# US 2019/0356684 A1 · Detecting robotic internet activity across domains utilizing one-class and domain adaptation machine-learning models > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0356684 A1 - Document ID: US20190356684A1 - Status: Published application - Kind: A1 - Application number: 15/982,393 - Filed: 2018-05-17 - Published: 2019-11-21 - Earliest claimed: 2018-05-17 - Assignees: Adobe Inc. - Applicants: Adobe Inc. - Inventors: Ritwik Sinha; Vishwa Vinay; Sunny Dhamnani; Margarita Savova; Lilly Kumari; David Weinstein - Web page: https://patentgrep.com/patent/US20190356684A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 41/16: using machine learning or artificial intelligence - H04L 43/16: Threshold monitoring - H04L 63/1458: {Denial of Service} - H04L 43/0817: by checking functioning - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and non-transitory computer readable storage media are disclosed for detecting robotic activity while monitoring Internet traffic across a plurality of domains. For example, the disclosed system identifies network session data for each domain of a plurality of domains, the network session data including network sessions comprising features that indicate human activity. In one or more embodiments, the disclosed system generates a classifier to output a probability that a network session at a domain includes human activity. In one or more embodiments, the disclosed system also generates a classifier to output a probability that a network session includes good robotic activity. Additionally, the disclosed system generates a domain-agnostic machine-learning model by combining models from a plurality of domains with network sessions including human activity. ## Claims ### Claim 1 A non-transitory computer readable storage medium comprising instructions that, when executed by at least one processor, cause a computer system to: access a plurality of machine-learning models for a plurality of domains, a machine-learning model of the plurality of machine-learning models trained to output a probability that a given network session at the domain corresponds to human activity given a set of features for the given network session; and generate a domain-agnostic machine-learning model by combining the plurality of machine-learning models for the plurality of domains, wherein the domain-agnostic machine-learning model, given a set of features for a network session irrespective of a domain, determines whether the network session corresponds to human activity or robotic activity. ### Claim 2 (depends on 1) The non-transitory computer readable storage medium as recited in claim 1, further comprising instructions that, when executed by the at least one processor, cause the computer system to: identify a new network session at a domain not in the plurality of domains; determine a plurality of features of the new network session; and determine, by inputting the plurality of features of the new network session to the domain-agnostic machine-learning model, that the new network session corresponds to human activity. ### Claim 3 (depends on 2) The non-transitory computer readable storage medium as recited in claim 2, wherein the instructions that cause the computer system to determine that the new network session at the domain not in the plurality of domains corresponds to human activity further cause the computer system to: generate, for the new network session and based on the plurality of features of the new network session, a humanness score indicating a probability of the new network session corresponding to human activity; and determine that the new network session corresponds to human activity in response to determining that the humanness score meets a threshold. ### Claim 4 (depends on 2) The non-transitory computer readable storage medium as recited in claim 2, wherein the domain not in the plurality of domains uses login requirements that do not verify human activity. ### Claim 5 (depends on 1) The non-transitory computer readable storage medium as recited in claim 1, wherein the instructions that cause the computer system to generate the domain-agnostic machine-learning model further cause the computer system to use domain adaptation to combine the plurality of machine-learning models for the plurality of domains. ### Claim 6 (depends on 1) The non-transitory computer readable storage medium as recited in claim 1, wherein the features that indicate human activity comprise indications of login sessions with multi-factor authentication requirements. ### Claim 7 (depends on 1) The non-transitory computer readable storage medium as recited in claim 1, wherein the plurality of network sessions comprises product purchases at the plurality of domains. ### Claim 8 (depends on 1) The non-transitory computer readable storage medium as recited in claim 1, further comprising instructions that, when executed by the at least one processor, cause the computer system to: determine that an amount of network session traffic at a webpage of a website meets a predetermined threshold amount of robotic activity; and modify, in response to determining that the amount of network session traffic meets the predetermined threshold, a session connection of the webpage to verify human activity. ### Claim 9 (depends on 1) The non-transitory computer readable storage medium as recited in claim 1, further comprising instructions that, when executed by the at least one processor, cause the computer system to: analyze, using the domain-agnostic machine-learning model, a plurality of new network sessions to determine a first subset of new network sessions corresponding to human activity and a second subset of new network sessions corresponding to robotic activity; analyze the second subset of new network sessions to determine whether the new network sessions include good robotic activity or bad robotic activity; and generate an analytics report including the first subset of new network sessions and excluding the second subset of new network sessions. ### Claim 10 (depends on 1) The non-transitory computer readable storage medium as recited in claim 1, wherein the instructions that cause the computer system to access a plurality of machine-learning models for a plurality