BOTracle: A framework for Discriminating Bots and Humans

August See; Jan Kadel; Mathias Fischer; Ritwik Sinha

REVIEW 4 major objections 6 minor 45 references

BOTracle: A framework for Discriminating Bots and Humans

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A behavior-only graph model matches technical bot detectors on real e-commerce logs.

desk verdict The paper's headline 98%/surpass-Botcha claim is contradicted by its own Table 3, and the evaluation labels are partly circular, but the three-stage pipeline and real-traffic comparison make it a salvageable applied paper rather than a waste of referee time. read the letter →

arxiv 2412.02266 v1 pith:H5CCJRTD submitted 2024-12-03 cs.LG

Jan Kadel , August See , Ritwik Sinha , Mathias Fischer This is my paper · ORCID

classification cs.LG

keywords webbotdetectionwebsitetraversalgraphssemi-supervisedGANgraphconvolutionalnetworkbehavioralfeaturese-commercetrafficBotchabenchmark

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a bot detection pipeline can work in two complementary modes on high-traffic e-commerce logs: a fast heuristic layer plus a technical-feature classifier (SGAN), and a behavior-only classifier (DGCNN) that sees only how a client moves through the site. Its central claim is that Website Traversal graphs, built purely from navigation, carry enough signal to distinguish bots from humans, and that this signal is harder for bots to counterfeit than static identifiers. The authors evaluate on roughly 1.4 million hits from a site with 40 million monthly visits and compare against Botcha. The reported numbers show high detection performance for both proposed models, although SGAN precision is 0.9189 and the Botcha-RAM baseline scores higher accuracy and AUROC than either proposed model.

What carries the argument

The key object is the Website Traversal (WT) graph: a graph for a client session where nodes are visited sub-pages, edges are navigational links between pages, edge weights are visit frequencies, and nodes carry metadata such as page type, timestamps, and the benchmark label. From each graph the pipeline extracts metrics including node degree, page-type distribution, session keywords via RAKE, and centrality measures. These graphs are fed to a Deep Graph Convolutional Neural Network (DGCNN), a graph-classification architecture with graph convolution layers followed by sort pooling and a 1D CNN. The SGAN provides the technical-feature path, and a confidence threshold $\lambda$ decides when a prediction is accepted or deferred to the graph model. This machinery carries the argument because it converts raw clickstreams into a representation that is independent of spoofable technical attributes.

What would settle it

Take the same pipeline and replace the assumption-based labels with a manually verified sample of sessions, or run the DGCNN on a public dataset with known bot and human labels; if accuracy drops substantially below the technical-feature baseline, the claim that traversal graphs alone suffice is falsified.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that a Deep Graph Convolutional Neural Network applied to Website Traversal graphs reaches accuracy 0.9845, recall 0.9833, precision 0.9791, F1 0.9812, and AUROC 0.9892 on a real e-commerce sample, using no IP, user-agent, or window-size features. The SGAN, which does use technical features, reaches accuracy 0.9895 and AUROC 0.9886 but lower precision at 0.9189. In the direct comparison, Botcha-RAM reports accuracy 0.9952 and AUROC 0.9996, while Botcha-MAM reports precision 1.0 but recall 0.8383. The paper reads these results as demonstrating that behavior-only analysis is competitive and that pushing bots to mimic human navigation reduces their efficiency.

Load-bearing premise

The reported accuracy rests on the labeling rule that employees are human and that traffic from cloud-provider IP addresses is bot traffic; if real customers use VPNs or bots run on ordinary IPs, the ground truth is wrong and the metrics are misleading.

