It is hard for bot programmers to emulate the biases in human actions whether in mouse movements or in key strokes. imc needs to look into these kinds of strategies (or at least pass this on to Valve)…
Here is one example of such a system being applied in blogs to detect blogging bots. (I’m not saying imc should implement THIS system exactly, but it provides the flavor for the kind of strategy that should be used)
The system consists of two components, a webpage-embedded
logger and a server-side detector. The logger is implemented
as a JavaScript snippet that runs in the webpage
on the client browser. It records a user’s input actions during
her stay at the site and streams the data to the serverside
detector. The detector processes raw user input (UI)
data, and extracts biometrics-related features. The core of
the detector is a machine-learning-based classifier which
is tuned with training data for the binary classification,
namely determining whether the user is human or bot.
Informed with the classification result, the server decides
whether or not to accept the comment form submission.1
We evaluate the efficacy of the detection system by conducting
a series of experiments over the user input dataset. The
experimental results demonstrate that the system can detect
97.9% of current blog bots with extremely low false positive
rate of 0.2%