The Invisible Biometric: High-Fidelity Mouse Logging

Mouse movement is an untapped signal

Every person moves a mouse in a uniquely personal way - speed, acceleration, curvature, hesitation patterns. These micro-behavioral signals are invisible to standard analytics but carry rich information: whether the user is a human or a bot, whether this is the legitimate account holder, and where exactly in the UI they are confused or frustrated. The challenge was building an infrastructure to capture, transmit, and interpret this signal at production scale without impacting page performance.

High-fidelity capture at minimal cost

Three constraints made this technically demanding:

• Sampling frequency vs. payload size: Capturing mouse events at high frequency (100Hz+) creates large data payloads. Too much and page performance degrades; too little and the behavioral signature loses fidelity.
• Privacy compliance: Mouse data can reveal sensitive user intent. Any implementation must be GDPR-compliant by design - no raw position logs transmitted, only anonymized behavioral features.
• Cross-device consistency: Mouse physics differ across hardware, OS, and browsers. A behavioral model trained on one device must generalize across the user's entire device profile.

A lightweight telemetry agent

TendersLab built a sub-5kb JavaScript agent that captures, compresses, and transmits behavioral features in real-time - with zero impact on page load.

1. Adaptive event sampling

Rather than capturing every mouse event, the agent uses an adaptive sampling algorithm that increases capture rate during high-velocity movements (where information density is highest) and decreases it during idle periods. This reduces payload by 70% while preserving behavioral fidelity.

2. On-device feature extraction

Raw coordinates are never transmitted. The agent performs local feature extraction - computing velocity vectors, angular acceleration, hesitation counts, and click pressure proxies - before transmitting a compact feature vector. This ensures GDPR compliance by design.

3. RNN-based behavioral profiling

On the server side, a Recurrent Neural Network (RNN) processes the time-series data to build a behavioral profile for each user. The model learns unique motor control patterns, enabling it to flag anomalies - such as a remote access trojan or an unauthorized user - with high confidence and low false-positive rate.

Security and UX intelligence from one data stream

• 99% bot detection rate: The system successfully distinguishes human users from advanced scripts that attempt to mimic human mouse movement - securing high-value transaction flows.
• Continuous authentication: For enterprise clients, the tool provides a passive second factor of authentication, locking sessions if behavior changes drastically (potential account takeover).
• UX heatmaps and rage-click detection: Product designers use aggregated data to visualize friction points - identifying UI issues that traditional analytics miss entirely.