Modern CAPTCHA Attacks in 2026: How AI Beats Human Verifi...

# Example: Extract audio from CAPTCHA
# (This is for educational purposes only on your own CAPTCHA)

# Download audio file
curl -o captcha_audio.mp3 "https://your-site.com/captcha/audio"

# Use speech recognition (e.g., Whisper)
whisper captcha_audio.mp3 --language en --output_format txt

# Or use online services
# Many speech-to-text APIs can transcribe CAPTCHA audio

Complete Behavioral Biometrics System:

/**
 * Production-ready Behavioral Biometrics System
 * Tracks user behavior patterns to distinguish humans from bots
 */

class BehavioralBiometrics {
    constructor(config = {}) {
        this.events = [];
        this.startTime = Date.now();
        this.config = {
            minEvents: config.minEvents || 20,
            maxEvents: config.maxEvents || 1000,
            trackingDuration: config.trackingDuration || 30000, // 30 seconds
            ...config
        };
        
        this.mousePath = [];
        this.keystrokes = [];
        this.scrolls = [];
        this.touchEvents = [];
        
        this.initTracking();
    }
    
    initTracking() {
        // Mouse tracking
        document.addEventListener('mousemove', (e) => this.trackMouseMove(e));
        document.addEventListener('mousedown', (e) => this.trackMouseDown(e));
        document.addEventListener('mouseup', (e) => this.trackMouseUp(e));
        
        // Keyboard tracking
        document.addEventListener('keydown', (e) => this.trackKeystroke(e));
        document.addEventListener('keyup', (e) => this.trackKeyUp(e));
        
        // Scroll tracking
        document.addEventListener('scroll', (e) => this.trackScroll(e), { passive: true });
        
        // Touch tracking (mobile)
        document.addEventListener('touchstart', (e) => this.trackTouch(e), { passive: true });
        document.addEventListener('touchmove', (e) => this.trackTouch(e), { passive: true });
        
        // Page visibility
        document.addEventListener('visibilitychange', () => this.handleVisibilityChange());
    }
    
    trackMouseMove(event) {
        const now = Date.now();
        const timestamp = now - this.startTime;
        
        // Calculate velocity
        let velocity = 0;
        if (this.mousePath.length > 0) {
            const lastPoint = this.mousePath[this.mousePath.length - 1];
            const distance = Math.sqrt(
                Math.pow(event.clientX - lastPoint.x, 2) +
                Math.pow(event.clientY - lastPoint.y, 2)
            );
            const timeDelta = timestamp - lastPoint.timestamp;
            velocity = timeDelta > 0 ? distance / timeDelta : 0;
        }
        
        const point = {
            type: 'mousemove',
            x: event.clientX,
            y: event.clientY,
            timestamp: timestamp,
            velocity: velocity,
            acceleration: this.calculateAcceleration(velocity)
        };
        
        this.mousePath.push(point);
        this.events.push(point);
        
        this.checkEventLimit();
    }
    
    trackMouseDown(event) {
        this.events.push({
            type: 'mousedown',
            x: event.clientX,
            y: event.clientY,
            timestamp: Date.now() - this.startTime,
            button: event.button
        });
    }
    
    trackMouseUp(event) {
        this.events.push({
            type: 'mouseup',
            x: event.clientX,
            y: event.clientY,
            timestamp: Date.now() - this.startTime,
            button: event.button
        });
    }
    
    trackKeystroke(event) {
        const now = Date.now();
        const timestamp = now - this.startTime;
        
        // Calculate dwell time and flight time
        let dwellTime = 0;
        let flightTime = 0;
        
        if (this.keystrokes.length > 0) {
            const lastKey = this.keystrokes[this.keystrokes.length - 1];
            if (lastKey.key === event.key) {
                dwellTime = timestamp - lastKey.timestamp;
            } else {
                flightTime = timestamp - (lastKey.timestamp + (lastKey.dwellTime || 0));
            }
        }
        
        const keystroke = {
            type: 'keystroke',
            key: event.key,
            code: event.code,
            timestamp: timestamp,
            dwellTime: dwellTime,
            flightTime: flightTime,
            shiftKey: event.shiftKey,
            ctrlKey: event.ctrlKey,
            altKey: event.altKey
        };
        
        this.keystrokes.push(keystroke);
        this.events.push(keystroke);
        
