# US 2020/0396233 A1 · Bot behavior detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0396233 A1 - Document ID: US20200396233A1 - Status: Published application - Kind: A1 - Application number: 16/442,819 - Filed: 2019-06-17 - Published: 2020-12-17 - Earliest claimed: 2019-06-17 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Yang LUO; Peng CHENG; Yongqiang XIONG; Qian LI - Web page: https://patentgrep.com/patent/US20200396233A1 ## CPC - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06F 18/2431: Multiple classes - G06F 21/552: {involving long-term monitoring or reporting} - G06N 3/045: Combinations of networks - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - G06V 10/82: using neural networks - G06V 20/95: {Pattern authentication; Markers therefor; Forgery detection} - G06V 30/19173: {Classification techniques} - G06V 30/422: Technical drawings; Geographical maps - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 2221/2133: Verifying human interaction, e.g., Captcha - H04L 2463/144: Detection or countermeasures against botnets - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present concepts relate to identifying entities based on their behavior using machine learning models. Where an entity may be a bot or a human, the entity's requests sent to a website are used to generate a graph. The graph may be used to create an image, such that the image reflects the entity's browsing behavior. A machine learning model, which has been trained using a first training set of images that correspond to bots and a second training set of images that correspond to humans, can determine whether the entity is a bot or a human by performing an image classification. ## Claims ### Claim 1 A system, comprising: a processor; and storage having instructions which, when executed by the processor, cause the processor to: access a web traffic log including requests sent from a client to a web server to access a web site hosted by the web server; generate an image based at least on the requests, the image including a set of spots and a set of lines depending on the requests; classify the image into a bot category or a human category using a machine learning model; and determine whether the client is a bot or a human based at least on whether the image is classified into the bot category or the human category. ### Claim 2 (depends on 1) The system of claim 1, wherein the instructions further cause the processor to: block additional requests sent from the client to the web server in response to determining that the client is a bot. ### Claim 3 (depends on 1) The system of claim 1, wherein the image is generated based at least on the requests by: generating a graph based at least on the requests; and generating the image based at least on the graph. ### Claim 4 (depends on 3) The system of claim 3, wherein: the graph comprises: a set of nodes representing the requests; and a set of edges between the set of nodes, the set of edges representing adjacent requests; the set of spots in the image represents the set of nodes in the graph; and the set of lines in the image connects the set of spots, the set of lines representing the set of edges in the graph. ### Claim 5 (depends on 1) The system of claim 1, wherein the machine learning model is trained using a training set of images generated from a first training set of requests received by the web server from known bot clients and a second training set of requests received by the web server from known human clients. ### Claim 6 (depends on 1) The system of claim 1, wherein the machine learning model includes a convolutional neural network. ### Claim 7 A computer-readable storage medium storing instructions which, when executed by a processor, cause the processor to: generate an image including spots and lines whose positions and/or sizes are based at least on a set of actions performed by an entity; and determine whether the entity is a bot or a human by inputting the image into a machine learning model. ### Claim 8 (depends on 7) The computer-readable storage medium of claim 7, wherein the set of actions includes one or more browsing requests submitted by a browser of the entity to a website. ### Claim 9 (depends on 7) The computer-readable storage medium of claim 7, wherein the machine learning model uses a convolutional neural network to classify an input image into one of a plurality of categories. ### Claim 10 (depends on 9) The computer-readable storage medium of claim 9, wherein the instructions further cause the processor to: generate a training set of images based at least on a first set of actions performed by known bots and a second set of actions performed by known humans; and train the machine learning model, using the training set of images, to categorize an input image into a bot category or a human category. ### Claim 11 A method, comprising: receiving behavior information associated with an entity; generating an image based at least on the behavior information; classifying the image into a category among a plurality of categories; and determining a group among a plurality of groups to which the entity belongs based at least on the category to which the image is classified. ### Claim 12 (depends on 11) The method of claim 11, wherein receiving the behavior information comprises: receiving one or more browsing requests submitted by the entity to a website. ### Claim 13 (depends on 12) The method of claim 12, wherein generating the image comprises: generating a graph based at least on the behavior information; and generating the image based at least on the graph. ### Claim 14 (depends on 13) The method of claim 13, wherein generating the graph comprises: generating one or more nodes that represent the one or more browsing requests; and generating one or more edges that connect the one or more nodes, the one or more edges representing adjacent browsing requests. ### Claim 15 (depends on 14) The method of claim 14, wherein generating the image comprises: generating one or more spots that represent the one or more nodes in the graph; and generating one or more lines that represent the one or more edges in the graph. ### Claim 16 (depends on 15) The method of claim 15, wherein generating the one or more spots comprises: determining sizes of the one or more spots based at least on access frequencies associated with corresponding one or more nodes in the graph. ### Claim 17 (depends on 11) The method of claim 11, wherein classifying the image comprises: using a machine learning model that is trained using a training set of images with known categories. ### Claim 18 (depends on 17) The method of claim 17, wherein the machine learning model includes a convolutional neural network. ### Claim 19 (depends on 11) The method of claim 11, wherein the plurality of categories includes a bot category and a human category, and the plurality of groups includes a bot group and a human group. ### Claim 20 (depends on 19) The method of claim 19, further comprising: generating an alert in response to determining that the entity belongs to the bot group.