Session-replay bots are believed to be the latest and most sophisticated generation of web-bots, that are also very difficult to defend against. Combating session-replay bots is particularly challenging in online domains that get repeatedly visited by the same genuine human user(s), and possibly in the same/similar way - such as news, banking or gaming sites. Namely, in such domains, it is difficult to determine whether two look-alike sessions are produced by the same human user or these sessions are just bot-generated session replays. Unfortunately, to date, only a handful of research studies have looked at the problem of session-replay bots, with many related questions still waiting to be addressed. The main contributions of this paper are two-fold: 1) We introduce and provide to the public a novel real-world mouse dynamics dataset named ReMouse. ReMouse dataset is collected in a guided environment and, unlike other publicly available mouse dynamics dataset, it contains repeat-sessions generated by the same human user(s). As such, ReMouse dataset is first of its kind and is of particular relevance for studies on the development of effective defenses against session-replay bots. 2) Our own analysis of ReMouse dataset using statistical and advanced ML-based methods (including deep and unsupervised neural learning) shows that not only two different human users are highly unlikely to generate same/similar looking sessions when performing the same/similar online task, but even the (repeat) sessions generated by the same human user are likely to be sufficiently distinguishable from one another.

Session-replay bots are believed to be the latest and most advanced generation of web-bots, that are also difficult challenging to defend against. Combating session-replay bots is particularly problematic in online domains that get repeatedly visited by the same genuine human user(s), and possibly in the same/similar way - such as news, banking or gaming sites. Namely, in such domains, it is difficult to determine whether two look-alike sessions are produced by the same human user or these sessions are just bot-generated session replays. In this paper we introduce and provide to the public a novel real-world mouse dynamics dataset named ReMouse. ReMouse dataset is collected in a guided environment and, unlike other publicly available mouse dynamics dataset, it contains repeat-sessions generated by the same human user(s). As such, ReMouse dataset is first of its kind and is of particular relevance for studies on the development of effective defenses against session-replay bots. Our own statistical analysis of ReMouse dataset shows that not only two different human users are highly unlikely to generate same/similar looking sessions when performing the same/similar online task, but even the (repeat) sessions generated by the same human user are likely to be sufficiently distinguishable from one another.

As Web bot technologies continue to evolve, the task of separating human Web sessions from those generated by malicious bots becomes increasingly more challenging. To date, many research studies have proposed the use of advanced ML-based methods as automated means of differentiating between Web bot and genuine human sessions. Unfortunately, most of these studies overlook the importance of adequate feature selection during the dataset preprocessing stage. Namely, instead of making the process of feature selection automated and optimized to each particular dataset, these studies generally resort to the use of the same fixed set of hand-picked Web-session attributes. It is well known, however, that suboptimal approach to feature selection is likely to result in suboptimal performance of the respective ML algorithm and, consequently, of the entire system. The main contributions of our work are as follows: First, we propose the use of Gradient Boosting Technique to automatically identify the most significant Web-session features (out of an extensive list of 119 possible attributes) for any given dataset. Second, we integrate this automated features selection technique into a system for Web-session classification based on the unsupervised Self-Organizing Map (SOM) algorithm. Third, we validate the performance of the integrated system on a recent real-world dataset which has been collected during a confirmed large-scale attack on our home institution. The obtained experimental results not only verify that our proposed system is highly effective in identifying malicious Web-sessions, but they also help us better understand the nature and scale of the conducted attack itself.