Editorial extensions

If this is right

If behavior-only detection holds up, bot operators can no longer evade detection simply by swapping user agents or resizing browser windows.
A business can run cheap heuristics first, reserving the SGAN and DGCNN for the ambiguous hits, which lowers compute cost at high traffic volumes.
The high accuracy on graphs with one to three nodes suggests even short sessions can be classified, so the pipeline does not need long observation periods.
Because behavioral mimicry forces bots to slow down and follow normal navigation patterns, effective bot detection raises the operating cost of automation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The abstract's blanket claim that all metrics reach 98 percent or higher and surpass Botcha is not supported by the paper's Table 3, where SGAN precision is 0.9189 and Botcha-RAM has higher accuracy and AUROC; a fair reading is that the behavior-only model is competitive, not universally superior.
The ground-truth assumptions in Section 5.1 (employees are human; cloud-provider IPs are bots) are the main hinge: if a meaningful share of humans use VPNs or bots live on residential IPs, the reported precision and recall are measured against the wrong labels.
A natural next test would be to run the same DGCNN on a public bot-detection corpus or a second website's logs to see whether the behavior-only advantage transfers across sites and traffic mixes.
The feature-importance result, which names browser height and width as SGAN's strongest signals, implies that a bot that randomizes window dimensions could degrade the technical-feature path, making the behavioral path the more durable component.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this paper has a real pipeline, real traffic data, and a sensible head-to-head comparison, but the headline numbers don't survive contact with its own Table 3 and the evaluation labels are too fragile to support 98–99% claims.

What's genuinely useful: the three-stage design (heuristics -> SGAN on technical features -> DGCNN on website traversal graphs) is a coherent industrial architecture. Evaluating on 40M-visit e-commerce traffic rather than a lab dataset is a step up, and comparing against Botcha on the same data is exactly the right exercise. The feature-importance analysis (browser height/width dominate SGAN) and the graph-size ablation are the kind of practical details practitioners want. Novelty is modest—SGAN, DGCNN, and traversal graphs have all been used before—but the application context and the explicit comparison are worthwhile. The citation pattern is fine; they engage with BotGraph, Botcha, and Cabri et al. rather than ignoring close competitors.

The problems are load-bearing. First, the abstract says precision, recall, and AUC reach 98% or higher, surpassing Botcha. Table 3 shows SGAN precision at 0.9189 and F1 at 0.9519; Botcha-RAM has higher accuracy (0.9952) and AUROC (0.9996) than either of their models. The conclusion quietly downgrades to "similar." That is an overclaim, not a nit.

Second, the ground truth is constructed from assumptions: employees are human, cloud IPs are bots, plus heuristics (forged UA, regular timing, small windows). Those same heuristics then appear as features in the SGAN, so the model is effectively scored on how well it reproduces the labeling assumptions. Section 5.3 concedes "we lack an accurate ground truth." With human labels at just 7,630 hits against 65k bot hits, a few percent label error is enough to make 98–99% meaningless.

Third, no dataset and no code, so none of this is independently checkable. I don't hold the proprietary dataset against the authors, but the combination of unverifiable data and circular labels means the metrics have to be read as "performance on an assumption set," not real-world discrimination.

The reader's REJECT is right. That said, the framework itself is salvageable: honest reporting, external validation of the labels (even a small hand-labeled sample), and a corrected abstract would make it a reasonable applied paper. It deserves a serious referee rather than a desk reject, because the engineering is real and the evaluation flaws are identifiable and fixable. I wouldn't cite the numbers as they stand, but I'd point someone to it as a worked example of how bot-detection evaluations can go circular.

Referee Report

4 major / 6 minor

Summary. The paper proposes BOTracle, a three-stage bot detection pipeline: heuristic filtering, a semi-supervised GAN (SGAN) classifier trained on technical features such as user agent and window size, and a deep graph convolutional neural network (DGCNN) operating on website traversal graphs. The methods are evaluated on a proprietary e-commerce dataset of roughly 40 million monthly page views (with a subset of about 1.4 million visits used in the experiments) and compared against the Botcha framework. The abstract claims that precision, recall, and AUC reach 98% or higher and that the approach surpasses Botcha.

