Behavioral analysis: what it is and how automation specialists can bypass it

Not long ago, anti-fraud systems mostly relied on technical signals such as IP addresses, cookies, and browser fingerprints. As scripts and scrapers became better at spoofing these attributes, security systems started paying much more attention to how users actually interact with websites.

Behavioral biometrics focuses on the way a person interacts with an interface — from mouse movements and scrolling to typing patterns. Today, it is becoming an increasingly important part of detecting automated activity.

In this article, we’ll look at how behavioral analysis works and what makes automated interactions appear more human-like.

Why CAPTCHAs are giving way to behavioral analysis

In the past, CAPTCHA was one of the main tools used to keep bots away. It is still widely used, but the technology has evolved considerably. Modern systems are more advanced, and some invisible solutions, such as reCAPTCHA v3, rely partly on the same behavioral signals discussed in this article.

Why is this necessary? Traditional CAPTCHAs (traffic lights and distorted characters) worsen the user experience and are increasingly being solved effortlessly by trained neural networks. The new approach, which works without visible elements, removes much of the burden from users and avoids annoying them.

Behavioral biometrics is an important part of this invisible verification process because it allows systems to continuously evaluate user activity. It looks at how a person interacts with a device while scrolling through a page, filling out a form, or performing other actions. All of this can happen without requiring any additional input from the user.

There is one important point to keep in mind. Behavioral biometrics is not used as the only method of verification. It works together with other checks. Anti-fraud systems can also evaluate digital fingerprints, IP reputation, cookies, and other signals to determine whether activity is legitimate or automated.

Types of behavioral biometrics

Let’s take a closer look at the theory. Behavioral patterns can be seen as a digital representation of how a person interacts with a device. Modern anti-fraud systems do not look at each parameter in isolation. Instead, they combine multiple signals to create a broader behavioral profile, which can be divided into the following categories:

Device interaction (kinesthetics)

This is the largest layer of data for the traditional web and mobile applications. Here, systems analyze the physics of user movements.

• Keyboard: it’s not about which letters or numbers you type. Anti-fraud systems evaluate two main parameters: how long a key is held down (dwell time) and how long it takes to move between keys (flight time). Humans have muscle memory — familiar key combinations (for example, common word endings) are typed in micro-bursts. Bots, meanwhile, either inject entire strings at once or imitate typing using simplistic time.sleep(random) logic. This creates a flat, unnatural delay distribution. Randomness itself becomes suspicious.

• Mouse: cursor analytics. The system records coordinates and calculates speed, acceleration, trajectory curvature, and jerks. Humans do not move a mouse in perfectly straight lines. We aim for a button, miss by a few pixels, make tiny corrective movements, and briefly pause before clicking.

• Touchscreen: specific for mobile web and native applications. A human swipe is an arc with uneven speed, specific pressure (if the API allows pressure detection), and a changing finger contact area. Bots that emulate touch events through Appium or JavaScript scripts often simply “teleport” focus coordinates. Writing the proper math for a realistic swipe is more difficult, so bot operators often cut corners.

Physical patterns (biomechanics)

When someone accesses a platform from a mobile device, its hardware sensors provide additional signals. This is especially relevant today because a large share of web traffic comes from mobile users.

Walking patterns and micromovements. Are they browsing while walking, sitting at a desk, or relaxing on a couch? The smartphone’s accelerometer and gyroscope can detect small changes in how the device moves. A real phone rarely stays completely still in someone’s hands, even when the person is trying to keep it steady. Server based bot farms and emulators often lack this natural sensor noise, which can give anti-fraud systems another reason to assign a higher risk score.

Cognitive patterns (interaction psychology)

This is where systems focus on how users behave while interacting with an interface.

Navigation and decision-making speed. How long does it take a user to find the right button? Do they read the text before selecting a checkbox? Real users often move the cursor around text as they read, pause when dealing with a complex form, or even select parts of the text. A scraper script behaves differently. It already knows the DOM structure and can trigger the required event after a fixed delay without going through the visual search and decision-making process.