of domains cause the computer system to train the machine-learning model of the plurality of machine-learning models using network session data for the domain, the network session data for the domain comprising a plurality of network sessions including features that indicate human activity. ### Claim 11 In a digital medium environment for monitoring Internet traffic, a system for detecting robotic activity comprising: at least one processor; and a non-transitory computer memory comprising instructions that, when executed by the at least one processor, cause the system to: identify network session data for a domain, the network session data comprising a plurality of network sessions; identify a first subset of network sessions comprising human activity; identify a second subset of network sessions comprising good robotic activity; generate, using the first subset of network sessions, a first classifier to output a probability that a network session corresponds to human activity given a set of features for the network session; generate, using the second subset of network sessions, a second classifier to output a probability that the network session corresponds to good robotic activity given the set of features for the network session; and generate, using the first classifier and the second classifier, an activity classifier model that determines whether network sessions correspond to human activity, good robotic activity, or bad robotic activity. ### Claim 12 (depends on 11) The system as recited in claim 11, further comprising instructions that, when executed by the at least one processor, cause the system to: identify a new network session; determine a plurality of features of the new network session; and determine, using the activity classifier model, whether the new network session corresponds to human activity, good robotic activity, or bad robotic activity given a set of features for the new network session. ### Claim 13 (depends on 11) The system as recited in claim 11, wherein the instructions that cause the system to generate the first classifier further cause the system to generate the first classifier to output the probability that the network session corresponds to good robotic activity based on whether the network session corresponds to an interaction comprising a purchase via the domain or a two-factor authentication session at the domain. ### Claim 14 (depends on 11) The system as recited in claim 11, wherein the instructions that cause the system to generate the second classifier further cause the system to generate the second classifier to output the probability that the network session at the domain corresponds to good robotic activity based on a session length of the network session. ### Claim 15 (depends on 14) The system as recited in claim 14, further comprising instructions that, when executed by the at least one processor, cause the system to determine a threshold session length as a value corresponding to a third quartile value in a distribution of session lengths of historical good robotic activity for the domain. ### Claim 16 (depends on 11) The system as recited in claim 11, further comprising instructions that, when executed by the at least one processor, cause the system to: identify a new network session at the domain; apply the first classifier and the second classifier of the activity classifier model to the new network session; and determine that the new network session corresponds to human activity, good robotic activity, or bad robotic activity based on an output of the first classifier and an output of the second classifier. ### Claim 17 In a digital medium environment for monitoring Internet traffic, a computer-implemented method of detecting robotic activity comprising: identifying network session data for each domain of a plurality of domains, the network session data comprising a plurality of network sessions with a first subset of network sessions comprising human activity and a second subset of network sessions comprising good robotic activity; a step for generating, for each domain of the plurality of domains, an activity classifier model that determines whether network sessions at a domain of the plurality of domains correspond to human activity, good robotic activity, or bad robotic activity using a first classifier corresponding to human activity and a second classifier corresponding to good robotic activity; and a step for generating, using a plurality of activity classifier models for the plurality of domains, a domain-agnostic machine-learning model for determining whether network sessions correspond to human activity or robotic activity irrespective of a domain of the network sessions. ### Claim 18 (depends on 17) The computer-implemented method as recited in claim 17, further comprising: identifying a new network session at a domain not in the plurality of domains; determining a plurality of features of the new network session; and determining, by inputting the plurality of features of the new network session to the domain-agnostic machine-learning model, whether the new network session at the domain not in the plurality of domains corresponds to human activity, good robotic activity, or bad robotic activity. ### Claim 19 (depends on 18) The computer-implemented method as recited in claim 18, further comprising: analyzing, using the domain-agnostic machine-learning model, a plurality of new network sessions for the domain not in the plurality of domains to determine a first subset of new network sessions corresponding to human activity and a second subset of new network sessions corresponding to robotic activity; and generating an analytics report including the first subset of new network sessions and excluding the second subset of new network sessions. ### Claim 20 (depends on 19) The computer-implemented method as recited in claim 19, further comprising: determining that an amount of network session traffic at a webpage of a website corresponding to the domain not in the plurality of domains meets a predetermined threshold amount of robotic activity; and modifying, in response to determining that the amount of network session traffic meets the predetermined threshold, a session connection of the webpage to verify human activity.