Opens every screen in order at machine speed, then enumerates the interface and finds the hidden decoy.
Signals: speed · regularity · no pointer · honeypotNaïve crawler
QALA AI Detection Engine, live prototype
Watch an AI agent try to copy an app, and get caught. See the app arrive as pixels, never code. Everything runs in your browser.
01 — Live console
Click around like a user.
The white window is what a QALA user sees: a streamed screen of the app, never its code. The QALA detector beside it scores your behaviour as you go.
QALA detector
7 signals + honeypot0risk
Normal
No signals yet. Use the app, or launch an agent below.
Trained model v2 risk: 0
Attack lab
Ready. An agent drives the demo app the way a cloning bot would, opening screens and clicking actions, while the detector scores every move.
02 — Streaming preview
The app runs on the host. The browser gets pixels.
QALA's delivery layer in miniature. A separate process plays the QALA host: it runs the app, draws each screen, burns in the session watermark and sends compressed frames. Your browser only shows frames and sends back clicks, and the gateway passes those clicks to the detector. Simulated here: a Web Worker stands in for the host. In production it is an Apache Guacamole session on our servers.
QALA host · Web Worker
0Frames streamed
–Avg frame, JPEG
–Click to new frame
0Input events sent
Compressed framesreceived
Clicks, as coordinatessent
App code and data filesnever sent
Starting the host…
Click the streamed app. The menu and buttons work, but this page never receives the app itself, only images of it.
03 — Attack lab
Four agents. One app to copy.
Each profile is an abstract behavioural model that drives the demo app above. Pick one and watch the risk score climb. Outcomes come from the benchmark below.
Adds random pauses so its timing looks human, but still sweeps forward through every screen.
Signals: coverage · forward sweep · no pointerJittered bot
Moves the pointer, varies its rhythm and sometimes revisits a screen, the way a person would.
Signals: coverage · forward sweep · dwellHuman-mimic agent
Paces itself over a long session and backtracks like a person. Our hard case, shown on purpose.
Mitigation: cross-session limits · more honeypotsLow-and-slow agent
04 — Benchmark
Numbers computed here, not typed.
Every attacker profile runs 100 times through three defences: a plain rate-limit rule (more than 25 actions a minute), QALA v1 with calibrated weights, and QALA v2, which adds a logistic-regression model trained on 10,612 labelled session prefixes. v2 was trained on seed 4242 and checked on seed 9191, so seed 777 is held-out data. Rerun with a new seed and the numbers move a little. That's the point.
Detection rate by attacker
Share of sessions pushed to step-up or lock (risk ≥ 70) before the agent finished.
QALA v1QALA v2 (trained)Rate-limit rule
–Real users flagged · v1
–Real users flagged · v2
–Real users flagged · rate limit
| Defence | Naïve | Jittered | Mimic | Low & slow | Real users flagged |
|---|
Honest failure cases
05 — Disclosure
What this is, and isn't.
The model
v1: a transparent weighted logistic classifier over seven named behavioural features (speed, timing regularity, coverage, forward sweep, pointer movement, backtracking, dwell) plus a honeypot rule, with every weight and contribution shown live. v2: averages v1 with a logistic-regression model trained on 10,612 labelled prefixes from 1,000 simulated sessions (seed 4242, class-balanced, L2). Its threshold was checked on validation seed 9191 and it is tested on held-out seed 777. The trained model leans on pointer movement, which real agents can fake, so pilot data comes next.
The data
Synthetic sessions plus your own, generated in your browser. Attacker profiles are statistical event generators. No external data, no network calls, and no personal data leaves the page.
The components
Vanilla JavaScript, Canvas and a Web Worker, no external libraries. The streaming preview uses a worker as the host and JPEG frames as the stream. In production the streaming layer is Apache Guacamole (Apache-2.0) and the detector runs server-side on the session event stream.
Production input
Only the event stream the streaming gateway already has: navigation and action events with timestamps, pointer-movement presence, and which screens were touched. No app instrumentation and no content capture.
Honest limits
A low-and-slow agent that paces itself and copies backtracking stays under the threshold most of the time. Mitigations on the roadmap: more honeypots and cross-session aggregation (one account slowly mapping an app over days). Filmed screens are deterred by the visible session ID, not prevented.