Together, these three levels create a detailed behavioral profile. Simply adding random delays to Selenium or Puppeteer scripts is not enough to reproduce this kind of behavior reliably.

Data collection and preprocessing

The primary sources for collecting biometric data are mousemove, keydown, keyup, touchstart, and touchend events, as well as the DeviceOrientation API for capturing accelerometer and gyroscope readings.

The most difficult part at this stage is handling the enormous volume of fragmented and asynchronous data. A single mousemove event alone can fire hundreds of times per second. If every cursor movement triggered backend processing or heavy computations directly on the client side, the anti-fraud system would instantly freeze the UI and cause noticeable lag on the client’s website. No business would accept that.

That is why client-side collection scripts are designed to be as lightweight and primitive as possible. Their only task is to quickly capture coordinates, attach precise timestamps, store everything in a local buffer, and send the data to the server in a batch.

These batches of JSON objects are then transmitted to the backend. In high-load systems, they are not written directly into databases or immediately passed to ML models. First, they are routed through message brokers such as Kafka or RabbitMQ. This is necessary to smooth out traffic spikes, for example, during large-scale bot attacks or natural surges of real users during sales or promotions. At this point, the client-side responsibility ends.

Feature engineering and ML models

So, the raw batches have reached the server. What happens next?

If you send this array of pixels directly to an ML model, it will not learn to tell humans from bots. Instead, it will mostly memorize the location of buttons and other elements on a particular website. A small change in the layout could then make the model ineffective. What machine learning needs is not information about screen layout, but more general behavioral patterns.

This is where the feature engineering layer comes in. It sits between the message queue and the ML models and prepares raw logs for further analysis. These pipelines are often built with Pandas and NumPy. They combine the collected data and convert it into features that machine learning models can process. Typical calculations include:

• Euclidean distances between points;
• time intervals between events;
• instantaneous movement speed;
• turning angles along a trajectory.

These calculations are then used to create a more detailed behavioral profile:

• Keyboard: delay vectors such as dwell time and flight time, together with their median, variance, and standard deviation. This shows how consistent the user's typing rhythm is.
• Mouse: speed and acceleration statistics, the number of short pauses, and the spectral entropy of the trajectory. This helps describe whether the movement looks more irregular or follows a highly predictable pattern.
• Touchscreen: changes in pressure and contact area during a swipe, when this information is available through the browser or operating system API.
• Cognitive features: idle time and the delays before focusing on specific elements. For example, a user may pause before clicking the “Pay” button while checking the amount.

A single session can produce hundreds of these parameters. They are extracted without relying on the specific page layout and then passed to the ML models for further analysis.

Classical ML algorithms (Random Forest, SVM, Gradient Boosting)

These models work especially well with aggregated statistical features. They are fast, require relatively few server resources, and are often used as the first layer of detection.

The full set of session statistics, including action speed, timing variance, entropy, and other parameters, is passed through a trained model. This allows the system to quickly filter out obvious anomalies, such as no variation in cursor acceleration or unusually consistent intervals between clicks.

Neural networks (LSTM, GRU, and 1D-CNN)

While classical algorithms mainly focus on the overall statistics of a session, neural networks can work directly with sequences of cursor movements over time.

Recurrent networks are well suited to sequential data where the current element can depend on what happened before it. Their ability to retain context allows them to consider previous user actions and identify unusual patterns or rhythms that may disappear when the data is reduced to simple averages.

Autoencoders and anomaly detection

One of the main challenges for anti-fraud systems is that bot developers are constantly coming up with new ways to bypass detection. It is impossible to train a separate model for every possible type of automation. At the same time, systems have access to huge amounts of data describing how real users behave. This makes unsupervised learning, particularly autoencoders, useful for detecting unusual sessions.

An autoencoder is trained primarily on data from real users. It takes session parameters as input, compresses them into a smaller representation, and then tries to reconstruct the original data.

Because the model has mainly learned normal human behavior, it can reconstruct similar sessions relatively accurately. When it receives an unfamiliar automated pattern, the reconstruction may become less accurate.