        this.checkEventLimit();
    }
    
    trackKeyUp(event) {
        if (this.keystrokes.length > 0) {
            const lastKey = this.keystrokes[this.keystrokes.length - 1];
            if (lastKey.key === event.key) {
                lastKey.keyUpTimestamp = Date.now() - this.startTime;
                lastKey.totalDwellTime = lastKey.keyUpTimestamp - lastKey.timestamp;
            }
        }
    }
    
    trackScroll(event) {
        this.events.push({
            type: 'scroll',
            deltaY: event.deltaY || window.scrollY,
            deltaX: event.deltaX || window.scrollX,
            timestamp: Date.now() - this.startTime,
            scrollTop: window.pageYOffset || document.documentElement.scrollTop,
            scrollLeft: window.pageXOffset || document.documentElement.scrollLeft
        });
        
        this.checkEventLimit();
    }
    
    trackTouch(event) {
        const touches = Array.from(event.touches).map(touch => ({
            type: 'touch',
            x: touch.clientX,
            y: touch.clientY,
            identifier: touch.identifier,
            timestamp: Date.now() - this.startTime,
            eventType: event.type
        }));
        
        this.touchEvents.push(...touches);
        this.events.push(...touches);
        
        this.checkEventLimit();
    }
    
    calculateAcceleration(currentVelocity) {
        if (this.mousePath.length < 2) return 0;
        
        const lastVelocity = this.mousePath[this.mousePath.length - 2].velocity || 0;
        const timeDelta = this.mousePath[this.mousePath.length - 1].timestamp - 
                         this.mousePath[this.mousePath.length - 2].timestamp;
        
        return timeDelta > 0 ? (currentVelocity - lastVelocity) / timeDelta : 0;
    }
    
    handleVisibilityChange() {
        if (document.hidden) {
            this.events.push({
                type: 'visibility_change',
                hidden: true,
                timestamp: Date.now() - this.startTime
            });
        }
    }
    
    checkEventLimit() {
        if (this.events.length > this.config.maxEvents) {
            // Remove oldest events
            this.events = this.events.slice(-this.config.maxEvents);
        }
    }
    
    // Analyze behavior patterns
    analyze() {
        if (this.events.length < this.config.minEvents) {
            return {
                isHuman: false,
                confidence: 0,
                reason: 'Insufficient events collected'
            };
        }
        
        const features = this.extractFeatures();
        const score = this.calculateHumanScore(features);
        
        return {
            isHuman: score > 0.7,
            confidence: score,
            features: features,
            eventsCollected: this.events.length,
            duration: Date.now() - this.startTime
        };
    }
    
    extractFeatures() {
        const features = {
            mouseMovements: this.mousePath.length,
            keystrokes: this.keystrokes.length,
            scrolls: this.scrolls.length,
            touches: this.touchEvents.length,
            averageVelocity: 0,
            mousePathComplexity: 0,
            keystrokeVariation: 0,
            timeActive: Date.now() - this.startTime
        };
        
        // Calculate average mouse velocity
        if (this.mousePath.length > 0) {
            const velocities = this.mousePath.map(p => p.velocity || 0);
            features.averageVelocity = velocities.reduce((a, b) => a + b, 0) / velocities.length;
        }
        
        // Calculate mouse path complexity (entropy)
        if (this.mousePath.length > 2) {
            const angles = [];
            for (let i = 1; i < this.mousePath.length - 1; i++) {
                const p1 = this.mousePath[i - 1];
                const p2 = this.mousePath[i];
                const p3 = this.mousePath[i + 1];
                
                const angle1 = Math.atan2(p2.y - p1.y, p2.x - p1.x);
                const angle2 = Math.atan2(p3.y - p2.y, p3.x - p2.x);
                angles.push(Math.abs(angle2 - angle1));
            }
            features.mousePathComplexity = angles.reduce((a, b) => a + b, 0) / angles.length;
        }
        
        // Calculate keystroke timing variation
        if (this.keystrokes.length > 1) {
            const flightTimes = this.keystrokes
                .filter(k => k.flightTime > 0)
                .map(k => k.flightTime);
            if (flightTimes.length > 0) {
                const avg = flightTimes.reduce((a, b) => a + b, 0) / flightTimes.length;
                const variance = flightTimes.reduce((sum, ft) => sum + Math.pow(ft - avg, 2), 0) / flightTimes.length;
                features.keystrokeVariation = Math.sqrt(variance);
            }
        }
        
        return features;
    }
    
    calculateHumanScore(features) {
        let score = 0;
        let factors = 0;
        
