Techniques for input classification and response using generative neural networks
Disclosed herein are techniques for detecting invalid web traffic. A method described herein involves obtaining an input sequence. The method further includes inputting the input sequence to an encoder model configured to generate an embedding from the input sequence. The method includes generating, as an output of the encoder model, an embedding. The method includes inputting the embedding to a classifier model configured to predict a vector of probability values corresponding to a plurality of classes using the embedding. A first class of the plurality of classes may be attributed to variable traffic and a second class of the plurality of classes may be attributed to repetitive traffic. The method includes predicting, as an output of the classifier, the vector of probability values. The method includes determining a machine-actor score from the vector of probability values. The method also includes outputting the machine-actor score.
1 . A method of detecting automated web traffic, the method comprising:
obtaining interaction data generated as part of a plurality of historical interactions with a plurality of graphical user interface elements to cause a computer application to provide one or more services as a result of application interaction during a plurality of user sessions with the computer application;
formatting the interaction data into a plurality of formatted sequences comprising bounded sequences of interaction events over time that can be processed by a neural network;
generating and storing a plurality of clusters of embeddings comprising embeddings of the plurality of formatted sequences with the plurality of graphical user interface elements during the plurality of user sessions with the computer application;
for each cluster of the plurality of clusters of embeddings, determining a density of embedding values within the cluster; wherein a particular cluster has a particular density of embedding values that is higher than one or more other clusters of the plurality of clusters;
obtaining particular interaction data generated as part of a particular interaction with a particular graphical user interface element to cause the computer application to provide one or more services as a result of application interaction during a particular user session with the computer application;
formatting the particular interaction data into a particular formatted sequence comprising a particular bounded sequence of interaction events over time that can be processed by a neural network;
inputting the particular formatted sequence to an encoder model to generate a particular embedding;
inputting the particular embedding to a classifier model to assign the particular embedding to the particular cluster of the plurality of clusters of embeddings;
based at least in part on the particular density of the particular cluster, determining a machine-actor score for the particular interaction, wherein the machine-actor score corresponds to a prediction that the particular interaction is invalid was machine-generated; and
storing the machine-actor score in association with the particular user session; and
based at least in part on the machine-actor score, outputting information indicating the particular user session is flagged as having machine-generated input.
2 . The method of claim 1 , wherein the encoder model is trained as part of an autoencoder comprising the encoder model and a decoder model, and wherein the encoder model comprises a recurrent neural network comprising a plurality of gradient recurrent unit cells or long short term memory cells.
3 . The method of claim 2 , wherein the autoencoder is a variational autoencoder configured to learn to output embeddings by sampling from a Gaussian probability distribution, parameters of which are learned and outputted by the encoder model.
4 . The method of claim 1 , wherein the encoder model is a deep learning transformer model comprising a transformer encoder and a transformer decoder, the transformer encoder configured to transform the formatted sequences into a sequence of intermediate outputs and the transformer decoder configured to decode the intermediate outputs into an output sequence of embeddings.
5 . The method of claim 1 , wherein the generating and storing the plurality of clusters comprises using a clustering model separate from the classifier model, the method further comprising:
training the classifier model to learn embedding cluster membership probabilities using the embeddings as input features and their corresponding cluster labels from the clustering as labels, to form a trained classifier model;
wherein inputting the particular embedding to a classifier model comprises inputting the particular embedding into the trained classifier model.
6 . The method of claim 1 , wherein determining the machine-actor score comprises:
identifying a first value of a vector of probability values attributable to a first class;
identifying a second value of the vector of probability values attributable to a second class, the second value being a largest value of the vector of probability values other than the first value; and
predicting the machine-actor score based at least in part on the second value.
7 . The method of claim 6 , wherein identifying the first value comprises:
evaluating a plurality of variance values for a plurality of clusters generated by the classifier model; and
attributing a cluster having a largest variance value of the plurality of variance values to the first class.
8 . The method of claim 1 , further comprising:
generating a visualization of interaction inputs in embedding space as a two-dimensional projection or a three-dimensional projection with annotations; and
causing display of the visualization on a user interface that includes options for monitoring and acting upon flagged user sessions.
9 . The method of claim 1 , wherein the bounded sequence of interaction events comprises a sequence of positional and time deltas generated by differences in positional and temporal elements of an input, respectively, over a period of time.
10 . The method of claim 9 , wherein the bounded sequence further comprises mouse click data corresponding to a sequence of mouse clicks over the period of time.
11 . The method of claim 1 , wherein a first class of a plurality of classes is attributed to human traffic and a second class of the plurality of classes is attributed to bot traffic.
12 . The method of claim 1 , wherein a collection period for the obtaining the particular interaction data is ongoing during the particular user session; wherein each of the plurality of historical interactions with the plurality of graphical user interface elements comprise interactions with a first graphical user interface element and one or more additional graphical user interface elements of the computer application, and wherein the particular interaction with the particular graphical user interface element comprises an interaction with the particular graphical user interface element and one or more additional graphical user interface elements of the computer application.