The difference between the original data and the reconstructed output is known as the reconstruction error. A larger error indicates that the observed behavior differs more significantly from the patterns learned by the model and can therefore contribute to a higher risk score.

Single checks vs. hybrid systems

Using just one detection method is not enough, which is why modern anti-fraud systems typically combine several models. A common approach is a cascading architecture. Lightweight ML models quickly eliminate obvious automation, while more resource-intensive neural networks are used for sessions that cannot be classified confidently during the first stage.

This approach helps improve detection accuracy while keeping computational costs under control.

Feature drift and adaptation

Human behavior can change over time, and the same is true for a device’s digital fingerprint. A user might replace their mouse with a model that has different DPI settings, switch from a desktop to a laptop with a touchpad, hurt their hand, drink a couple of espressos, or simply get tired toward the end of the day. Each of these factors can affect typing patterns, fine motor movements, and reaction times.

If an anti-fraud model remains static and relies on a reference profile created years ago, it will eventually start flagging legitimate users. False positive rates will increase, conversion rates may decline, and businesses can lose both revenue and customer trust.

For this reason, anti-fraud systems need to evolve with users and account for changes in their behavior and environment.

Real-time neural network training

Traditional batch training involves retraining a model periodically using a large accumulated dataset. Online learning takes a different approach by allowing the model to update its parameters continuously. When a legitimate session is confirmed, for example through a completed purchase or successful 2FA verification, its data can be used to gradually update the model. This helps the system adapt to long-term changes in user behavior.

Sliding memory window

Another approach is the sliding memory window. New session data is continuously added to the behavioral profile and given more weight than older records. Over time, older sessions have less influence on the model until they become almost irrelevant. This means the system compares current activity with the user’s recent behavior rather than relying on a profile that was created when the account was first registered.

Statistical monitoring

But how does the system distinguish between a legitimate change, such as buying a new mouse, and a sudden session spoofing by a sophisticated bot? For this purpose, strict statistical monitoring is applied, including:

• Principal Component Analysis (PCA). This method projects dozens of features into a 2D or 3D space and tracks cluster drift. If fresh sessions suddenly deviate from the user’s historical behavioral core, the system detects the drift.

• Statistical tests (such as the Kolmogorov–Smirnov test). The algorithm continuously compares the distribution of new data against the reference distribution. If divergence between the two samples is detected, the system temporarily lowers trust in the profile. At this stage, the user is not banned but instead prompted to complete a CAPTCHA. If the verification is passed successfully, the model interprets the deviation as legitimate—for example, a switch to a new device—and updates the reference profile accordingly.

Human behavior emulation

Now that we have a basic understanding of how anti-fraud systems work, let’s look at how automated systems can be designed to produce more human-like behavior.

Simply smoothing cursor movements with Bézier curves or adding time.sleep() delays is no longer enough. Modern ML models can pick up on automated patterns very quickly. A more realistic emulator needs to account for factors related to human physiology and biomechanics.

Jitter injection

If you instruct a script to make random pauses lasting 80 to 120 milliseconds, it will generate 80 ms, 120 ms, and 95 ms delays with roughly the same frequency.

Humans do not type like that. We each have a natural, comfortable rhythm that we fall into most of the time. Occasionally, our fingers speed up or slow down slightly. That is why delays should be generated according to a Gaussian distribution (a bell curve). The overwhelming majority of a bot’s pauses should cluster around a single baseline speed, while only a few deviations should significantly differ in either direction.

Tremor emulation
Imagine trying to quickly click a tiny checkbox. You move the mouse abruptly, overshoot the target by a couple of pixels, notice the mistake, and pull the cursor back.

To imitate this effect and the natural shakiness of the human hand, developers blend mathematical functions (sine and cosine waves) into the ideal cursor trajectory. This creates realistic micro-noise capable of deceiving anti-fraud systems.