        // Mouse movement patterns (humans have irregular movements)
        if (features.mouseMovements > 10) {
            const mouseScore = Math.min(features.mousePathComplexity / Math.PI, 1);
            score += mouseScore * 0.3;
            factors += 0.3;
        }
        
        // Keystroke variation (humans have variable timing)
        if (features.keystrokes > 5) {
            const keystrokeScore = Math.min(features.keystrokeVariation / 100, 1);
            score += keystrokeScore * 0.3;
            factors += 0.3;
        }
        
        // Activity duration (bots complete actions very quickly)
        const durationScore = Math.min(features.timeActive / 5000, 1);
        score += durationScore * 0.2;
        factors += 0.2;
        
        // Event diversity (humans have diverse interactions)
        const eventTypes = new Set(this.events.map(e => e.type));
        const diversityScore = Math.min(eventTypes.size / 5, 1);
        score += diversityScore * 0.2;
        factors += 0.2;
        
        return factors > 0 ? score / factors : 0;
    }
    
    // Get behavior data for server validation
    getBehaviorData() {
        return {
            events: this.events.slice(-100), // Last 100 events
            analysis: this.analyze(),
            userAgent: navigator.userAgent,
            screenResolution: {
                width: window.screen.width,
                height: window.screen.height
            },
            timestamp: Date.now()
        };
    }
    
    // Send to server for validation
    async validateWithServer(endpoint) {
        const behaviorData = this.getBehaviorData();
        
        try {
            const response = await fetch(endpoint, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json'
                },
                body: JSON.stringify(behaviorData)
            });
            
            const result = await response.json();
            return result;
        } catch (error) {
            console.error('Error validating behavior:', error);
            return { isHuman: false, error: error.message };
        }
    }
    
    cleanup() {
        // Remove event listeners
        document.removeEventListener('mousemove', this.trackMouseMove);
        document.removeEventListener('keydown', this.trackKeystroke);
        document.removeEventListener('scroll', this.trackScroll);
    }
}

// Server-side validation (Node.js/Express example)
const express = require('express');
const app = express();

app.post('/api/validate-behavior', express.json(), (req, res) => {
    const behaviorData = req.body;
    
    // Server-side validation
    const isValid = validateBehaviorServerSide(behaviorData);
    
    res.json({
        isHuman: isValid,
        confidence: isValid ? 0.9 : 0.1,
        timestamp: Date.now()
    });
});

function validateBehaviorServerSide(data) {
    const analysis = data.analysis;
    
    // Check minimum requirements
    if (analysis.eventsCollected < 20) return false;
    if (analysis.duration < 2000) return false; // Less than 2 seconds is suspicious
    
    // Check human-like patterns
    if (analysis.confidence < 0.7) return false;
    
    // Check for bot-like patterns
    const events = data.events;
    
    // Check for perfectly regular timing (bot-like)
    if (events.length > 10) {
        const timings = events.slice(1).map((e, i) => e.timestamp - events[i].timestamp);
        const avgTiming = timings.reduce((a, b) => a + b, 0) / timings.length;
        const variance = timings.reduce((sum, t) => sum + Math.pow(t - avgTiming, 2), 0) / timings.length;
        
        // Too regular timing suggests automation
        if (variance < 10) return false;
    }
    
    return true;
}

// Usage example
document.addEventListener('DOMContentLoaded', () => {
    const biometrics = new BehavioralBiometrics({
        minEvents: 20,
        trackingDuration: 30000
    });
    
    // Before form submission, validate
    document.getElementById('myForm').addEventListener('submit', async (e) => {
        e.preventDefault();
        
        const result = await biometrics.validateWithServer('/api/validate-behavior');
        
        if (result.isHuman) {
            // Proceed with form submission
            e.target.submit();
        } else {
            alert('Bot detected. Please try again.');
        }
    });
});

