Can platforms still tell a machine from a person?

Enlarge

THREAT HUNTER · RESEARCH BRIEF

Can platforms still tell a machine from a person?

Behavioral differences between automated and human mobile operations

The concert ticket you cannot get, the drop that sells out in a second, even accounts that look like they are browsing, liking, and chatting — the operator is not always a person. To test this, the Threat Hunter research team ran 8 types of automation devices, with software scripts and real human input as controls, and collected more than 75,000 operation events. We compared them on 9 dimensions including pressure, contact area, speed, trajectory, and device motion.

8 automation devices · RMB 18.3–1,535 · 75,000+ events · 9 dimensions

threathunter.com · github.com/threathunterX/gesture-fingerprint

Three findings

This run produced three main conclusions:

01 Machines can already approach humans on some single metrics. A robotic arm can physically touch the screen and produce pressure, contact area, speed change, and curved paths. “Real touch” and “curved trajectory” are no longer proof of a human.

02 Different automation methods still leave different patterns. Software scripts are overly stable. HID and mouse lack real touch features. Physical sliders can show mechanical jitter. Robotic arms sit between classic scripts and humans on several dimensions.

03 Multidimensional combinations are more useful than any single rule. Contact area and swipe trajectory had the highest separation in this run; pressure-related metrics were also high-value. Trajectory, curvature, and device sensors work better as supporting evidence. A machine can imitate one feature. Replicating several linked human behaviors at once is much harder.

In the past, automation meant scripts, device farms, or auto-click tools on the phone. In this study we found another form: the software does not have to live on the phone, yet the operation still completes automatically.

01 Automation has moved from on-device scripts to external hardware

Traditional detection looks at the phone environment: root, accessibility abuse, virtual environments, obvious scripts. External hardware changes the problem.

The 8 devices purchased for this study cost RMB 18.3 to 1,535 and fall into three classes.

1. No real screen contact — HID, mouse clickers — inject click/swipe via input protocols. The phone responds; no finger is on the glass.

Enlarge

FIG. 1 Class 1 devices: HID and mouse clickers. Clicks and swipes are injected through input protocols; there is no real finger on the glass.

1. Real contact with the screen — capacitive clickers and mechanical sliders — repeat taps and swipes through capacitive tips or mechanics.

Enlarge

FIG. 2 Class 2 devices: capacitive clickers and mechanical sliders. Capacitive tips or mechanical structures make real contact with the screen and repeat taps and swipes.

1. See-the-screen-then-act — a robotic arm reads the page with a camera, locates targets with image recognition, then physically taps/swipes. Companion software included “AI chat recognition” that chooses the next action from page content, not fixed coordinates.

Enlarge

FIG. 3 Class 3 devices: a vision-guided robotic arm. A camera reads the page; a mechanical structure then makes real taps and swipes.

So root / VM / accessibility checks are not enough. A completely normal phone with real physical touch can still be a machine. The question moves from “is the device abnormal?” to “is the behavior itself real?”

02 These devices already cover high-frequency taps, continuous swipes, and dynamic-page actions

Different devices map to different business actions.

High-frequency tap: ticketing, limited drops, campaigns, benefit claiming. Automation can raise efficiency through fast, stable taps.

Continuous swipe / engagement: content inflation, auto-watch, like, favorite. Sliders and auto swipe-likers can repeat the motion without pause.

Dynamic pages: fixed-coordinate tools are limited; a vision-guided arm can read the screen and decide the next tap, including chat-like flows.

This study verifies what the devices can do. It does not claim every device is already used in every scenario above.

03 75,000+ events, 9 dimensions

3.1 Groups and conditions

This study split operations into three groups: human, software automation, and hardware automation.

Software automation includes code scripts, screen recording, and accessibility. Hardware automation includes HID, mouse clicker, capacitive clicker, physical slider, auto swipe-liker, and robotic arm.

Multiple rounds and scenes; desk-flat, stand, handheld, walking; tap, swipe, long-press, and combinations.

3.2 Collection

The Threat Hunter research team built a dedicated collector that logged touch coordinates, time, pressure, contact area, path points, speed, acceleration, and curvature, plus accelerometer and gyroscope, at about 10–20 ms.

More than 75,000 events. Nine focus dimensions: pressure intensity, pressure fluctuation, contact area, mean swipe speed, swipe-speed fluctuation, path redundancy, mean curvature, linear acceleration, gyroscope.

FIG. 4 Separating power and main findings

Note: + metrics depend on device sensors. All values are from the source study; no new statistics were added.

