Mouse-Movement Analysis for Bot Detection

A human moving a mouse never travels in a straight line. The cursor accelerates, overshoots the target, corrects back, pauses while the eye catches up, and drifts with tiny tremors no person notices. A naive bot, by contrast, teleports the cursor to exact coordinates or slides it along a perfect line at constant speed. The gap between those two motion profiles is one of the richest behavioral signals available for telling people from machines.

This article explains how mouse-movement analysis works, what it reliably catches, where its blind spots are, and why it belongs in a layered system rather than standing alone. It builds on the behavioral biometrics overview and the bot detection pillar.

The physics of human motion

Human cursor movement is governed by well-studied motor behavior. The most famous is Fitts’s law, which says the time to reach a target depends on its distance and size, producing a characteristic accelerate-then-decelerate velocity curve. Real motion also carries noise: the hand trembles, the mouse sensor jitters, and the eye-hand loop overshoots and corrects.

The features that encode humanity:

• Velocity profile. Humans ramp up speed, then slow as they approach a target, giving a bell-shaped curve rather than a flat line.
• Path curvature. People move in gentle arcs, not straight segments, because arm and wrist rotation curve the path.
• Overshoot and correction. The cursor commonly passes the target slightly and snaps back, a signature of closed-loop motor control.
• Micro-pauses. Brief hesitations while attention shifts, absent in scripted motion.
• Tremor and jitter. Sub-pixel noise from the neuromuscular system that synthetic paths lack.

A bot that sets element.click() produces no motion at all, and a bot that animates the cursor linearly produces motion with none of these properties. Both are easy to flag.

What the analysis catches

Movement analysis is most powerful against the large middle of the bot population: automation that interacts with the page but does not bother to simulate realistic motion. This is where most Selenium, Puppeteer, and Playwright scripts and automation frameworks live.

Bot behavior	Movement signature	Detected
Direct DOM click, no cursor	No movement events at all	Easily
Linear cursor animation	Constant velocity, zero curvature	Easily
Teleport to coordinates	Instant jumps, no path	Easily
Recorded-path replay	Realistic but repeated identically	With correlation
Generative human-like motion	Plausible curves	Hard, needs other signals

The signal is also useful positively. High-confidence human motion can be a reason to reduce friction, letting a genuine user skip a challenge they would otherwise face. Used that way, movement analysis improves the experience for real people rather than only punishing bots, which is the humane alternative to a CAPTCHA wall.

The blind spots

Movement analysis is a strong signal, not a complete one, and honest engineering means naming where it fails.

• Sophisticated replay. Bots can record real human mouse paths and replay them, producing motion that passes a naive check. The tell is repetition: replayed paths are identical or trivially perturbed, detectable only by comparing sessions.
• Generative motion. Models trained on human data can synthesize plausible curves. These defeat single-session analysis and require correlation with device and network signals.
• No cursor on touch. Touchscreens have no mouse, so the analysis simply does not apply; you fall back to touch-gesture and scroll dynamics instead.
• Accessibility tools. Users with assistive devices, eye-trackers, or switch access produce atypical motion that must not be misread as robotic.
• Sparse data. A user who clicks one button and leaves gives too little motion to judge, so the signal is weak on short sessions.

The accessibility point is not a footnote. A detector that flags assistive-technology users as bots is broken, and any deployment must treat unusual-but-human motion carefully, which is another reason movement analysis should inform a score rather than issue a verdict.

Capturing and scoring movement

Collection is lightweight: listen for pointer events, sample position and timestamp, and derive features client-side before sending a compact summary rather than the raw trace. Sending features instead of full coordinates also serves data minimization.

let last = null, samples = [];
document.addEventListener('pointermove', (e) => {
  const now = performance.now();
  if (last) {
    const dt = now - last.t;
    const dx = e.clientX - last.x, dy = e.clientY - last.y;
    const v = Math.hypot(dx, dy) / (dt || 1);   // velocity
    samples.push({ v, dx, dy, dt });
  }
  last = { x: e.clientX, y: e.clientY, t: now };
});

// summarize to features, not raw path
function features() {
  const vels = samples.map(s => s.v);
  return {
    straightness: pathStraightness(samples), // 1.0 == perfectly linear (suspicious)
    velVariance: variance(vels),             // near-zero == constant speed (suspicious)
    pauseCount: samples.filter(s => s.dt > 120).length,
    sampleCount: samples.length,
  };
}

The scoring logic looks for the absence of humanity rather than its presence, because absence is what cheap bots reveal:

• Perfect straightness (path length equals displacement) suggests linear animation.
• Near-zero velocity variance suggests constant-speed scripting.
• Zero pauses and micro-corrections over a long interaction suggests non-human control.
• Too few samples means low confidence, so weight the signal down rather than guessing.

Combining with other signals

Movement analysis earns its place as one input among many. On its own it is defeatable by replay and generative motion and inapplicable on touch. Combined, it sharpens a picture that no single signal completes. Pair it with:

• Device signals and headless detection to catch bots that skip motion entirely.
• Keystroke dynamics for forms, another behavioral channel with the same human-noise logic.
• Mouse-adjacent correlation across sessions to spot replayed paths that repeat.
• A suspect score that fuses behavior, device, and network into one explainable decision.

Treated this way, a bot must simultaneously fake realistic motion, present a clean device, originate from a trustworthy network, and avoid repeating itself across sessions. Defeating one signal is easy; defeating all of them at once is the cost we want to impose.

Frequently asked questions

How does mouse-movement analysis detect bots?

It examines the physics of cursor motion, velocity curves, path curvature, pauses, and micro-corrections, which humans produce naturally and simple bots fail to reproduce.

Can bots fake human mouse movement?

Advanced bots replay recorded human paths or use generative models, so movement analysis is a strong signal but must be combined with device and network checks.

Does mouse analysis work on touchscreens?

Not directly, since touch devices have no cursor, but analogous touch-gesture and scroll dynamics provide equivalent behavioral signals on mobile.

Mouse-movement analysis reads the physics of human motion to expose bots that cannot reproduce it, and it can reward genuine users with less friction. Respect its blind spots, protect assistive-technology users, and fuse it with device and network signals into one score. See the playground to watch motion scored live, or the behavioral biometrics guide for the wider toolkit.