I'm working on a Java Spring with a team and have been facing form spam issues. We are seeing a large number of requests that use generated & falsified information (ie everyone's names are generic, emails follow the same syntax, birthdays are 1/1 of various years, and all forms are completed in the same amount of time). Due to the uniform nature of these requests, I can reliably assume automation is being used.

Without introducing additional external dependencies into the project (eg Captcha), I would like to set up a system that can make automated form submissions as difficult as possible. My current approach would utilize five different approaches in tandem.

  • Measuring keystroke events per form/field
  • Hidden honeypot fields
  • Measure mouse events per page
  • Server-side timing
  • IP blocking

The first three would obviously be front-end and generally focus on determining how "human" the user is behaving. The latter two are to determine if the user is coming from a flagged IP or is submitting data repeatedly and within the same amount of time as their last submission. The nature of the application allows and encourages the same user to enter and submit data more than once, but the vast majority of users don't submit more than a few times.

My number one priority is reducing spam, with a close number two being the minimization of false positives. Each of the five elements wouldn't be an absolute ruling, but if two (or more) of these flags is triggered, the user is flagged and booted.

With all this said and done, how can I improve or build upon this approach? Are there any particular Spring libraries I could use? I am primarily a JavaScript dev in a Java project, hence my focus on front-end behavioral analysis.

  • 2
    I think you are overthinking this. A honeypot field is simple and effective against most form spam. – Sjoerd Mar 13 at 12:32
  • 2
    Be careful not to devise a behavioural analysis engine that is hyper-optimised to detect only one type of automated system. And also account for the fact that humans use automation legitimately. For instance, if I were to use my Lastpass auto-form filler, would that get flagged by your system? You want to allow humans, not block bots. That's why CAPTCHA is an elegant solution. – schroeder Mar 13 at 12:39
  • Definitely overthinking this, but I'd like to have something robust enough to not need regular configuration. If whoever is behind this attack wants to continue their spam, they can simply investigate the new point of failure in their approach and modify the script to circumvent the honeypot. I'm not trying to create something hugely sophisticated in terms of behavioral analysis, but if there aren't any mouse movements or natural keystrokes, that seems pretty suspicious. The nature of these forms would rarely be automatically filled, but in theory something like that could be a false positive – Chris Mar 13 at 12:45
  • 2
    a lot of bots simply don't run javascript. So, if you remove the action from the form's HTML, and set it with JS, it will work for users but not bots. I'm sure there are newer robots, but this slashed spam on a form at work from ~100 a day to ~3-4/month. – dandavis Mar 13 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.