Fake Activity Detection

In-Depth Definition

Activity metrics are only useful if the input behind them came from a human. Tools that simulate keyboard or pointer events defeat simple idle detection completely, which is why activity percentage alone is a weak trust signal. Fake activity detection looks at the shape of input over time rather than its volume: generated events tend to arrive at regular intervals, repeat identical movements, and lack the clustering and variation of genuine work. The output is a flag for review, never a conclusion about intent.

How It Works in Practice

• Timing regularity is examined, because automated input arrives on an interval while human input clusters and gaps.
• Movement variety is examined, since generated pointer movement often repeats near-identical vectors that a hand does not reproduce.
• Patterns are assessed across a session rather than at a moment, as any short window can look mechanical by chance.
• A flag routes to a human with the surrounding context attached, because the data can show what happened but never why.

A Worked Example

Two sessions both report high activity. In the first, input arrives in irregular bursts with long gaps around calendar meetings, and pointer paths differ every time. In the second, an event lands every 30 seconds almost exactly, and the pointer traverses the same short path each time. The second pattern is worth a conversation. Neither pattern is proof of anything on its own.

The Common Mistake

Treating a flag as a verdict. Detection identifies a statistical pattern, and patterns have innocent explanations: accessibility software, automated testing tools, remote desktop sessions and presentation software all generate synthetic-looking input. Acting on a flag without asking the person is how organisations end up apologising to employees who did nothing wrong.