Significance. A validated bot detection framework for high-traffic e-commerce would be practically valuable, and the use of a real-world dataset with a purely behavioral detector (DGCNN) is a useful complement to existing work. The paper also contributes a feature-importance analysis for the SGAN and a graph-size analysis for the DGCNN. However, the quantitative contribution is severely compromised by an internally inconsistent comparison with the Botcha baseline and by a circular, unvalidated ground-truth construction. As a result, the reported performance numbers do not currently support the paper's headline claims.

major comments (4)

[Abstract and Table 3] The abstract's central claim that 'Our performance metrics, including precision, recall, and AUC, reach 98 percent or higher, surpassing Botcha' is directly contradicted by Table 3. The SGAN has precision 0.9189 and F1 0.9519, both below 98%, and Botcha-RAM has higher accuracy (0.9952 vs. 0.9895 and 0.9845) and AUROC (0.9996 vs. 0.9886 and 0.9892) than both SGAN and DGCNN. Section 5.2 even states that 'Botcha-RAM stands out as the most effective model.' The paper's headline result as written is therefore false.
[Sections 5.1, 3.1, and 5.3] The evaluation is circular in a way that is load-bearing for all reported metrics. Section 5.1 constructs ground-truth labels from assumptions (employee-account traffic is human; cloud-provider IP traffic is bot), and Section 3.1 adds bot labels using heuristics such as forged user agents, regular time-between-hits, and unrealistic window sizes. The same signals are used as features in the SGAN (e.g., user agent, browser height/width, timing-related attributes), and Table 2 shows the heuristics expanding the bot label set from 51,462 to 65,018 hits. The model is therefore scored against labels partly produced by the same characteristics it learns. Section 5.3 explicitly concedes 'we lack an accurate ground truth.' A small labeling error rate (even a few percent) is enough to make 98-99% accuracy/AUROC claims meaningless, because the metrics measure agreement with the assumption set rather than true bot/human status.
[Section 5.2 (RQ1)] The narrative interpretation of Table 3 is internally inconsistent. The text says that 'the superiority of WT graphs that leverage behavioral features is noteworthy,' but Table 3 shows SGAN with accuracy 0.9895 and AUROC 0.9886 versus DGCNN with 0.9845 and 0.9892, and Botcha-RAM outperforming both on accuracy, precision, F1, and AUROC. The authors should either revise the interpretation to match the numbers or provide a statistical test showing that the differences between SGAN and DGCNN are meaningful.
[Section 5 (Evaluation setup)] The experimental setup is underspecified: the paper does not describe how the 1.4 million-visit subset is split into training, validation, and test sets; whether the 710,023 'unknown' hits are excluded or treated in some other way; and whether Table 3 metrics for the different methods are computed on exactly the same test set. Without this information, the reported comparisons cannot be independently checked, and the robustness of the claimed performance cannot be assessed.

minor comments (6)

[Section 6 vs. Section 1/5.1] The conclusion states that the site has 'a substantial monthly visitor count of 50 million,' whereas the abstract and Section 5.1 say 40 million; please reconcile these numbers.
[Table 2] The numbers '51.462' and '65.018' use a decimal point where a thousands separator is presumably intended; the text should read 51,462 and 65,018.
[Section 4.1] The text refers to 'equation 4.1' and 'equation 4.2,' but the displayed equations are numbered (1), (2), and (3); please fix the cross-references.
[References] Reference [26] contains the placeholder 'document reference needed,' and reference [24] appears to duplicate [19]; several other references are incomplete, e.g., [16] and [27].
[Section 2.2] The phrase 'sessions with few requests (¿ 3)' should be 'sessions with few requests (< 3)'.
[Section 3] The sentence 'This integration aims to automate captcha resolution' is misleading: the pipeline is a bot detection system, not a CAPTCHA-solving system.

Circularity Check

1 steps flagged · score 6.0 of 10

SGAN's reported accuracy is partly self-confirming: bot labels are expanded by heuristics on window size, user agent, and timing, and the SGAN's top features are exactly those signals, so the 98% metrics partly measure reproduction of the labeling rules.

self definitional [Section 5.1, paragraph following Table 2; heuristics in Section 3.1; SGAN feature importance in Section 5.2, Table 4]
"It is structured to compare the number of hits identified through our initial assumptions (cf. 5.1) with those further refined by the application of our heuristics (cf. 3.1), which are designed to identify more bots but not humans. It shows a refinement in bot detection in our dataset, increasing from 51,462 to 65,018 instances with the application of heuristics."