13 . An automated web traffic detection system, comprising:
one or more processors;
a non-transitory memory storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
obtaining interaction data generated as part of a plurality of historical interactions with a plurality of graphical user interface elements to cause a computer application to provide one or more services as a result of application interaction during a plurality of user sessions with the computer application;
formatting the interaction data into a plurality of formatted sequences comprising bounded sequences of interaction events over time that can be processed by a neural network;
generating and storing a plurality of clusters of embeddings comprising embeddings of the plurality of formatted sequences with the plurality of graphical user interface elements during the plurality of user sessions with the computer application;
for each cluster of the plurality of clusters of embeddings, determining a density of embedding values within the cluster; wherein a particular cluster has a particular density of embedding values that is higher than one or more other clusters of the plurality of clusters;
obtaining particular interaction data generated as part of a particular interaction with a particular graphical user interface element to cause the computer application to provide one or more services as a result of application interaction during a particular user session with the computer application;
formatting the particular interaction data into a particular formatted sequence comprising a particular bounded sequence of interaction events over time that can be processed by a neural network;
inputting the particular formatted sequence to an encoder model configured to generate a particular embedding;
generating, as an output of the encoder model, the particular embedding;
inputting the particular embedding to a classifier model configured to assign the particular embedding to the particular cluster of the plurality of clusters of embeddings;
based at least in part on the particular density of the particular cluster, determining a machine-actor score for the particular interaction, wherein the machine-actor score corresponds to a prediction that the particular interaction was machine-generated; and
storing the machine-actor score in association with the particular user session; and
based at least in part on the machine-actor score, outputting information indicating the particular user session is flagged as having machine-generated input.
14 . The system of claim 13 , wherein the encoder model is trained as part of an autoencoder comprising the encoder model and a decoder model, and wherein the encoder model comprises a recurrent neural network comprising a plurality of gradient recurrent unit cells or long short term memory cells.
15 . The system of claim 13 , wherein the generating and storing the plurality of clusters comprises using a clustering model separate from the classifier model, the operations further comprising:
training the classifier model using plurality of clusters of embeddings to form a trained classifier model;
wherein inputting the embedding to a classifier model comprises inputting the particular embedding into the trained classifier model.
16 . The system of claim 13 , wherein determining the machine-actor score comprises:
identifying a first value of a vector of probability values attributable to a first class;
identifying a second value of the vector of probability values attributable to a second class, the second value being a largest value of the vector of probability values other than the first value; and
predicting the machine-actor score based at least in part on the second value.
17 . The system of claim 16 , wherein identifying the first value comprises:
evaluating a plurality of variance values for a plurality of clusters generated by the classifier model; and
attributing a cluster having a largest variance value of the plurality of variance values to a first class of a plurality of classes.
18 . The system of claim 13 , wherein the computer-executable instructions, when executed by the one or more processors, further cause the one or more processors to perform operations comprising:
generating a visualization of interaction inputs in embedding space as a two-dimensional projection or a three-dimensional projection with annotations; and
causing display of the visualization on a user interface that includes options for monitoring and acting upon flagged user sessions.
19 . The system of claim 13 , wherein the bounded sequence of interaction events comprises a sequence of positional and time deltas generated by differences in positional elements of an input over a period of time.
20 . The system of claim 13 , wherein a collection period for the obtaining the particular interaction data is ongoing during the particular user session; wherein each of the plurality of historical interactions with the plurality of graphical user interface elements comprise interactions with a first graphical user interface element and one or more additional graphical user interface elements of the computer application, and wherein the particular interaction with the particular graphical user interface element comprises an interaction with the particular graphical user interface element and one or more additional graphical user interface elements of the computer application.
21 . A computer-program product, the computer-program product comprising a computer-readable storage medium having program instructions embodied thereon, the program instructions executable by one or more processors to cause the one or more processors to perform operations comprising:
obtaining interaction data generated as part of a plurality of historical interactions with a plurality of graphical user interface elements to cause a computer application to provide one or more services as a result of application interaction during a plurality of user sessions with the computer application;
formatting the interaction data into a plurality of formatted sequences comprising bounded sequences of interaction events over time that can be processed by a neural network;
generating and storing a plurality of clusters of embeddings comprising embeddings of the plurality of formatted sequences with the plurality of graphical user interface elements during the plurality of user sessions with the computer application;
for each cluster of the plurality of clusters of embeddings, determining a density of embedding values within the cluster; wherein a particular cluster has a particular density of embedding values that is higher than one or more other clusters of the plurality of clusters;
obtaining particular interaction data generated as part of a particular interaction with a particular graphical user interface element to cause the computer application to provide one or more services as a result of application interaction during a particular user session with the computer application;
formatting the particular interaction data into a particular formatted sequence comprising a particular bounded sequence of interaction events over time that can be processed by a neural network;
inputting the particular formatted sequence to an encoder model configured to generate a particular embedding;
generating, as an output of the encoder model, the particular embedding;
inputting the particular embedding to a classifier model configured to assign the particular embedding to the particular cluster of the plurality of clusters of embeddings;
based at least in part on the particular density of the particular cluster, determining a machine-actor score for the particular interaction, wherein the machine-actor score corresponds to a prediction that the particular interaction was machine-generated; and
storing the machine-actor score in association with the particular user session; and
based at least in part on the machine-actor score, outputting information indicating the particular user session is flagged as having machine-generated input. obtaining interaction data generated as part of a user interacting with a computer application;
formatting the interaction data as a bounded sequence of interaction events over time that can be modeled by a neural network to form formatted sequences;
inputting the formatted sequences to an encoder model configured to generate an embedding from the bounded sequence;
generating, as an output of the encoder model, an embedding;
inputting the embedding to a classifier model configured to predict a vector of probability values corresponding to a plurality of classes using the embedding;
predicting, as an output of the classifier model, the vector of probability values;
determining a machine-actor score for the interaction from the vector of probability values; and
outputting the machine-actor score.
22 . The computer-program product of claim 21 , wherein a collection period for the obtaining the particular interaction data is ongoing during the particular user session; wherein each of the plurality of historical interactions with the plurality of graphical user interface elements comprise interactions with a first graphical user interface element and one or more additional graphical user interface elements of the computer application, and wherein the particular interaction with the particular graphical user interface element comprises an interaction with the particular graphical user interface element and one or more additional graphical user interface elements of the computer application.