// Node.js example
async function verifyTurnstile(token, ip) {
  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      secret: process.env.TURNSTILE_SECRET,
      response: token,
      remoteip: ip
    })
  });
  
  const data = await response.json();
  return data.success;
}

class ActivityAnalyzer {
  constructor() {
    this.activities = [];
    this.startTime = Date.now();
  }
  
  trackActivity(type, metadata = {}) {
    this.activities.push({
      type,
      timestamp: Date.now() - this.startTime,
      ...metadata
    });
  }
  
  analyzePatterns() {
    const timeOnPage = Date.now() - this.startTime;
    const activityCount = this.activities.length;
    const activityRate = activityCount / (timeOnPage / 1000); // per second
    
    // Bot indicators
    const indicators = {
      tooFast: activityRate > 10, // Unrealistic activity rate
      noPauses: this.detectNoPauses(),
      perfectTiming: this.detectPerfectTiming(),
      noErrors: this.detectNoErrors(),
      directNavigation: this.detectDirectNavigation()
    };
    
    const botScore = Object.values(indicators).filter(Boolean).length;
    return { botScore, indicators };
  }
  
  detectNoPauses() {
    // Humans pause between actions; bots don't
    const intervals = [];
    for (let i = 1; i < this.activities.length; i++) {
      intervals.push(this.activities[i].timestamp - this.activities[i-1].timestamp);
    }
    const avgInterval = intervals.reduce((a, b) => a + b, 0) / intervals.length;
    return avgInterval < 100; // Less than 100ms average = suspicious
  }
  
  detectPerfectTiming() {
    // Bots have consistent timing; humans vary
    const intervals = [];
    for (let i = 1; i < this.activities.length; i++) {
      intervals.push(this.activities[i].timestamp - this.activities[i-1].timestamp);
    }
    const variance = this.calculateVariance(intervals);
    return variance < 50; // Low variance = suspicious
  }
  
  // Calculate variance of intervals
  calculateVariance(values) {
    if (values.length === 0) return 0;
    const mean = values.reduce((a, b) => a + b, 0) / values.length;
    const squaredDiffs = values.map(value => Math.pow(value - mean, 2));
    return squaredDiffs.reduce((a, b) => a + b, 0) / values.length;
  }
  
  detectNoErrors() {
    // Humans make mistakes; bots don't
    const errorCount = this.activities.filter(a => a.type === 'error').length;
    const totalActions = this.activities.length;
    return totalActions > 10 && errorCount === 0; // Suspicious if no errors
  }
  
  detectDirectNavigation() {
    // Bots often navigate directly; humans browse
    const navigationEvents = this.activities.filter(a => 
      a.type === 'navigation' || a.type === 'pageview'
    );
    const hasIntermediatePages = navigationEvents.length > 1;
    return !hasIntermediatePages && this.activities.length > 5; // Direct nav = suspicious
  }
}

// Show additional verification (production implementation)
function showAdditionalVerification() {
  // Create verification modal
  const modal = document.createElement('div');
  modal.id = 'verification-modal';
  modal.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;background:rgba(0,0,0,0.7);z-index:10000;display:flex;align-items:center;justify-content:center';
  
  const content = document.createElement('div');
  content.style.cssText = 'background:white;padding:2rem;border-radius:8px;max-width:400px';
  content.innerHTML = `
    <h2>Additional Verification Required</h2>
    <p>Please complete the verification to continue.</p>
    <button id="verify-btn" style="padding:0.5rem 1rem;background:#007bff;color:white;border:none;border-radius:4px;cursor:pointer">
      Verify
    </button>
  `;
  
  modal.appendChild(content);
  document.body.appendChild(modal);
  
  // Handle verification
  document.getElementById('verify-btn').addEventListener('click', () => {
    // In production, trigger CAPTCHA or additional verification
    // For now, just close modal
    document.body.removeChild(modal);
    // Trigger form submission after verification
    document.querySelector('form').submit();
  });
}

// Usage
const analyzer = new ActivityAnalyzer();

// Track various activities
document.addEventListener('click', (e) => {
  analyzer.trackActivity('click', { x: e.clientX, y: e.clientY });
});
document.addEventListener('keydown', () => analyzer.trackActivity('keydown'));
window.addEventListener('focus', () => analyzer.trackActivity('focus'));
window.addEventListener('blur', () => analyzer.trackActivity('blur'));

// Track errors
window.addEventListener('error', () => analyzer.trackActivity('error'));

// Before form submit, analyze
const form = document.querySelector('form');
if (form) {
  form.addEventListener('submit', async (e) => {
    const analysis = analyzer.analyzePatterns();
    
    if (analysis.botScore >= 3) {
      e.preventDefault();
      // Require additional verification
      showAdditionalVerification();
    }
  });
}