The heuristics referenced are the Section 3.1 rules: forged user agents, regular time-between-hits, and 'unrealistic window sizes' (very small browser dimensions, e.g. an axis under 50 pixels). The SGAN is trained on these heuristic-expanded labels using technical features such as user agent and window size, and Table 4 reports 'post browser height' and 'post browser width' as the two most important features. The bot class is thus partly defined by the same signals the model uses to predict it, so precision/recall/AUC measure how well the model rediscovers the heuristic labeling rules rather than agreement with an independent bot/human ground truth. Section 5.3 concedes 'we lack an accurate ground truth.'

full rationale

The core evaluation is partially circular. Section 5.1 builds ground truth from assumptions and then expands the bot class with the Section 3.1 heuristics (forged user agent, timing regularity, unrealistically small windows). Section 5.2/Table 4 shows the SGAN's most important features are browser height and width, the same signal used in the 'unrealistic window sizes' heuristic. Consequently the reported 98%+ metrics partly quantify the model's agreement with the labeling procedure rather than with an external ground truth. The DGCNN uses behavior-only graph features and is less directly tied to the heuristics, so the circularity is partial, not total. The cloud-IP and employee-account assumptions are unvalidated but not circular in the defined sense. Self-citations ([18]-[20], [24]) appear only in related-work context and do not carry the derivation. Separately, Table 3 shows Botcha-RAM accuracy (0.9952) and AUROC (0.9996) exceed the paper's models, contradicting the abstract's 'surpassing Botcha' claim, but that is a factual inconsistency rather than circularity. Score 6 reflects one central prediction target reduced, by construction, to the heuristic inputs.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The central evaluation rests on three unverified premises: that employee traffic is human, that cloud IP traffic is bot, and that the three heuristic rules identify bots reliably. These premises are acknowledged in the paper as assumptions ('we rely instead of the most basic assumptions we can think of'), so the reported 98% figures are conditional on them.

free parameters (1)

confidence threshold λ
Section 3 defines a threshold λ in [0,1] for deciding whether SGAN/DGCNN predictions are confident enough to emit a label, but the paper never reports the value used in the evaluation. The choice directly controls precision/recall and the fraction of hits passed to the next stage.

assumptions (3)

domain assumption Traffic from the hosting organization's employee accounts is human.
Section 5.1 defines all employee-account traffic as human; this defines the human class used to train and evaluate the models and is not independently verified.
domain assumption Requests from cloud provider IP addresses are bots.
Section 5.1 labels any cloud-IP request as bot; the paper acknowledges VPN/proxy exceptions but treats them as a minority, which is untested.
domain assumption Heuristics (forged user-agent, regular hit intervals, very small window sizes) identify bots with high precision.
Section 3.1 presents these as detection rules; Section 5.1 uses them to expand the bot label set from 51k to 65k hits, so they shape the ground truth.

how reviews work

0 comments

Cite this review

Pith. "Pith review of BOTracle: A framework for Discriminating Bots and Humans." pith.science (2026). https://pith.science/paper/H5CCJRTD

@misc{pith2026241202266,
  author       = {Pith},
  title        = {Pith review of: BOTracle: A framework for Discriminating Bots and Humans},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/H5CCJRTD}},
  note         = {Machine review of arXiv:2412.02266}
}

read the original abstract

Bots constitute a significant portion of Internet traffic and are a source of various issues across multiple domains. Modern bots often become indistinguishable from real users, as they employ similar methods to browse the web, including using real browsers. We address the challenge of bot detection in high-traffic scenarios by analyzing three distinct detection methods. The first method operates on heuristics, allowing for rapid detection. The second method utilizes, well known, technical features, such as IP address, window size, and user agent. It serves primarily for comparison with the third method. In the third method, we rely solely on browsing behavior, omitting all static features and focusing exclusively on how clients behave on a website. In contrast to related work, we evaluate our approaches using real-world e-commerce traffic data, comprising 40 million monthly page visits. We further compare our methods against another bot detection approach, Botcha, on the same dataset. Our performance metrics, including precision, recall, and AUC, reach 98 percent or higher, surpassing Botcha.

