Bot activity detection for email tracking
In some embodiments, techniques for identifying email events generated by bot activity are provided. For example, a process may involve applying bot detection patterns to identify bot activity among email response events.
1. A method of processing email response events, the method comprising:
storing a sequence of email response events to a cache, wherein the cache is a least-recently-used (LRU) cache comprising a first hashmap; and
for each email response event among a plurality of the email response events of the sequence, performing a respective instance of a bot detection routine, the routine comprising:
evicting the email response event from the cache;
based on at least one of a lead identifier of the email response event or a campaign identifier of the email response event, querying the cache and a historical event cache to obtain a plurality of retrieved email response events, wherein each of the plurality of retrieved email response events has an activity type, wherein the historical event cache is an LRU cache comprising a second hashmap;
based on an activity type of the email response event and the activity types of the plurality of retrieved email response events, determining whether a bot detection rule is matched; and
storing the email response event to the historical event cache;
wherein, for each email response event of at least some of the plurality of the email response events, the determining whether a bot detection rule is matched includes storing a corresponding indication of bot activity detection for the email response event; and
wherein the method further comprises causing, based on the corresponding indications of bot activity detection, a user interface to display content relating to the plurality of the email response events of the sequence.
2. The method of claim 1 , wherein, for each of the respective instances of the bot detection routine, evicting the email response event from the cache comprises removing a LRU event from the cache, wherein the LRU event is the email response event.
3. The method of claim 1 , wherein, for each of the respective instances of the bot detection routine:
each of the plurality of retrieved email response events has a timestamp, the plurality of retrieved email response events having a plurality of timestamps, and
the determining whether a bot detection rule is matched is based on a timestamp of the email response event and the plurality of timestamps of the plurality of retrieved email response events.
4. The method of claim 1 , wherein the plurality of the email response events comprises a plurality of open events and a plurality of link-click events.
5. The method of claim 4 , wherein the sequence of email response events comprises a plurality of delivery events.
6. The method of claim 1 , wherein:
the historical event cache comprises a historical open event cache and a historical link-click event cache; and
for each of the respective instances of the bot detection routine, storing the email response event to the historical event cache comprises storing the email response event, according to the activity type of the email response event, to one among the historical open event cache or the historical link-click event cache.
7. The method of claim 6 , wherein:
the historical event cache further comprises a historical delivery event cache, and
querying the historical event cache comprises querying the historical delivery event cache, querying the historical open event cache, and querying the historical link-click event cache.
8. The method of claim 1 , wherein, for each of the respective instances of the bot detection routine, the routine further comprises, for each retrieved email response event among the plurality of retrieved email response events, returning the retrieved email response event to its respective cache as a most-recently-used entry.
9. The method of claim 1 , wherein, for each of the respective instances of the bot detection routine, determining whether a bot detection rule is matched comprises determining that timestamps of at least three click events among the email response event and the plurality of retrieved email response events are within three seconds of each other.
10. The method of claim 9 , wherein, for each of the respective instances of the bot detection routine, determining whether a bot detection rule is matched comprises determining that the email response event is a click event and that none among the plurality of retrieved email response events is an open event.
11. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
storing a sequence of email response events to a cache, wherein the cache is a least-recently-used (LRU) cache comprising a first hashmap;
for each email response event among a plurality of the email response events of the sequence, performing a respective instance of a bot detection routine, the routine comprising:
evicting the email response event from the cache;
based on at least one of a lead identifier of the email response event or a campaign identifier of the email response event, querying the cache and a historical event cache to obtain a plurality of retrieved email response events, wherein each of the plurality of retrieved email response events has an activity type, wherein the historical event cache is an LRU cache comprising a second hashmap;
based on an activity type of the email response event and the activity types of the plurality of retrieved email response events, determining whether a bot detection rule is matched; and
storing the email response event to the historical event cache; and
wherein, for each email response event of at least some of the plurality of the email response events, the determining whether a bot detection rule is matched includes storing a corresponding indication of bot activity detection for the email response event.
12. The non-transitory computer-readable medium of claim 11 , wherein the operations further comprises causing, based on the corresponding indications of bot activity detection, a user interface to display content relating to the plurality of the email response events of the sequence.
13. The non-transitory computer-readable medium of claim 11 , wherein, for each of the respective instances of the bot detection routine, evicting the email response event from the cache comprises removing an event from the cache in a first-in-first-out manner, wherein the removed event is the email response event.
14. The non-transitory computer-readable medium of claim 11 , wherein, for each of the respective instances of the bot detection routine:
each of the plurality of retrieved email response events has a timestamp, the plurality of retrieved email response events having a plurality of timestamps, and
the determining whether a bot detection rule is matched is based on a timestamp of the email response event and the plurality of timestamps of the plurality of retrieved email response events.
15. The non-transitory computer-readable medium of claim 11 , wherein:
the plurality of the email response events comprises a plurality of open events and a plurality of link-click events, and
the sequence of email response events comprises a plurality of delivery events.
16. A system comprising:
a future event cache configured to store a sequence of email response events; and
a rule-matching module configured to perform, for each email response event among a plurality of the email response events of the sequence, a respective instance of a bot detection routine, the routine comprising:
evicting the email response event from the future event cache, wherein the future event cache is a least-recently-used (LRU) cache comprising a first hashmap;
based on at least one of a lead identifier of the email response event or a campaign identifier of the email response event, querying the future event cache and a historical event cache to obtain a plurality of retrieved email response events, wherein each of the plurality of retrieved email response events has an activity type;
based on an activity type of the email response event and the activity types of the plurality of retrieved email response events, determining whether a bot detection rule is matched; and
storing the email response event to the historical event cache, wherein the historical event cache is an LRU cache comprising a second hashmap;
wherein, for each email response event of at least some of the plurality of the email response events, the determining whether a bot detection rule is matched includes storing a corresponding indication of bot activity detection for the email response event; and
wherein the system further comprises an interface-modification server configured to cause, based on the corresponding indications of bot activity detection, a user interface to display content relating to the plurality of the email response events of the sequence.
17. The system of claim 16 , wherein:
the historical event cache comprises a historical open event cache and a historical link-click event cache; and
for each of the respective instances of the bot detection routine, storing the email response event to the historical event cache comprises storing the email response event, according to the activity type of the email response event, to one among the historical open event cache or the historical link-click event cache.
18. The system of claim 17 , wherein:
the historical event cache further comprises a historical delivery event cache, and
querying the historical event cache comprises querying the historical delivery event cache, querying the historical open event cache, and querying the historical link-click event cache.
19. The system of claim 16 , wherein, for each of the respective instances of the bot detection routine, determining whether a bot detection rule is matched comprises determining that timestamps of at least three click events among the email response event and the plurality of retrieved email response events are within three seconds of each other.
20. The system of claim 19 , wherein, for each of the respective instances of the bot detection routine, determining whether a bot detection rule is matched comprises determining that the email response event is a click event and that none among the plurality of retrieved email response events is an open event.