Mustafa Güngör

Posted on Sep 15

Building a 19D Kinematic Biometrics Engine for Bot Mitigation in FastAPI

#cybersecurity #fastapi #python #security

The Problem with Modern Bot Detection

Most web applications rely on standard rate-limiting (Leaky Bucket, Token Bucket) or invasive third-party CAPTCHA widgets.

However, modern automated scrapers and headless browser suites (Playwright, Selenium-Stealth, Undetected-Chromedriver) bypass IP-based rate limiters with cheap residential proxies. Meanwhile, forcing human users to click traffic lights or solve distorted puzzles degrades user experience and leaks privacy.

What if we could identify automation at the middleware layer using pure behavioral biometrics — without storing a single piece of Personally Identifiable Information (Zero-PII)?

Here is how I designed and built a 19-dimensional kinematic engine and cryptographic challenge protocol from scratch.

Architecture Overview: The 5 Defense Layers

Instead of treating incoming HTTP requests as isolated JSON payloads, the engine processes telemetry through a multi-tiered pipeline:

[ Incoming Request ]
         │
         ▼
[ Layer 1: Cryptographic Guard ]   ── HMAC-SHA256 Challenge & Single-Use Nonce
         │
         ▼
[ Layer 2: Anti-Stealth Scanner ]  ── Prototype Unhooking & Runtime Checks
         │
         ▼
[ Layer 3: 19D Kinematics Engine ] ── Jerk Analysis & Fitts's Law Profiling
         │
         ▼
[ Layer 4: Micro-Brain (1D-CNN) ]  ── 60-Step Sequence Pattern Detection
         │
         ▼
[ Layer 5: Network Anomaly Guard ] ── Sliding-Window Poisson & IP Quarantine

1. Kinematics: Why Bots Fail at Third-Order Derivatives

Most bot scripts simulate mouse movements using linear interpolation, Bézier curves, or basic Gaussian jitter. While a Bézier curve looks smooth to the naked eye, its physical properties immediately expose it.

Neuro-Muscular Tremor & Jerk Analysis

Human motor control is naturally imperfect due to neuromuscular lag. When a human moves a cursor:

Position: x(t)
Velocity: v(t) = dx/dt
Acceleration: a(t) = d²x/dt²
Jerk: j(t) = d³x/dt³

Automated scripts trying to minimize jerk (such as Flash & Hogan models) or applying naive random noise generate unnatural velocity spikes or mathematically flat jerk profiles.

In our telemetry extractor, we compute discrete third derivatives over microsecond-stamped coordinates:

import numpy as np

def calculate_jerk_profile(timestamps: np.ndarray, x: np.ndarray, y: np.ndarray):
    dt = np.diff(timestamps)
    # Prevent zero-division on microsecond clamping
    dt = np.where(dt <= 0, 1e-6, dt)

    # Velocities
    vx = np.diff(x) / dt
    vy = np.diff(y) / dt

    # Accelerations
    dt_mid = 0.5 * (dt[:-1] + dt[1:])
    ax = np.diff(vx) / dt_mid
    ay = np.diff(vy) / dt_mid
    a = np.hypot(ax, ay)

    # Jerk (Third derivative)
    dt_jerk = dt_mid[:-1]
    jerk = np.diff(a) / dt_jerk

    return float(np.var(jerk)), float(np.mean(np.abs(jerk)))

Terminal Deceleration (Fitts's Law)

When humans move a pointer to click a target, the final 20–25% of the trajectory exhibits progressive deceleration to stabilize target acquisition.

Bots typically maintain constant velocity until the exact click coordinate or snap abruptly. By calculating velocity ratios in the terminal phase, robotic trajectories are separated with high statistical confidence.

2. Zero-PII Cryptographic Defense

Client-side behavioral collectors are worthless if an attacker can simply capture a real human session and replay the payload.

To guarantee zero data storage while maintaining atomic replay resistance:

The server issues a timestamped, HMAC-SHA256 signed token containing a high-entropy random nonce.
The client telemetry payload is signed alongside this nonce.
The middleware verifies that elapsed time exceeds a physiological human threshold (t_elapsed > 1500 ms).
The nonce is consumed atomically via distributed cache (Redis SET key 1 EX 120 NX or local SQLite WAL transactions).
Any subsequent request reusing the same token is rejected with HTTP 403 instantly.

3. Fast In-Process Inference Without Bloat

A security middleware cannot afford 100ms inference latencies. Standard PyTorch or TensorFlow runtimes introduce heavy memory footprints and cold-start penalties.

Instead:

The 1D-CNN sequence classifier was trained offline on trajectory vectors.
Model weights were exported directly to compressed NumPy arrays (.npz).
The forward pass is executed in pure NumPy using vector operations, completing inference in under 2 milliseconds inside the ASGI event loop.

Key Takeaways

Physical laws beat statistical obfuscation: Advanced stealth tools can fake navigator.webdriver, but mimicking human neuromuscular jerk across time derivatives without massive latency overhead is computationally expensive for scrapers.
Stateless cryptography reduces attack surfaces: You don't need user cookies or session tables to verify authenticity.
Keep middleware lean: Pre-compiled arrays and pure matrix operations beat bloated ML runtime dependencies every single time.

What challenges have you faced when dealing with modern automated traffic? Let's discuss in the comments below!

DEV Community