Figures

Figures reproduced from arXiv: 2412.02266 by the authors.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 44 canonical work pages

[1]

Bot traffic report 2016,

I. Zeifman, “Bot traffic report 2016,” https://www.incapsula.com/blog/ bot-traffic-report-2016.html, 2017, retrieved: 2017-02-01

work page 2016
[2]

Online web bot detection using a sequential classification ap- proach,

A. Cabri et al. , “Online web bot detection using a sequential classification ap- proach,” in IEEE 20th International Conference on High Performance Computing and Communications; IEEE 16th International Conference on Smart City; IEEE 4th International Conference on Data Science and Systems (HPCC/SmartCity/DSS) . IEEE, 2018

work page 2018
[3]

Social bots distort the 2016 us presidential election online discussion,

A. Bessi and E. Ferrara, “Social bots distort the 2016 us presidential election online discussion,” First Monday , vol. 21, no. 11-7, 2016

work page 2016
[4]

A low-cost attack against the hcaptcha system,

M. I. Hossen and X. Hei, “A low-cost attack against the hcaptcha system,” in IEEE Security and Privacy Workshops (SPW) , 2021, pp. 422–431

work page 2021
[5]

Commercial image captcha solving service,

“Commercial image captcha solving service,” https://bestcaptchasolver.com/, 2022, last visited on October 6th

work page 2022
[6]

Web bot detection evasion using generative adversarial networks,

C. Iliou et al. , “Web bot detection evasion using generative adversarial networks,” in IEEE International Conference on Cyber Security and Resilience (CSR) . IEEE, 2021

work page 2021
[7]

Yet another text captcha solver: A generative adversarial network based approach,

G. Ye et al. , “Yet another text captcha solver: A generative adversarial network based approach,” in ACM SIGSAC Conference on Computer and Communications Security, 2018

work page 2018
[8]

Introducing recaptcha v3: the new way to stop bots,

W. Liu, “Introducing recaptcha v3: the new way to stop bots,” https://developers. google.com/search/blog/2018/10/introducing-recaptcha-v3-new-way-to, 2018, ac- cessed: 2021-05-20

work page 2018

Show all 45 references

[9]

Stop more bots. start protecting user privacy,

I. Machines, “Stop more bots. start protecting user privacy,” https://www.hcaptcha. com/, 2018, accessed: 2021-05-20

2018
[10]

I’m not a human: Breaking the google recaptcha,

S. Sivakorn, J. Polakis, and A. D. Keromytis, “I’m not a human: Breaking the google recaptcha,” in Black Hat , vol. 14, 2016

2016
[11]

Humanity wastes about 500 years per day on captchas. it’s time to end this madness,

“Humanity wastes about 500 years per day on captchas. it’s time to end this madness,” http://blog.cloudflare.com/ introducing-cryptographic-attestation-of-personhood/, 2021, accessed: 2022-11- 21

2021
[12]

Expedia on how one extra data field can cost $12m,

N. Heath, “Expedia on how one extra data field can cost $12m,” https://www. zdnet.com/article/expedia-on-how-one-extra-data-field-can-cost-12m/, October 18 2010

2010
[13]

Towards a framework for detecting advanced web bots,

C. Iliou, T. Kostoulas, T. Tsikrika, V. Katos, S. Vrochidis, and Y. Kompatsiaris, “Towards a framework for detecting advanced web bots,” in Proceedings of the 14th International Conference on Availability, Reliability and Security , 2019

2019
[14]