// Production-ready human verification with real implementations
class HumanVerification {
  constructor() {
    this.ipReputationCache = new Map();
  }
  
  // Calculate behavioral score from mouse/keyboard patterns
  calculateBehavioralScore(behaviorData) {
    let score = 0.5; // Start neutral
    
    // Check mouse movement patterns (humans have curves, bots are linear)
    if (behaviorData.mouseMovements) {
      const movements = behaviorData.mouseMovements;
      const curvatures = [];
      for (let i = 2; i < movements.length; i++) {
        const curvature = this.calculateCurvature(
          movements[i-2], movements[i-1], movements[i]
        );
        curvatures.push(curvature);
      }
      const avgCurvature = curvatures.reduce((a, b) => a + b, 0) / curvatures.length;
      if (avgCurvature > 0.1) score += 0.2; // Curved movements = human
    }
    
    // Check typing patterns (humans have variable speed)
    if (behaviorData.keystrokes) {
      const intervals = [];
      for (let i = 1; i < behaviorData.keystrokes.length; i++) {
        intervals.push(behaviorData.keystrokes[i].timestamp - behaviorData.keystrokes[i-1].timestamp);
      }
      const variance = this.calculateVariance(intervals);
      if (variance > 100) score += 0.2; // Variable timing = human
    }
    
    return Math.min(1.0, Math.max(0.0, score));
  }
  
  // Calculate activity score
  calculateActivityScore(activityData) {
    let score = 0.5;
    
    // Check for natural pauses
    if (activityData.pauses && activityData.pauses.length > 0) {
      score += 0.2; // Pauses indicate human behavior
    }
    
    // Check for errors (humans make mistakes)
    if (activityData.errors && activityData.errors > 0) {
      score += 0.2; // Errors indicate human
    }
    
    // Check activity rate (too fast = bot)
    const activityRate = activityData.totalActions / (activityData.timeOnPage / 1000);
    if (activityRate > 20) {
      score -= 0.3; // Too fast = suspicious
    }
    
    return Math.min(1.0, Math.max(0.0, score));
  }
  
  // Get device fingerprint
  async getDeviceFingerprint() {
    try {
      const canvas = document.createElement('canvas');
      const ctx = canvas.getContext('2d');
      ctx.textBaseline = 'top';
      ctx.font = '14px Arial';
      ctx.fillText('Device fingerprint', 2, 2);
      
      const fingerprint = {
        userAgent: navigator.userAgent,
        language: navigator.language,
        platform: navigator.platform,
        screenResolution: `${screen.width}x${screen.height}`,
        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
        canvasHash: this.hashString(canvas.toDataURL()),
        webglVendor: this.getWebGLVendor()
      };
      
      // Convert to score (0-1)
      const fingerprintString = JSON.stringify(fingerprint);
      const hash = this.hashString(fingerprintString);
      return this.hashToScore(hash);
    } catch (error) {
      console.error('Error getting device fingerprint:', error);
      return 0.5; // Neutral on error
    }
  }
  
  // Check IP reputation
  async checkIPReputation(ip) {
    try {
      // Check cache first
      if (this.ipReputationCache.has(ip)) {
        return this.ipReputationCache.get(ip);
      }
      
      // In production, use IP reputation service (e.g., AbuseIPDB, VirusTotal)
      const response = await fetch(`/api/ip-reputation?ip=${encodeURIComponent(ip)}`, {
        method: 'GET',
        headers: { 'Content-Type': 'application/json' }
      });
      
      if (response.ok) {
        const data = await response.json();
        const score = data.reputation || 0.5; // 0-1 scale
        this.ipReputationCache.set(ip, score);
        return score;
      }
      
      // Default to neutral if check fails
      return 0.5;
    } catch (error) {
      console.error('Error checking IP reputation:', error);
      return 0.5; // Neutral on error
    }
  }
  
  // Detect browser features
  detectBrowserFeatures() {
    let score = 0.5;
    