These nine metrics answer three questions:

01 Real contact? Was there real physical contact with the screen? Mainly contact area and pressure.

02 Human motion? Does the motion look like a human body? Speed, fluctuation, path, and curvature.

03 State match? Does the touch match the phone’s physical state? Linear acceleration and gyroscope.

04 Different methods leave different traces

4.1 Scripts are too stable

The standout trait of software scripts is that they are too stable. Some code scripts and screen-recording automation stay highly consistent in pressure, speed, and path. Humans accelerate–peak–decelerate; some scripts hold speed and pressure almost constant.

Enlarge

FIG. 5 Swipe-speed curves: human vs. software scripts. Humans show accelerate–peak–decelerate; some scripts and clickers stay near a constant-speed line.

4.2 HID and mouse inject events but lack real touch

Contact area is an important way to separate some external input devices.

A human finger forms a real contact patch, and the area changes with force, angle, and motion. In this run, humans had the largest, widest contact-area distribution; arms, capacitive clickers, and sliders also have contact, but more concentrated.

HID and mouse clickers do not make real screen contact. Measured contact area = 0.

Enlarge

FIG. 6 Press-force distribution. This figure is pressure, not contact area. Contact area is FIG. 8.

4.3 Robotic arms can approach humans on some single metrics

The robotic arm is the device class that most deserves attention in this study.

Unlike software scripts, the arm really touches the screen, so it produces contact area and pressure. Mechanics also create speed change and path curvature. On some single metrics it already shows traits once treated as “human.”

Enlarge

FIG. 7 Human vs. robotic arm: mean contact size and path redundancy.

4.4 Highest separation: contact area and swipe trajectory

In this run, contact area and swipe trajectory had the highest separation.

Contact area mainly shows whether real physical touch occurred. A human finger forms a clear patch that changes with force, angle, and motion. HID and mouse, which do not really touch the glass, lack a normal contact area. Arms and capacitive clickers can produce real contact, but their distribution still differs from humans.

Enlarge

FIG. 8 Press contact-area distribution. Humans: a wide natural spread. HID / mouse / auto swipe-likers: mostly 0.

Swipe trajectory mainly shows differences in path shape and how tightly the motion repeats.

Humans: dispersed start/end/curvature. Arms: some spread but more clustered. Mouse clicker: start/end vary, path stays a straight line. The other five tools: highly uniform straight or curved paths.

Enlarge

FIG. 9 Swipe-gesture trajectory overlay (n = 250 per group).

05 Single rules are easy to fake; combinations are not

Several results in this study show the limits of any single rule.

Non-zero contact area ≠ human (arms and capacitive devices also touch). A curve ≠ human (mechanics make curves). Large speed jitter ≠ human (some machines exceed humans). Phone shake ≠ human.

We distilled 9 analysis dimensions, typical signatures per method, and a first-pass multidimensional rule engine — a further base for testing behavioral authenticity.

Nine-dimension recap (not a second full table)

Swipe-speed fluctuation (Very high): Scripts near 0; humans ~0.51; robotic arms ~0.65; sliders up to ~1.09

Press contact area (Very high): Software inject / HID / mouse mostly 0; humans largest; arms / sliders / capacitive clickers non-zero mid-high

Press force (High): Scripts / HID / auto swipe-likers almost constant at 1

Pressure fluctuation (High): Scripts / HID almost 0; humans ~0.23

Mean swipe speed (Medium-high): Auto swipe-likers fastest; humans relatively fast; mouse clickers slowest

Path redundancy / curvature (Medium): Code scripts almost a straight line; a human path is about 4.8% longer; scripts and capacitive clickers have curvature near 0

Acceleration / gyroscope+ (Medium): Handheld walking >> lying flat; flat / still near 0

Findings and open source

Under the conditions of this test, humans, software scripts, and several classes of automation hardware show observable differences on contact area, pressure, speed, trajectory, and device motion.

A machine can imitate one parameter, or one action. Replicating the natural human linkage among pressure, contact, speed, trajectory, and device motion at once is much harder. Detection can therefore add behavioral authenticity on top of device-environment checks.

The Threat Hunter research team has distilled three lines of work, and has open-sourced the experiment data, method, and detector from this study.

1. Analysis dimensions. Nine focus dimensions — pressure, contact area, speed, trajectory, and device sensors — with an assessment of separating value in this run.

1. Signatures by method. Typical patterns for software scripts, HID, mouse, sliders, robotic arms, and the other automation methods in the study.

1. Multidimensional detector. A first-pass rule engine, built from the results, to test whether combined behavior features can separate humans from automation.

GitHub: https://github.com/threathunterX/gesture-fingerprint

The release includes the behavioral data, analysis method, and related detector from this experiment, for security, risk, and research teams to test, verify, and extend.

threathunter.com