Classification of website sessions using one-class labeling techniques
A session identification system classifies network sessions with a network application as either human-generated or generated by a non-human, such as by a bot. In an embodiment, the session identification system receives a set of unlabeled network sessions, and determines a label for a single class of the unlabeled network sessions. Based on the one-class labeling information, the session identification system determines multiple subsets of the unlabeled network sessions. Multiple classifiers included in the session identification system generate probabilities describing each of the unlabeled network sessions. The session identification system classifies each of the unlabeled network sessions based on a combination of the generated probabilities.
1. A method comprising:
receiving data describing a set of network sessions with a network application, wherein the received data lacks labeling information indicating a class for each network session in the set of network sessions;
determining a labeled subset of the network sessions, wherein each of the network sessions included in the labeled subset has an identified session feature associated with human-generated network traffic;
generating, via a first classifier and based on the determining of the labeled subset, a first probability indicating that a feature vector for a particular unlabeled network session includes the identified session feature;
determining a derived subset of the network sessions, wherein each of the network sessions included in the derived subset has an additional session feature that is associated with at least one of the network sessions included in the labeled subset;
generating, via a second classifier and based on the determining of the derived subset, a second probability indicating that, given that the feature vector for the particular unlabeled network session includes the additional session feature, the feature vector for the particular unlabeled network session also includes the identified session feature;
determining, based on a combination of the first probability and the second probability, a third probability indicating that the particular unlabeled network session is a human-generated network session;
generating, based on the third probability, classification data indicating the particular unlabeled network session as the human-generated network session or as a non-human network session; and
providing the classification data to an additional computing system that is configured to, based on the classification data, perform an operation related to the particular unlabeled network session.
2. The method of claim 1 , wherein the set of network sessions includes a set of unlabeled network sessions, and wherein the received data includes session features associated with the set of unlabeled network sessions.
3. The method of claim 2 , wherein the session features associated with each particular network session included in the set of unlabeled network sessions are represented by a respective feature vector.
4. The method of claim 3 , further comprising:
classifying, by the first classifier, each particular network session based on a first comparison of the respective feature vector with one or more additional feature vectors associated with the labeled subset, and
classifying, by the second classifier, each particular network session based on a second comparison of the respective feature vector with one or more additional feature vectors associated with the derived subset.
5. The method of claim 1 , wherein the identified session feature associated with human-generated network traffic comprises a network interaction indicating a purchase via the network application.
6. The method of claim 1 , wherein the data describing the set of network sessions describes one or more historical sessions.
7. The method of claim 1 , wherein
providing the classification data to the additional computing system includes providing, to the network application, the classification data of the particular unlabeled network session.
8. A non-transitory computer-readable medium embodying program code comprising instructions which, when executed by a processor, cause the processor to perform operations comprising:
receiving data describing a set of network sessions with a network application, wherein the received data lacks labeling information indicating a class for each network session in the set of network sessions;
determining a labeled subset of the network sessions, wherein each of the network sessions included in the labeled subset has an identified session feature associated with human-generated network traffic;
generating, via a first classifier and based on the determining of the labeled subset, a first probability indicating that a feature vector for a particular unlabeled network session includes the identified session feature;
determining a derived subset of the network sessions, wherein each of the network sessions included in the derived subset has an additional session feature that is associated with at least one of the network sessions included in the labeled subset;
generating, via a second classifier and based on the determining of the derived subset, a second probability indicating that, given that the feature vector for the particular unlabeled network session includes the additional session feature, the feature vector for the particular unlabeled network session also includes the identified session feature;
determining, based on a combination of the first probability and the second probability, a third probability indicating that the particular unlabeled network session is a human-generated network session;
generating, based on the third probability, classification data indicating the particular unlabeled network session as the human-generated network session or as a non-human network session; and
providing the classification data to an additional computing system that is configured to, based on the classification data, perform an operation related to the particular unlabeled network session.
9. The non-transitory computer-readable medium of claim 8 , wherein the set of network sessions includes a set of unlabeled network sessions, and wherein the received data includes session features associated with the set of unlabeled network sessions.
10. The non-transitory computer-readable medium of claim 9 , wherein the session features associated with each particular network session included in the set of unlabeled network sessions are represented by a respective feature vector.
11. The non-transitory computer-readable medium of claim 10 , wherein the operations further comprise:
classifying, by the first classifier, each particular network session based on a first comparison of the respective feature vector with one or more additional feature vectors associated with the labeled subset, and
classifying, by the second classifier, each particular network session based on a second comparison of the respective feature vector with one or more additional feature vectors associated with the derived subset.
12. The non-transitory computer-readable medium of claim 8 , wherein the identified session feature associated with human-generated network traffic comprises a network interaction indicating a purchase via the network application.
13. The non-transitory computer-readable medium of claim 8 , wherein
providing the classification data to the additional computing system includes providing, to the network application, the classification data.
14. A system comprising:
one or more processing devices; and
one or more memory devices communicatively coupled to the one or more processing devices, the one or more memory devices storing instructions which, when executed by the one or more processing devices, configure the system for:
receiving data describing a set of network sessions with a network application, wherein the received data lacks labeling information indicating a class for each network session in the set of network sessions;
determining a labeled subset of the network sessions, wherein each of the network sessions included in the labeled subset has an identified session feature associated with human-generated network traffic;
generating, via a first classifier and based on the determining of the labeled subset, a first probability indicating that a feature vector for a particular unlabeled network session includes the identified session feature;
determining a derived subset of the network sessions, wherein each of the network sessions included in the derived subset has an additional session feature that is associated with at least one of the network sessions included in the labeled subset;
generating, via a second classifier and based on the determining of the derived subset, a second probability indicating that, given that the feature vector for the particular unlabeled network session includes the additional session feature, the feature vector for the particular unlabeled network session having the additional session feature also has includes the identified session feature;
determining, based on a combination of the first probability and the second probability, a third probability indicating that the particular unlabeled network session is a human-generated network session; and
generating, based on the third probability, classification data indicating the particular unlabeled network session as the human-generated network session or as a non-human network session; and
providing the classification data to an additional computing system that is configured to, based on the classification data, perform an operation related to the particular unlabeled network session.
15. The system of claim 14 , wherein the set of network sessions includes a set of unlabeled network sessions, and wherein the received data includes session features associated with the set of unlabeled network sessions.
16. The system of claim 15 , wherein the session features associated with each particular network session included in the set of unlabeled network sessions are represented by a respective feature vector.
17. The system of claim 16 , further configured for:
classifying, by the first classifier, each particular network session based on a first comparison of the respective feature vector with one or more additional feature vectors associated with the labeled subset, and
classifying, by the second classifier, each particular network session based on a second comparison of the respective feature vector with one or more additional feature vectors associated with the derived subset.
18. The system of claim 14 , wherein the identified session feature associated with human-generated network traffic comprises a network interaction indicating a purchase via the network application.
19. The system of claim 14 , wherein the data describing the set of network sessions describes one or more historical sessions.
20. The system of claim 14 , wherein providing the classification data to the additional computing system includes providing, to the network application, the classification data.