Analysis of Novel Mouse Dynamics Dataset with Repeat Sessions: Helpful Observations for Tackling Session-Replay Bot

• Published in: 2023 IEEE 20th Consumer Communications & Networking Conference (CCNC) pp. 790 - 797
• Main Authors: Sadeghpour, Shadi, Vlajic, Natalija
• Format: Conference Proceeding
• Language: English
• Published: IEEE 08.01.2023
• Subjects: Banking; Behavioral biometrics; Biometrics (access control); Chatbots; Clustering algorithms; Convolutional neural network; Feature learning; Heuristic algorithms; Image representation; Mice; Mouse dynamics; Trajectory
• ISSN: 2331-9860
• DOI: 10.1109/CCNC51644.2023.10060083

Session-replay bots are believed to be the latest and most sophisticated generation of web-bots, that are also very difficult to defend against. Combating session-replay bots is particularly challenging in online domains that get repeatedly visited by the same genuine human user(s), and possibly in the same/similar way - such as news, banking or gaming sites. Namely, in such domains, it is difficult to determine whether two look-alike sessions are produced by the same human user or these sessions are just bot-generated session replays. Unfortunately, to date, only a handful of research studies have looked at the problem of session-replay bots, with many related questions still waiting to be addressed. The main contributions of this paper are two-fold: 1) We introduce and provide to the public a novel real-world mouse dynamics dataset named ReMouse. ReMouse dataset is collected in a guided environment and, unlike other publicly available mouse dynamics dataset, it contains repeat-sessions generated by the same human user(s). As such, ReMouse dataset is first of its kind and is of particular relevance for studies on the development of effective defenses against session-replay bots. 2) Our own analysis of ReMouse dataset using statistical and advanced ML-based methods (including deep and unsupervised neural learning) shows that not only two different human users are highly unlikely to generate same/similar looking sessions when performing the same/similar online task, but even the (repeat) sessions generated by the same human user are likely to be sufficiently distinguishable from one another.