hidden”;
	y.name = “EventsObserved”;
	// y.value will be updated live to be the events
	// seen by the event observer module during
	// content entry into this form
	y.value = “none”;
	x.appendChild(y);
	};
	};

For example, a web page may contain code for a page element “field1” as follows:


	<span id=“span1”>
	<input name=“field1” id=“field1”>
	</span>

The “insert form tracker” function locates form containing the “field1” field and registers the “EventsObserved” field as a hidden field. A user may enter “sometext” in field1. The content may be submitted to the web server as follows:
field1=sometext&EventsObserved=mousemove.span1.x.120.y.310
That is, the observed event data includes the event “mousemove.span1.x.120.y.310” which is submitted with the field1 content “sometext”. The field content and hidden field data are submitted to the web server 14 where they are associated with the Interaction ID described above.
In a further example, the web page containing the “field1” field described above may be modified by the process described with reference to FIG. 2. In such an example, the modification may be provided as follows:


	<div id= “div8328”>
	<span id=“span1”>
	<input name=“field1” id=“field1”>
	</span>
	</div>

Following the previous example, when the user enters the same “sometext” content into field 1, the content submission may appear as follows:
field1=sometext&EventsObserved=mousemove.span1.div8328.x120.y.310
That is, with event handlers registered for both span1 and div8328, and with the mousemove event (at x=120, y=310) seen by each event handler, each event handler will record an identifier for its DOM element into the data stream.
It can be seen that the content submission carries extra information added dynamically by the authored content module 24. The extra information includes the observed user interface events and the DOM element that each event was observed on (or some sample or subset of such). Because the events indicate the DOM element that each event was observed on, the events can be analyzed to infer the structure of the DOM. The page modification process described above allows the web server to alter the page structure by the creation of additional, usually non-visible, page elements and values. Page modification is useful in detecting malicious clients and preventing replay attacks. While a single mouse move event is shown, a person skilled in the art will readily understand that multiple events may be recorded and provided in the content submission. Additionally, an “events observed” field may be provided for each field in a form element. The data gathered in the “events observed” fields may be suitably encoded and, as mentioned, may be a sample or subset of the observed events. When down sampling of events is used, the function performing the down sampling may be generated uniquely per page request by the Page Modification Module.
In FIG. 5 there is shown a process undertaken by the response processing module 19 of the web server 14. At step 501, the content submission is received. At step 502, the interaction ID associated with the content submission is checked against the local data store. A matching Interaction ID indicates that the page content was altered by the page modification module 21 in the modification process described above with reference to FIG. 2. Thus, at step 503, the response processing module replaces the default page with an altered page matching the page modification module's 21 changes. The DOM structure may be partially or fully included in the data sent in the “EventsObserved” field. In the previous example, the structure of the DOM page near field1 is indicated in the data along with the UI event “mousemove” that was observed: field1=sometext&EventsObserved=mousemove.span1.div8328.x.120.y.310. The event handlers on the elements with ids “span1” and “div8328” added these attribute values into the EventsObserved field. The response processing module has a record of the page (as modified) and its DOM structure is compared (step 504) with the structure indicated by the data inserted during event capturing which arrived with the content submission. Any attribute values inserted during page modification can also be compared at this stage. In the example, “div8328” may include a random number, 8328, that was added by the page modification module for a particular interaction. A mismatch in the DOM structure and/or attribute values may be indicative of a non-human user at the client computer 18, such as an automated machine invoking an automated content submission perhaps using a previously recorded human web page interaction (a replay attack). For example, a malicious client may have replaced some or all of the web page content, thereby affecting either the DOM structure or the additional attribute values. Thus, the content submission may be ignored, tagged as spam or a content confirmation process 507 can be initiated. The content confirmation process may include providing a dynamic CAPTCHA to the client 18, as described in the Applicant's co-pending application Attorney Docket No. HAUSER006, the contents of which are explicitly incorporated herein by reference.
If the DOM structure comparison indicates a match, then event analysis may be optionally performed (step 506) to determine the likely event generator type, e.g. human, non-human etc. Further detail of event generator analysis is described in the Applicant's co-pending application Attorney Docket No. HAUSER001 referenced above. Alternatively or in addition, the events may be analyzed to correlate the number, timing and type of events with the actual content generated to determine if the content is most likely human generated, as described in the Applicant's co-pending application Attorney Docket No. HAUSER007 referenced above. If the event analysis indicates a likely non-human user, then the content confirmation process 507 may be initiated. Otherwise, if the content submission is shown to be most likely human generated, then further processing of the content submission may follow.
In one embodiment, further processing of the content submission may include binding of the content, e.g. “sometext”, to the underlying events involved in the generation of the content. The bind operation may be initiated from the web server 14 in response to the web server 14 receiving the content submission 29. In one embodiment, described in more detail in the Applicant's co-pending patent application Attorney Docket No. HAUSER007 referenced above, a bind code may be created as a one-way hash of the concatenation of the hash of the content and/or the hash of the events generated in creating the content. The bind code may be associated with the content by a content ID field, by the interaction ID, or by some other suitable identifier. The binding operation may occur within the web server 14 or may be provided by a third party server (not shown) in response to a bind request from the web server 14. The binding of the events to the content allows additional services, such as the determination of various work metrics to be performed, as described in greater detail in the Applicant's co-pending patent application Attorney Docket No. HAUSER007 referenced above.
In the above described embodiments, the page modification may be provided as a way to change the event stream signature. This provides resistance to automated attacks on providing fake (or automated) event stream data. In the present embodiments, the web server has control over the whole web page and, properly configured, it can change the structure of the web page, on each request if required.
The event observer module 26 and the authored content module 24 may be provided as code embedded in a web page 11 from the web server 14. Alternatively or in addition, the Event Observer Module 26 and the Authored Content Module 24 may be provided as a link back to the web server 14 or a third party server for the resource containing the code which the web browser will fetch as part of loading the web page.
In one embodiment, the web server 12 may include a processor 61 operatively associated with a memory 62 as shown in FIG. 6. The memory 62 may store instructions that are executable on the processor 61. In addition, the memory 62 may provide elements of the data store for the response processing module 19. An instruction set 600 that may be executed on the event server processor 61 is depicted in the flowchart of FIG. 7. Specifically, when executed, the instruction set 600 allows the processor to receive a content submission from the client browser 601. The content submission may include the content entered by the user and the events generated during the authoring of the content. The processor may then determine a DOM structure of the web page from the events that have been supplied 602 and compare the observed DOM structure with a stored DOM structure for the particular web page interaction, identified by the Interaction ID (step 603). The content submission may be received from a second processor, such as a processor 71 of the client browser shown in FIG. 8, that may also be operatively associated with a memory 72. The second processor 71 may provide the content submission through a suitable communications link 65.
Although embodiments of the present invention have been illustrated in the accompanied drawings and described in the foregoing description, it will be understood that the invention is not limited to the embodiments disclosed, but is capable of numerous rearrangements, modifications, and substitutions without departing from the spirit of the invention as set forth and defined by the following claims. For example, the capabilities of the invention can be performed fully and/or partially by one or more of the blocks, modules, processors or memories. Also, these capabilities may be performed in the current manner or in a distributed manner and on, or via, any device able to provide and/or receive information. Further, although depicted in a particular manner, various modules or blocks may be repositioned without departing from the scope of the current invention. Still further, although depicted in a particular manner, a greater or lesser number of modules and connections can be utilized with the present invention in order to accomplish the present invention, to provide additional known features to the present invention, and/or to make the present invention more efficient. Also, the information sent between various modules can be sent between the modules via at least one of a data network, the Internet, an Internet Protocol network, a wireless source, and a wired source and via plurality of protocols.

