Detecting robotic internet activity across domains utilizing one-class and domain adaptation machine-learning models
Methods, systems, and non-transitory computer readable storage media are disclosed for detecting robotic activity while monitoring Internet traffic across a plurality of domains. For example, the disclosed system identifies network session data for each domain of a plurality of domains, the network session data including network sessions comprising features that indicate human activity. In one or more embodiments, the disclosed system generates a classifier to output a probability that a network session at a domain includes human activity. In one or more embodiments, the disclosed system also generates a classifier to output a probability that a network session includes good robotic activity. Additionally, the disclosed system generates a domain-agnostic machine-learning model by combining models from a plurality of domains with network sessions including human activity.
1. A non-transitory computer readable storage medium comprising instructions that, when executed by at least one processor, cause a computer system to:
access a plurality of machine-learning models for a plurality of domains, a machine-learning model of the plurality of machine-learning models trained to output a probability that a given network session at the domain corresponds to human activity given a set of features for the given network session; and
generate a domain-agnostic machine-learning model by combining the plurality of machine-learning models for the plurality of domains, wherein the domain-agnostic machine-learning model, given a set of features for a network session irrespective of a domain, determines whether the network session corresponds to human activity or robotic activity.
2. The non-transitory computer readable storage medium as recited in claim 1 , wherein the instructions that cause the computer system to generate the domain-agnostic machine-learning model further cause the computer system to use domain adaptation to combine the plurality of machine-learning models for the plurality of domains.
3. The non-transitory computer readable storage medium as recited in claim 1 , wherein the features that indicate human activity comprise indications of login sessions with multi-factor authentication requirements.
4. The non-transitory computer readable storage medium as recited in claim 1 , wherein a plurality of network sessions comprises product purchases at the plurality of domains.
5. The non-transitory computer readable storage medium as recited in claim 1 , further comprising instructions that, when executed by the at least one processor, cause the computer system to:
determine that an amount of network session traffic at a webpage of a website meets a predetermined threshold amount of robotic activity; and
modify, in response to determining that the amount of network session traffic meets the predetermined threshold, a session connection of the webpage to verify human activity.
6. The non-transitory computer readable storage medium as recited in claim 1 , further comprising instructions that, when executed by the at least one processor, cause the computer system to:
analyze, using the domain-agnostic machine-learning model, a plurality of new network sessions to determine a first subset of new network sessions corresponding to human activity and a second subset of new network sessions corresponding to robotic activity;
analyze the second subset of new network sessions to determine whether the new network sessions include good robotic activity or bad robotic activity; and
generate an analytics report including the first subset of new network sessions and excluding the second subset of new network sessions.
7. The non-transitory computer readable storage medium as recited in claim 1 , wherein the instructions that cause the computer system to access a plurality of machine-learning models for a plurality of domains cause the computer system to train the machine-learning model of the plurality of machine-learning models using network session data for the domain, the network session data for the domain comprising a plurality of network sessions including features that indicate human activity.
8. The non-transitory computer readable storage medium as recited in claim 1 , further comprising instructions that, when executed by the at least one processor, cause the computer system to:
identify a new network session at a domain not in the plurality of domains;
determine a plurality of features of the new network session; and
determine, by inputting the plurality of features of the new network session to the domain-agnostic machine-learning model, that the new network session corresponds to human activity.
9. The non-transitory computer readable storage medium as recited in claim 8 , wherein the instructions that cause the computer system to determine that the new network session at the domain not in the plurality of domains corresponds to human activity further cause the computer system to:
generate, for the new network session and based on the plurality of features of the new network session, a humanness score indicating a probability of the new network session corresponding to human activity; and
determine that the new network session corresponds to human activity in response to determining that the humanness score meets a threshold.
10. The non-transitory computer readable storage medium as recited in claim 8 , wherein the domain not in the plurality of domains uses login requirements that do not verify human activity.