Bot Detection & Keystroke Dynamics (AgentDetect & Cursive)

1. Overview & Architecture

Modern academic integrity challenges extend beyond traditional webcam monitoring. Today’s high-stakes online examinations face two emerging vectors:

1. Automated Browser Agents & AI Copilots: Tools like Perplexity Comet, Puppeteer, Playwright, and browser extensions that scrape questions and simulate mouse interactions.
2. Bulk Clipboard Dumps (Paste Attacks): Generating long-form essays in a separate window or device and instantly pasting the completed text into Moodle.

To neutralize these threats without imposing invasive operating system kernel hooks, ExamNode integrates two dedicated tools into the examination environment:

• Agent Detection Lite (local_agentdetect): Lightweight, sovereign browser automation detection.
• Cursive TinyMCE (tiny_cursive): Keystroke dynamics capture and interactive writing replay.

---

2. Browser Bot & Automation Detection (local_agentdetect)

Detection Mechanism

local_agentdetect runs during active quiz attempts via Moodle’s modern output hook (core\hook\output\before_footer_html_generation). It collects zero-dependency client telemetry directly within the candidate’s browser session:

• Automation Flags: Checks for navigator.webdriver, headless Chrome signatures, Chrome DevTools Protocol (CDP) artifacts, and automation globals.
• Perplexity Comet Signatures: Specific behavioral heuristics identifying Perplexity’s Comet browser (such as ultra-precise mathematical center-clicks, zero-keystroke submissions, and known Comet extension globals).
• Interaction Micro-patterns: Analyzes mouse trajectory curvature, click precision, and mouse-to-click event ratios.

Staff Reports

Course coordinators and invigilators can view flagged sessions by navigating to:

Course Administration ▸ Reports ▸ Agent Detection Report
# or directly at /local/agentdetect/coursereport.php?courseid=XYZ

Sessions are scored on a scale from 0 to 100. Attempts exceeding the configured threshold (default: 70) are flagged as Suspected Agent or Confirmed Agent for academic review.

---

3. Keystroke Dynamics & Writing Replay (tiny_cursive)

For assessments involving long-form written synthesis (such as essay questions or design justifications), tiny_cursive instruments the TinyMCE rich text editor.

Local Composition Replay

Every keystroke, pause, deletion, and paste event is recorded as structured JSON in the local Moodle database (mdl_tiny_cursive_*).

• Interactive Replay: Markers can open the Writing Report (/lib/editor/tiny/plugins/cursive/writing_report.php) and click Play to watch the candidate’s answer being typed character-by-character in real time.
• Paste Detection: If a student pastes 500 words in a single second from an external AI window, the replay immediately isolates the paste block, records the source timestamp, and highlights the sudden word surge.
• Paste Policies: Quizzes can enforce configurable paste constraints: Allow Paste, Block Paste Entirely, or Require Source Citation.

---

4. Privacy & The Sovereign Infrastructure Boundary

A foundational architectural commitment of ExamNode is sovereign data privacy: student data remains on institutional infrastructure.

Here is how each tool operates with respect to this boundary:

┌────────────────────────────────────────────────────────────────────────┐
│ SOVEREIGN INFRASTRUCTURE PERIMETER (100% Self-Hosted & On-Prem)       │
├────────────────────────────────────────────────────────────────────────┤
│  ✓ local_agentdetect: 100% local database storage; zero external calls. │
│  ✓ quizaccess_simpleproctor: Local Moodle File API + local Ollama LLM.  │
│  ✓ qtype_recordrtc: Local audio/video draft storage.                   │
│  ✓ tiny_cursive (Local Core): Keystroke logging & playback on-prem.    │
└────────────────────────────────────────────────────────────────────────┘
                                    │
                         Optional Cloud Add-on
                                    │
                                    ▼
┌────────────────────────────────────────────────────────────────────────┐
│ THIRD-PARTY CLOUD ANALYTICS (Optional / Enterprise Add-on)             │
├────────────────────────────────────────────────────────────────────────┤
│  ⚠️ Cursive Technology Cloud API (api.cursivetechnology.net)           │
│  - Cross-submission authorship attribution across multiple courses     │
│  - Advanced machine-learning behavioral metrics & PDF summaries        │
│  - STATUS: Active on ExamNode sandbox as a Proof of Concept (PoC)       │
│  - PRODUCTION: Requires institutional Data Processing Agreement (DPA)  │
└────────────────────────────────────────────────────────────────────────┘

Clarification on Cursive Technology API

• Proof of Concept (PoC): The current ExamNode sandbox utilizes a demonstration API key provided by Cursive Technology Inc. to evaluate advanced cross-submission authorship scoring.
• Production Institutional Deployments: Each institution has distinct procurement and privacy mandates. The cloud API integration is an optional add-on:
  1. Strictly Sovereign Deployment: Institutions can run Cursive with cloud telemetry disabled (sendtelemetry = 0). In this mode, keystroke capture, paste blocking, and marker video replay continue to function 100% locally within Moodle. No student writing ever leaves the host.
  2. Enterprise Analytics Deployment: Institutions wishing to utilize Cursive’s multi-submission authorship attribution and remote AI metrics can establish their own commercial agreement, Data Processing Agreement (DPA), and dedicated endpoint directly with Cursive Technology Inc.