System and method for bot detection
A method, a system, and an article are provided for detecting bot users of a software application. An example method can include: providing a client application to a plurality of users; obtaining device-based data and application-based data for each user, the device-based data including a description of at least one computer component used to run the client application, the application-based data including a history of user interactions with the client application; aggregating the data to obtain a plurality of bot signals for each user; analyzing the bot signals to detect a bot among the plurality of users; and preventing the bot from accessing the client application.
1. A method, comprising:
providing a client application to a plurality of users;
obtaining device-based data and application-based data for each user, the device-based data comprising a description of at least one computer component used to run the client application, the application-based data comprising a history of user interactions with the client application;
aggregating the data to obtain a plurality of bot signals for each user;
analyzing the bot signals to detect a bot among the plurality of users; and
preventing the bot from accessing the client application.
2. The method of claim 1 , wherein the client application comprises a multiplayer online game.
3. The method of claim 1 , wherein the at least one computer component comprises at least one of client device hardware or client device software.
4. The method of claim 1 , wherein analyzing the bot signals comprises:
determining that a user is a bot based on an incompatible combination of a client device model and an operating system version.
5. The method of claim 1 , wherein analyzing the bot signals comprises:
determining that a user is a bot based on (i) a number of distinct geographical login locations used by the user or (ii) a number of distinct Internet Protocol addresses used by the user.
6. The method of claim 1 , wherein analyzing the bot signals comprises:
determining that a user is a bot based on a repeating pattern of activity in the user's history of user interactions with the client application.
7. The method of claim 1 , wherein analyzing the bot signals comprises:
determining that a user is a bot based on a lack of social interactions with other users in the client application.
8. The method of claim 1 , wherein analyzing the bot signals comprises:
determining that a user is a bot when a client device for the user is associated with an anomalous pattern of calls to an application programming interface for the client application.
9. The method of claim 1 , wherein analyzing the bot signals comprises:
determining that a user is a bot based on a similarity between one of the user's signals and a corresponding signal for a different user.
10. The method of claim 1 , wherein analyzing the bot signals comprises:
using a sigmoid function to calculate a confidence score comprising an indication that at least one user is a bot.
11. A system, comprising:
one or more computer processors programmed to perform operations comprising:
providing a client application to a plurality of users;
obtaining device-based data and application-based data for each user, the device-based data comprising a description of at least one computer component used to run the client application, the application-based data comprising a history of user interactions with the client application;
aggregating the data to obtain a plurality of bot signals for each user;
analyzing the bot signals to detect a bot among the plurality of users; and
preventing the bot from accessing the client application.
12. The system of claim 11 , wherein the client application comprises a multiplayer online game.
13. The system of claim 11 , wherein the at least one computer component comprises at least one of client device hardware or client device software.
14. The system of claim 11 , wherein analyzing the bot signals comprises:
determining that a user is a bot based on an incompatible combination of a client device model and an operating system version.
15. The system of claim 11 , wherein analyzing the bot signals comprises:
determining that a user is a bot based on (i) a number of distinct geographical login locations used by the user or (ii) a number of distinct Internet Protocol addresses used by the user.
16. The system of claim 11 , wherein analyzing the bot signals comprises:
determining that a user is a bot based on a repeating pattern of activity in the user's history of user interactions with the client application.
17. The system of claim 11 , wherein analyzing the bot signals comprises:
determining that a user is a bot based on a lack of social interactions with other users in the client application.
18. The system of claim 11 , wherein analyzing the bot signals comprises:
determining that a user is a bot when a client device for the user is associated with an anomalous pattern of calls to an application programming interface for the client application.
19. The system of claim 11 , wherein analyzing the bot signals comprises:
determining that a user is a bot based on a similarity between one of the user's signals and a corresponding signal for a different user.
20. An article, comprising:
a non-transitory computer-readable medium having instructions stored thereon that, when executed by one or more computer processors, cause the computer processors to perform operations comprising:
providing a client application to a plurality of users;
obtaining device-based data and application-based data for each user, the device-based data comprising a description of at least one computer component used to run the client application, the application-based data comprising a history of user interactions with the client application;
aggregating the data to obtain a plurality of bot signals for each user;
analyzing the bot signals to detect a bot among the plurality of users; and
preventing the bot from accessing the client application.