    // Check for automation indicators
    const automationIndicators = [
      navigator.webdriver, // Selenium/automation
      window.navigator.plugins.length === 0, // Headless browsers
      !window.chrome && !window.safari, // Missing browser objects
    ];
    
    const hasAutomation = automationIndicators.some(indicator => indicator === true);
    if (hasAutomation) {
      score -= 0.4; // Likely automated
    } else {
      score += 0.3; // Looks like real browser
    }
    
    return Math.min(1.0, Math.max(0.0, score));
  }
  
  // Helper: Calculate curvature of mouse movement
  calculateCurvature(p1, p2, p3) {
    const dx1 = p2.x - p1.x;
    const dy1 = p2.y - p1.y;
    const dx2 = p3.x - p2.x;
    const dy2 = p3.y - p2.y;
    
    const cross = dx1 * dy2 - dy1 * dx2;
    const dist1 = Math.sqrt(dx1 * dx1 + dy1 * dy1);
    const dist2 = Math.sqrt(dx2 * dx2 + dy2 * dy2);
    
    if (dist1 === 0 || dist2 === 0) return 0;
    return Math.abs(cross) / (dist1 * dist2);
  }
  
  // Helper: Calculate variance
  calculateVariance(values) {
    if (values.length === 0) return 0;
    const mean = values.reduce((a, b) => a + b, 0) / values.length;
    const squaredDiffs = values.map(value => Math.pow(value - mean, 2));
    return squaredDiffs.reduce((a, b) => a + b, 0) / values.length;
  }
  
  // Helper: Hash string
  hashString(str) {
    let hash = 0;
    for (let i = 0; i < str.length; i++) {
      const char = str.charCodeAt(i);
      hash = ((hash << 5) - hash) + char;
      hash = hash & hash; // Convert to 32bit integer
    }
    return Math.abs(hash);
  }
  
  // Helper: Convert hash to score (0-1)
  hashToScore(hash) {
    return (hash % 1000) / 1000; // Normalize to 0-1
  }
  
  // Helper: Get WebGL vendor
  getWebGLVendor() {
    try {
      const canvas = document.createElement('canvas');
      const gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl');
      if (gl) {
        const debugInfo = gl.getExtension('WEBGL_debug_renderer_info');
        return debugInfo ? debugInfo.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL) : 'unknown';
      }
    } catch (e) {
      return 'unknown';
    }
    return 'unknown';
  }
  
  // Main verification function
  async verifyHuman(userData, behaviorData, activityData) {
    try {
      const signals = {
        behavioralScore: this.calculateBehavioralScore(behaviorData),
        activityScore: this.calculateActivityScore(activityData),
        deviceFingerprint: await this.getDeviceFingerprint(),
        ipReputation: await this.checkIPReputation(userData.ip),
        browserFeatures: this.detectBrowserFeatures()
      };
      
      // Weighted scoring
      const humanScore = (
        signals.behavioralScore * 0.3 +
        signals.activityScore * 0.2 +
        signals.deviceFingerprint * 0.2 +
        signals.ipReputation * 0.2 +
        signals.browserFeatures * 0.1
      );
      
      return {
        isHuman: humanScore > 0.7,
        score: humanScore,
        signals
      };
    } catch (error) {
      console.error('Error verifying human:', error);
      // Fail closed - treat as potentially bot
      return { isHuman: false, score: 0.0, error: error.message };
    }
  }
}

// Usage
const verifier = new HumanVerification();

// Example usage
async function checkIfHuman() {
  const userData = { ip: '192.168.1.1' };
  const behaviorData = {
    mouseMovements: [{ x: 100, y: 100 }, { x: 150, y: 120 }, { x: 200, y: 140 }],
    keystrokes: [
      { timestamp: 1000 },
      { timestamp: 1250 },
      { timestamp: 1600 }
    ]
  };
  const activityData = {
    totalActions: 15,
    timeOnPage: 5000,
    pauses: [1000, 2000],
    errors: 2
  };
  
  const result = await verifier.verifyHuman(userData, behaviorData, activityData);
  return result.isHuman;
}

// Server-side logging
async function logCaptchaAttempt(req, success, solvingTime) {
  await db.logs.insert({
    ip: req.ip,
    userAgent: req.headers['user-agent'],
    success,
    solvingTime,
    timestamp: new Date(),
    riskScore: calculateRiskScore(req)
  });
  
  // Alert on suspicious patterns
  const recentAttempts = await db.logs.findRecent(req.ip, '1h');
  if (recentAttempts.length > 50 && recentAttempts.filter(a => a.success).length / recentAttempts.length > 0.9) {
    await sendAlert('Suspicious CAPTCHA solving pattern', req.ip);
  }
}