System and method for bot detection

Abstract

A method, a system, and an article are provided for detecting bot users of a software application. An example method can include: providing a client application to a plurality of users; obtaining device-based data and application-based data for each user, the device-based data including a description of at least one computer component used to run the client application, the application-based data including a history of user interactions with the client application; aggregating the data to obtain a plurality of bot signals for each user; analyzing the bot signals to detect a bot among the plurality of users; and preventing the bot from accessing the client application.

What is claimed is: 
     
         1 . A method, comprising:
 obtaining at least one of device-based data or application-based data for each user of a plurality of users of a client application,
 wherein the device-based data comprises a description of at least one computer component used to run the client application, and 
 wherein the application-based data comprises a history of user interactions with the client application; 
   aggregating the data to obtain a plurality of signals for each user;   analyzing the signals to identify at least one bot among the plurality of users; and   removing one or more identified bots from the client application.   
     
     
         2 . The method of  claim 1 , comprising:
 providing the client application to the plurality of users.   
     
     
         3 . The method of  claim 1 , wherein the client application comprises an online computer game. 
     
     
         4 . The method of  claim 1 , wherein aggregating the data comprises:
 segmenting the plurality of users into cohorts,
 wherein users in each cohort share one or more characteristics. 
   
     
     
         5 . The method of  claim 4 , wherein analyzing the signals comprises:
 comparing signals of users in a cohort; and   determining that a user is a bot based on signals associated with the user in the cohort deviating from signals associated with other users in the cohort.   
     
     
         6 . The method of  claim 1 , wherein analyzing the signals comprises:
 generating a bot score for each user based on a combination of the plurality of signals for each user.   
     
     
         7 . The method of  claim 1 , wherein analyzing the signals comprises:
 determining that a user is a bot based on a repeating pattern of activity in the user's history of user interactions with the client application.   
     
     
         8 . The method of  claim 1 , wherein analyzing the signals comprises:
 determining that a user is a bot based on a similarity between one of the user's signals and a corresponding signal for a known bot.   
     
     
         9 . The method of  claim 1 , wherein analyzing the signals comprises:
 using a sigmoid function to calculate a confidence score comprising an indication that at least one user is a bot.   
     
     
         10 . The method of  claim 1 , wherein analyzing the signals comprises:
 determining that a user is a bot based on an incompatible combination of a client device model and an operating system version.   
     
     
         11 . A system, comprising:
 one or more computer processors programmed to perform operations to:
 obtain at least one of device-based data or application-based data for each user of a plurality of users of a client application,
 wherein the device-based data comprises a description of at least one computer component used to run the client application, and 
 wherein the application-based data comprises a history of user interactions with the client application; 
 
 aggregate the data to obtain a plurality of signals for each user; 
 analyze the signals to identify at least one bot among the plurality of users; and 
 remove one or more identified bots from the client application. 
   
     
     
         12 . The system of  claim 11 , wherein the operations are further to:
 provide the client application to the plurality of users.   
     
     
         13 . The system of  claim 11 , wherein the client application comprises an online computer game. 
     
     
         14 . The system of  claim 11 , wherein to aggregate the data the one or more computer processors are further programmed to:
 segment the plurality of users into cohorts,
 wherein users in each cohort share one or more characteristics. 
   
     
     
         15 . The system of  claim 14 , wherein to analyze the signals the one or more computer processors are further programmed to:
 compare signals of users in a cohort; and   determine that a user is a bot based on signals associated with the user in the cohort deviating from signals associated with other users in the cohort.   
     
     
         16 . The system of  claim 11 , wherein to analyze the signals the one or more computer processors are further programmed to:
 generate a bot score for each user based on a combination of the plurality of signals for each user.   
     
     
         17 . The system of  claim 11 , wherein to analyze the signals the one or more computer processors are further programmed to:
 determine that a user is a bot based on a repeating pattern of activity in the user's history of user interactions with the client application.   
     
     
         18 . The system of  claim 11 , wherein to analyze the signals the one or more computer processors are further programmed to:
 determine that a user is a bot based on a similarity between one of the user's signals and a corresponding signal for a known bot.   
     
     
         19 . The system of  claim 11 , wherein to analyze the signals the one or more computer processors are further programmed to:
 use a sigmoid function to calculate a confidence score comprising an indication that at least one user is a bot.   
     
     
         20 . A non-transitory computer-readable medium having instructions stored thereon that, when executed by one or more computer processors, cause the one or more computer processors to:
 obtain at least one of device-based data or application-based data for each user of a plurality of users of a client application,
 wherein the device-based data comprises a description of at least one computer component used to run the client application, and 
 wherein the application-based data comprises a history of user interactions with the client application; 
   aggregate the data to obtain a plurality of signals for each user;   analyze the signals to identify at least one bot among the plurality of users; and   remove one or more identified bots from the client application.