Security vendor ferrets out who's a human and who's a bot

Pramana analyzes interactions with Web applications in order to stop spam and click fraud

An Atlanta security company has come up with a technology it says can block automated programs responsible for perpetuating nuisances such as spam, fake e-mail registrations and click fraud.

The software, HumanPresent, essentially ferrets out, for example, whether a human is filling out a Web-based form and stopping those actions that appear to come from automated programs, said Sanjay Sehgal, CEO of Pramana.

Next month, Pramana expects to fully launch both a SaaS (software-as-a-service) offering and an appliance that monitor Web applications for intrusions by bots, Sehgal said.

Pramana's software can be applied to Web-based forms, whether they be e-mail registrations, e-commerce transactions or detecting click fraud related to banner advertising.

Sehgal is cautious about revealing how HumanPresent tells the difference between machines and people for fear that spammers will be able to create bots that act more like humans.

Pramana uses 32 metrics in its analysis to see if a Web page has been approached by a bot. Aspects that are analyzed include keyboard strokes and mouse clicks and the timing of those actions, Sehgal said.

For example, if a human clicks on a link on a Web page and nothing happens, the typical human reaction is to click the link again. Bots won't do that, Sehgal said.

Pramana can also be applied to click fraud scenarios, where bots are programmed to open up a Web page hundreds of times in order to click on the banner ads and potentially increase ad rates.

Sehgal was coy on exactly how it works, but a bot interacts with the page and an advertisement different than a human would. If Pramana detects that a bot is clicking on ads, a dummy ad can be substituted instead to avoid having tainted statistics.

For the SaaS offering, Pramana's technology is integrated into a Web application. When someone tries to do a log-in, for example, some of that session information is sent back to Pramana for nearly instant analysis. If Pramana detects a bot, the Web site could then opt to ask the person to go through some other verification step.

Pramana is one alternative to CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), the box of squiggly characters a person must enter in order to prove they're human. Previously, it was hard for computers to solve CAPTCHAs, but that has changed in recent years. Also, it's believe that scammers in some instances have employed real people to solve CAPTCHAs.

Pramana's software is being actively used by a few businesses. ZCorum, which provides back-end services for small- to medium-size service providers and other ISPs, is one customer. Like other e-mail service providers, hackers targeted the Alpharetta, Georgia, company's webmail services.

Those hackers would obtain a customer's log-in credentials for an e-mail account and then relay spam through it, said Scott Helms, vice president of technology for ZCorum.

It used to be easy to detect the spam runs. A spammer would flood thousands of messages through one account, which would trigger alarms. But in recent years, spammers tended to have their bots abuse 10 or 20 accounts but send fewer messages per hour, which made them much harder to detect, Helms said.

"It's definitely a struggle for service providers of all sizes," Helms said.

ZCorum had been using the reCAPTCHA system from Carnegie Mellon University, but the puzzles frustrated end users. "The biggest thing that we really wanted was just to find a good way of protecting our systems and at the same time making the end-user experience a positive one," Helms said.

Three of ZCorum's 200 or so ISP customers are now using Pramana and are pleased with the results, Helms said. When a customer logs into webmail, that session information is sent to Pramana for analysis using a bit of JavaScript integrated into the webmail service. Also, some session information from the e-mail composition window is sent for analysis but not any content from the e-mail.

When humans write e-mails, they make spelling mistakes, do back spaces and are pretty random. Bots, on the other hand, are methodic, which can give them away.

False positives -- where Pramana mistakenly detects a bot -- are less than a tenth of 1 percent, Helms said. Even if people are labeled a bot rather than human, the ISP can configure the system to ask a verification question that a bot wouldn't be able to handle, and users can continue their transaction, Helm said.

"I feel pretty good we are on the leading edge of solving this problem," Helms said. "I do think this [Pramana] will become a de facto standard for most ISPs."

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags botssecurity

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?