Macro-pauses
One of the most advanced and rarely implemented techniques is the introduction of macro-pauses that imitate physiological cycles. Humans do not work continuously at a computer. We blink, temporarily losing visual contact with the screen, breathe in and out, glance down at the keyboard, or get distracted by our phones.

An emulator must therefore include a “loss of focus” logic—periodic artificial delays of 1–3 seconds before important actions, breaking the machine-like monotony.

Behavior copying

Why build complex mathematical models to reproduce natural scrolling, deceleration, and small movements from scratch when you can work with real human interaction data instead? This approach is known as blending and takes behavioral emulation a step further.

Advanced bot developers can build their own datasets or use existing ones. These datasets contain recordings of real user sessions, including how people scroll through feeds, move the cursor while reading, or make small unconscious mouse movements while thinking. The data can be stored as sequences of movement vectors combined with timing information.

When a script based on this approach needs to scroll a page or move the cursor toward a complex form, it does not necessarily rely on simple commands such as window.scrollBy() or predefined Bézier curves. Instead, it can select a suitable segment from a database of recorded interactions. The trajectory is then adjusted to match the current browser coordinates. The movement is transformed so that the cursor reaches the required element, after which the automated process continues with the intended action.

From the perspective of an anti-fraud model, these movements can look much closer to genuine human activity because they are based on real interaction data. Natural variations, small movements, and timing patterns are already present in the original recordings.

What’s the catch? Scaling this approach requires a large and diverse collection of behavioral data. Reusing the same interaction fragments across many profiles can make the pattern easier to identify. If identical sequences appear repeatedly, server-side systems may recognize them as replayed behavior and use that signal to flag the associated sessions.

The vulnerability of loops

However much you randomize timings and shake the cursor, every bot suffers from one congenital weakness: it lives inside a programmatic loop (while or for).

Protection systems take your script’s timings and run them through spectral analysis (Fourier transform). This filters out the artificial random noise and reveals the hidden carrier frequency of the loop. Humans are naturally arrhythmic; bots are not.

Can you defeat Fourier analysis and convince the server that your script is a living human with no detectable base frequency? Yes, but doing so requires rewriting the entire architecture of your scraper. A simple Math.random() is nowhere near enough for this.

1. Abandoning loops in favor of State Machines. Do not use linear while or for loops combined with nested sleep() calls. Your bot should function as a finite-state machine driven by events. It should have multiple states, e.g., reading, hesitation or idling, movement, clicking. Transitions between these states should not be rigidly hardcoded but determined probabilistically. Only then will the overall rhythm of the session become unpredictable, like a human who may suddenly change their mind before clicking a button.
2. The mathematics of “heavy tails.” Forget uniform randomness or even Gaussian distributions. Most of your pauses should be short and tightly clustered, but the bot should occasionally stop for an abnormally long time with a certain probability. These rare but extreme outliers are precisely what disrupt Fourier frequency analysis, smearing the spectrum and hiding the machine rhythm.
3. Using OS entropy. The built-in pseudorandom number generators in JavaScript or Python have predictable patterns of their own. Instead, you can draw true entropy directly from the operating system, which gathers chaotic hardware noise, from CPU temperature fluctuations to network interrupts.

Conclusion: the economics of scraping and the endless game

Behavioral biometrics has not become a universal solution for stopping bots. However, it has changed both the rules of the game and the cost of building sophisticated automation.

In the past, creating a scraper often required little more than a pool of proxies and a basic understanding of browser headers. Today, more advanced automation can require knowledge that goes beyond traditional web development and touches areas such as biomechanics and signal processing. This is mainly relevant to sophisticated projects, rather than simple tasks like scraping images from Google Maps.

The competition between anti-fraud systems and bot developers is still ongoing, but the focus has shifted toward reproducing aspects of human behavior. Anti-fraud systems will continue to develop more advanced ways of identifying automated activity, while automation tools will continue trying to make their interactions look increasingly natural.

If you want to try an anti-detect browser for your automation tasks, sign up on our website and use promo code DEVTO to get 4 days of Starter subscription for free.