Web bot detection via behavioral analysis and machine learning

Patent metadata

Field	Value
Publication number	US-12430254-B2
Application number	US-202318220440-A
Country	US
Kind code	B2
Filing date	Jul 11, 2023
Priority date	Jul 11, 2023
Publication date	Sep 30, 2025
Grant date	Sep 30, 2025

Abstract

Techniques for web bot detection using behavioral analysis and machine learning are disclosed. In an example method, a processing device receives an indication of a network interaction by a client agent, from which behaviors of the client agent can be determined. A heuristics module may classify the client agent as in an unknown class based on the behaviors of the client agent. A trained adversarial neural network may also classify the client agent as in the unknown class. The processing device then generates a graph representation of the network interaction. A trained graph convolutional neural network may classify the client agent as in a bot class using the graph representation. Based on the classification of the client agent as a bot, the processing device executes a command to cause a bot countermeasure and generates a notification including information about the behaviors of the client agent.

First claim

The invention claimed is:

1. A method comprising:
receiving a first indication of a first network interaction by a client agent, wherein the client agent includes one or more characteristics;
determining, based on the first network interaction, one or more behaviors of the client agent;
making a first determination, by a heuristics module, based a first classification of the client agent, that the client agent is in an unknown class, wherein the first classification is based on the one or more characteristics of the client agent and the one or more behaviors of the client agent;
making a second determination, by a trained adversarial neural network, based on a second classification of the client agent, that the client agent in the unknown class;
generating a graph representation of the first network interaction;
based on the first classification and the second classification of the client agent as in the unknown class, determining, by a trained graph convolutional neural network, based on a third classification of the client agent, that the client agent is in a bot class, wherein the third classification is performed using the graph representation of the first network interaction;
based on the third classification of the client agent as in the bot class, executing a command to cause a bot countermeasure; and
generating a notification comprising information about the one or more characteristics of the client agent and the one or more behaviors of the client agent.

2. The method of claim 1 , wherein the trained adversarial neural network is a trained semi-supervised generative adversarial network (SGAN), comprising at least a generator, a discriminator, and a classifier.

3. The method of claim 2 , wherein training the classifier of the SGAN comprises:
accessing a dataset comprising a plurality of network interactions by a plurality of client agents;
processing the dataset, by, for each of the network interactions in the plurality of network interactions:
applying a heuristics-based filter to the network interaction; and
based on the heuristics-based filtering, applying a label to the network interaction;

generating, by the classifier, a fourth classification for each network interaction in a training portion of the dataset, wherein the fourth classification classifies each of the network interactions into at least one of a set of classes including human, bot, or unknown; and
based on a first accuracy of the fourth classification, updating a configuration of one or more components of the classifier.

4. The method of claim 3 , wherein training the discriminator of the SGAN comprises:
generating, by the discriminator, a first likelihood associated with each of the network interactions in the training portion of the dataset;
based on a second accuracy of the first likelihood, updating the configuration of one or more components of the discriminator;
generating, by the generator, first generated training data, the first generated training data including one or more network interactions;
generating, by the discriminator, a second likelihood associated with each of the network interactions in the first generated training data; and
based on a third accuracy of the second likelihood, updating the configuration of the one or more components of the discriminator.

5. The method of claim 4 , wherein training the generator of the SGAN comprises:
generating, by the generator, second generated training data, the second generated training data including one or more of the network interactions;
generating, by the discriminator, a third likelihood associated with each of the network interactions in the second generated training data; and
based on a fourth accuracy of the third likelihood, updating the configuration of the one or more components of the discriminator or a configuration of one or more components of the generator.

6. The method of claim 1 , wherein the trained graph convolutional neural network is a trained deep graph convolutional network (DGCNN).

7. The method of claim 6 , wherein the trained DGCNN includes at least a graph convolution layer, a sort pooling layer, and one-dimensional convolutional neural network.

8. The method of claim 7 , wherein training the trained DGCNN comprises:
accessing a dataset comprising a plurality of network interactions by a plurality of client agents;
processing the dataset, by, for each of the network interactions in the plurality of network interactions:
applying a heuristics-based filter to the network interaction; and
based on the heuristics-based filtering, applying a label to the network interaction;

generating one or more graph representations of the plurality of network interactions in the dataset;
generating, by the one-dimensional convolutional neural network, a fourth classification for each network interaction in a training portion of the dataset, wherein the fourth classification classifies each of the network interactions into at least one of a set of classes including human, bot, or unknown; and
based on an accuracy of the fourth classification, updating a configuration of one or more components of the DGCNN.

9. The method of claim 1 , wherein the graph representation is a website traversal graph.

10. The method of claim 9 , wherein the website traversal graph includes one or more nodes, wherein each node:
corresponds to a webpage visited by the client agent;
includes information about the webpage visited by the client agent; and
includes a feature vector, the feature vector encoding at least one or more behaviors of the client agent and the information about the webpage visited by the client agent.

11. The method of claim 1 , wherein the bot countermeasure includes at least one of:
restricting a network access of the client agent;
presenting a verification challenge to the client agent;
logging the one or more behaviors of the client agent; or
modifying a property of a network.

12. A system comprising, comprising:
a processing device; and
a memory device that includes instructions executable by the processing device for causing the processing device to perform operations comprising:
receiving a first indication of a first network interaction by a client agent, wherein the client agent includes one or more characteristics;
receiving a second indication of a second network interaction by the client agent;
determining, based on the first network interaction and the second network interaction, one or more behaviors of the client agent;
making a first determination, based a first classification of the client agent, that the client agent is in an unknown class, wherein the first classification is based on the one or more characteristics of the client agent and the one or more behaviors of the client agent;
making a second determination, based on a second classification of the client agent, that the client agent in the unknown class, wherein the second classification is performed using a trained adversarial neural network;
generating a graph representation of the first network interaction and the second network interaction;
based on the first classification and the second classification of the client agent as in the unknown class, determining, based on a third classification of the client agent, that the client agent is in a bot class, wherein the third classification is performed using the graph representation of the first network interaction and the second network interaction and a trained graph convolutional neural network;
based on the third classification of the client agent as in the bot class, executing a command to cause a bot countermeasure; and
generating a notific

Assignees

• Adobe Inc

Inventors

• Kadel Jan
• Sinha Ritwik

Classifications

• G06N3/08

  Learning methods · CPC title

• G06Q40/06

  Asset management; Financial planning or analysis · CPC title

• G06F16/355

  Creation or modification of classes or clusters · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title