| CPC H04L 63/1425 (2013.01) [G06F 21/316 (2013.01); H04L 63/107 (2013.01); H04L 63/1416 (2013.01); G06F 2221/2133 (2013.01)] | 17 Claims |

|
1. A computer-implemented method comprising:
receiving, for a user interface element, interaction locations that indicate where interactions with the user interface element occurred when the user interface element was provided on behalf of a first system;
determining, based on the received interaction locations, a difference between (i) a first distribution of the interaction locations for the user interface element when the user interface element was provided on behalf of the first system and (ii) a second distribution of the interaction locations for the user interface element when the user interface element was provided on behalf of a second system;
classifying the first distribution of the interaction locations as anomalous in response to the difference not satisfying a condition; and
preventing the first system from accessing an other system to which the first system was trying to gain access in response to classifying the first distribution of the interaction locations as anomalous, wherein preventing the first system from accessing the other system comprises:
preventing, at the other system and for the user interface element that has a first element type, the first system from accessing all user interface elements that have the first element type; and
enabling the first system's access to user interface elements that have a second, different element type.
|