Efficient on-the-fly web bot detection,

G. Suchacka, A. Cabri, S. Rovetta, and F. Masulli, “Efficient on-the-fly web bot detection,” Knowledge-Based Systems, vol. 223, p. 107074, 2021

2021
[15]

Good bot, bad bot: Charac- terizing automated browsing activity,

X. Li, B. A. Azad, A. Rahmati, and N. Nikiforakis, “Good bot, bad bot: Charac- terizing automated browsing activity,” in IEEE Symposium on Security and Privacy (SP). IEEE, 2021, pp. 1589–1605

2021
[16]

Fingerprint surface-based detection of web bot detectors,

H. Jonker, B. Krumnow, and G. Vlot, “Fingerprint surface-based detection of web bot detectors,” in European Symposium on Research in Computer Security. Springer, 2019, pp. 586–605

2019
[17]

Hlisa: Towards a more reliable measurement tool,

D. Goßen et al., “Hlisa: Towards a more reliable measurement tool,” inProceedings of the 21st ACM Internet Measurement Conference , 2021

2021
[18]

Polymorphic protocols at the example of mitigat- ing web bots,

A. See, L. Fritz, and M. Fischer, “Polymorphic protocols at the example of mitigat- ing web bots,” in European Symposium on Research in Computer Security. Springer, 2022, pp. 106–124. 18 Kadel et al

2022
[19]

Detecting web bots via mouse dynamics and communication metadata,

A. See, T. Wingarz, M. Radloff, and M. Fischer, “Detecting web bots via mouse dynamics and communication metadata,” in IFIP International Conference on ICT Systems Security and Privacy Protection . Springer, 2023, pp. 73–86

2023
[20]

Detecting web bots via keystroke dynamics,

A. See, A. Westphal, C. Weber, and M. Fischer, “Detecting web bots via keystroke dynamics,” in IFIP International Conference on ICT Systems Security and Privacy Protection. Springer, 2024, pp. 423–436

2024
[21]

Continuous authentication for mouse dynamics: A pattern-growth approach,

C. Shen, Z. Cai, and X. Guan, “Continuous authentication for mouse dynamics: A pattern-growth approach,” in IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2012) , 2012, pp. 1–12

2012
[22]

Biometric authentication using mouse gesture dynamics,

B. Sayed, I. Traor´ e, I. Woungang, and M. S. Obaidat, “Biometric authentication using mouse gesture dynamics,” IEEE Systems Journal , vol. 7, no. 2, pp. 262–274, 2013

2013
[23]

On mouse dynamics as a behavioral biometric for au- thentication,

Z. Jorgensen and T. Yu, “On mouse dynamics as a behavioral biometric for au- thentication,” in Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security , 2011, pp. 476–482

2011
[24]

Detecting web bots via mouse dy- namics and communication metadata,

A. See, T. Wingarz, M. Radloff, and M. Fischer, “Detecting web bots via mouse dy- namics and communication metadata,” in International Conference on ICT Systems Security and Privacy Protection (IFIP SEC) , 2023, accepted for publication

2023
[25]

Botcha: Detecting malicious non-human traffic in the wild,

S. Dhamnani et al. , “Botcha: Detecting malicious non-human traffic in the wild,” https://arxiv.org/abs/2103.01428, 2021

2021 arXiv
[26]

Need tickets? a case study of bot-enabled ticket scalping,

C. Lin and H.-C. Hsiao, “Need tickets? a case study of bot-enabled ticket scalping,” document reference needed
[27]

Was ist content scraping?

