SYSTEM AND METHOD FOR BOT DETECTION
A method, a system, and an article are provided for detecting bot users of a software application. An example method can include: providing a client application to a plurality of users; obtaining device-based data and application-based data for each user, the device-based data including a description of at least one computer component used to run the client application, the application-based data including a history of user interactions with the client application; aggregating the data to obtain a plurality of bot signals for each user; analyzing the bot signals to detect a bot among the plurality of users; and preventing the bot from accessing the client application.
1 . A method, comprising:
obtaining at least one of device-based data or application-based data for each user of a plurality of users of a client application,
wherein the device-based data comprises a description of at least one computer component used to run the client application, and
wherein the application-based data comprises a history of user interactions with the client application;
aggregating the data to obtain a plurality of signals for each user;
analyzing the signals to identify at least one bot among the plurality of users; and
removing one or more identified bots from the client application.
2 . The method of claim 1 , comprising:
providing the client application to the plurality of users.
3 . The method of claim 1 , wherein the client application comprises an online computer game.
4 . The method of claim 1 , wherein aggregating the data comprises:
segmenting the plurality of users into cohorts,
wherein users in each cohort share one or more characteristics.
5 . The method of claim 4 , wherein analyzing the signals comprises:
comparing signals of users in a cohort; and
determining that a user is a bot based on signals associated with the user in the cohort deviating from signals associated with other users in the cohort.
6 . The method of claim 1 , wherein analyzing the signals comprises:
generating a bot score for each user based on a combination of the plurality of signals for each user.
7 . The method of claim 1 , wherein analyzing the signals comprises:
determining that a user is a bot based on a repeating pattern of activity in the user's history of user interactions with the client application.
8 . The method of claim 1 , wherein analyzing the signals comprises:
determining that a user is a bot based on a similarity between one of the user's signals and a corresponding signal for a known bot.
9 . The method of claim 1 , wherein analyzing the signals comprises:
using a sigmoid function to calculate a confidence score comprising an indication that at least one user is a bot.
10 . The method of claim 1 , wherein analyzing the signals comprises:
determining that a user is a bot based on an incompatible combination of a client device model and an operating system version.
11 . A system, comprising:
one or more computer processors programmed to perform operations to:
obtain at least one of device-based data or application-based data for each user of a plurality of users of a client application,
wherein the device-based data comprises a description of at least one computer component used to run the client application, and
wherein the application-based data comprises a history of user interactions with the client application;
aggregate the data to obtain a plurality of signals for each user;
analyze the signals to identify at least one bot among the plurality of users; and
remove one or more identified bots from the client application.
12 . The system of claim 11 , wherein the operations are further to:
provide the client application to the plurality of users.
13 . The system of claim 11 , wherein the client application comprises an online computer game.
14 . The system of claim 11 , wherein to aggregate the data the one or more computer processors are further programmed to:
segment the plurality of users into cohorts,
wherein users in each cohort share one or more characteristics.
15 . The system of claim 14 , wherein to analyze the signals the one or more computer processors are further programmed to:
compare signals of users in a cohort; and
determine that a user is a bot based on signals associated with the user in the cohort deviating from signals associated with other users in the cohort.
16 . The system of claim 11 , wherein to analyze the signals the one or more computer processors are further programmed to:
generate a bot score for each user based on a combination of the plurality of signals for each user.
17 . The system of claim 11 , wherein to analyze the signals the one or more computer processors are further programmed to:
determine that a user is a bot based on a repeating pattern of activity in the user's history of user interactions with the client application.
18 . The system of claim 11 , wherein to analyze the signals the one or more computer processors are further programmed to:
determine that a user is a bot based on a similarity between one of the user's signals and a corresponding signal for a known bot.
19 . The system of claim 11 , wherein to analyze the signals the one or more computer processors are further programmed to:
use a sigmoid function to calculate a confidence score comprising an indication that at least one user is a bot.
20 . A non-transitory computer-readable medium having instructions stored thereon that, when executed by one or more computer processors, cause the one or more computer processors to:
obtain at least one of device-based data or application-based data for each user of a plurality of users of a client application,
wherein the device-based data comprises a description of at least one computer component used to run the client application, and
wherein the application-based data comprises a history of user interactions with the client application;
aggregate the data to obtain a plurality of signals for each user;
analyze the signals to identify at least one bot among the plurality of users; and
remove one or more identified bots from the client application.