Claims

1. A method for recording web page content into a web page comprising at least one user entry element, the method comprising:

receiving content into the at least one user entry element;

recording one or more events that occurred during entry of the content; and

submitting the content and the one or more events to a web server.

2. The method according to claim 1 comprising associating at least one events field with the one or more user entry elements, wherein the one or more events are recorded into the at least one events field.

3. The method according to claim 2 comprising associating an events field with each user entry element.

4. The method according to claim 2 wherein the at least one events field comprises a hidden field.

5. The method according to claim 1 comprising receiving the content and the one or more events in the web server and associating the content and the one or more events with an interaction identifier.

6. The method according to claim 5 comprising determining an observed document object model for the web page from the events.

7. The method according to claim 6 comprising retrieving a stored document object model for the web page using the interaction identifier and comparing the stored document object with the observed document object model.

8. The method according to claim 7 wherein a mismatch between the observed document object model and the stored document object model is determined to indicate a non-human event generator.

9. The method according to claim 1 comprising generating the web page in the web server, generating the web page comprising:

generating visible web page content comprising the at least one user entry element for entry of the content;

providing an event observer module that records events generated during authoring of the content;

generating at least one hidden element in association with the at least one user entry element that receives the events from the event observer module; and

providing the web page from the web server to a web browser.

10. The method according to claim 9 comprising registering the hidden element with a content submission function such that the hidden element is updated with a current value of the events when content is submitted from the web browser to a web server.

11. The method according to claim 9 wherein generating the web page comprises:

retrieving web page data from a page repository;

modifying the page structure of the retrieved web page data;

generating the web page comprising a modified page structure; and

providing the web page to the web browser.

12. The method according to claim 11 wherein modifying the page structure comprises adding at least one page element.

13. The method according to claim 11 comprising assigning an attribute value to the at least one page element.

14. The method according to claim 11 comprising:

receiving the content and the one or more events in the web server;

determining an observed document object model for the modified page structure from the events;

retrieving a stored document object model for the modified page structure using the interaction identifier;

comparing the observed document object model with the stored document object model.

15. A web server configured to:

generate a web page comprising:

web page content comprising at least one user entry element;

an event observer module that records events generated when content is added to the at least one user entry element; and

an authored content module that writes the recorded events into a hidden events field associated with the at least one user entry element; and

provide the web page to a client browser.

16. The web server according to claim 15 comprising a response processing module configured to:

receive content from the client browser;

extract the events from the events field; and

determine an observed document object model from the events.

17. The web server according to claim 16 configured to compare an observed document object model with a stored document object model of the generated web page.

18. The web server according to claim 16 comprising a page modification module configured to:

modify a page structure of web page data;

generate the web page comprising a modified page structure;

store the modified page structure in association with an interaction identifier; and

provide the web page to the client browser.

19. The web server according to claim 18 wherein the response processing module is configured to compare an observed document object model with a stored document object model of the generated web page.

20. A computer-readable medium comprising computer-executable instructions for execution by a processor, that, when executed, cause the processor to:

receive a content submission from a web browser comprising:

content of a user entry element of a web page; and

one or more events generated in the web browser during authoring of the content;

determine a document object model of the web page from the events; and

compare the determined document object model with a stored document object model for the web page.