“Was ist content scraping?” https://www.cloudflare.com/de-de/learning/bots/ what-is-content-scraping/, 2022, last visited on October 6th

2022
[28]

Udger database for user agents, ip addresses, and other web technologies,

“Udger database for user agents, ip addresses, and other web technologies,” https: //udger.com, accessed 2024-04-05

2024
[29]

Sequential tests of statistical hypotheses,

A. Wald, “Sequential tests of statistical hypotheses,” Ann. Math. Statist. , vol. 16, no. 2, pp. 117–186, 1945

1945
[30]

Botgraph: Web bot detection based on sitemap,

Y. Luo et al., “Botgraph: Web bot detection based on sitemap,” https://arxiv.org/ abs/1903.08074, 2019

1903 arXiv
[31]

Hand labeling considered harmful,

S. Mohanty, “Hand labeling considered harmful,” https://www.oreilly.com/radar/ arguments-against-hand-labeling/, 2021, last visited on October 6th, 2022

2021
[32]

Detecting malicious activities with user-agent-based profiles,

Y. Zhang et al. , “Detecting malicious activities with user-agent-based profiles,” International Journal of Network Management , vol. 25, no. 5, pp. 306–319, 2015

2015
[33]

Web robot detection techniques: overview and limita- tions,

D. Doran and S. Swapna, “Web robot detection techniques: overview and limita- tions,” Data Mining and Knowledge Discovery , vol. 22, pp. 183–210, 2011

2011
[34]

Bot detection model using user agent and user behavior for web log analysis,

T. Tanaka et al., “Bot detection model using user agent and user behavior for web log analysis,” Procedia Computer Science, vol. 176, pp. 1621–1625, 2020

2020
[35]

Efficient on-the-fly web bot detection,

G. Suchacka et al., “Efficient on-the-fly web bot detection,” Knowledge-Based Sys- tems, vol. 223, p. 107074, 2021

2021
[36]

Fingerprint surface-based detection of web bot detectors,

H. Jonker, K. Benjamin, and V. Gabry, “Fingerprint surface-based detection of web bot detectors,” in Computer Security–ESORICS 2019: 24th European Symposium on Research in Computer Security , vol. 24. Springer International Publishing, 2019

2019
[37]

Taming the cross entropy loss,

M. Martinez and R. Stiefelhagen, “Taming the cross entropy loss,” in German Conference on Pattern Recognition. Springer, Cham, 2018

2018
[38]

How to implement a semi-supervised gan (sgan) from scratch in keras,

J. Brownlee, “How to implement a semi-supervised gan (sgan) from scratch in keras,” https://machinelearningmastery.com/ semi-supervised-generative-adversarial-network/, July 24 2019

2019
[39]

Learning representations by back-propagating errors,

D. E. Rumelhart, G. E. Hinton, and R. J. Williams, “Learning representations by back-propagating errors,” Nature, vol. 323, no. 6088, pp. 533–536, 1986. BOTracle: A framework for Discriminating Bots and Humans 19

1986
[40]

Improved techniques for training gans,

T. Salimans et al., “Improved techniques for training gans,” in Advances in Neural Information Processing Systems, vol. 29, 2016

2016
[41]

Rose et al

S. Rose et al. , Automatic keyword extraction from individual documents . Text mining: applications and theory, 2010, vol. 1

2010
[42]

An end-to-end deep learning architecture for graph classification,

M. Zhang et al., “An end-to-end deep learning architecture for graph classification,” in Proceedings of the AAAI conference on artificial intelligence , vol. 32, no. 1, 2018

2018
[43]

Scalping in ecommerce: ethics and impacts,

S. Brock, “Scalping in ecommerce: ethics and impacts,” https://ssrn.com/ abstract=3793357, 2021

2021
[44]

At ticketmaster, scalpers score and fans come last,

D. Parma, “At ticketmaster, scalpers score and fans come last,”JL & Com., vol. 38, p. 463, 2019

2019
[45]

Permutation importance: a corrected feature importance mea- sure,

A. Altmann et al., “Permutation importance: a corrected feature importance mea- sure,” Bioinformatics, vol. 26, no. 10, pp. 1340–1347, 2010

2010

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Bot traffic report 2016,

I. Zeifman, “Bot traffic report 2016,” https://www.incapsula.com/blog/ bot-traffic-report-2016.html, 2017, retrieved: 2017-02-01

work page 2016

[2] [2]

Online web bot detection using a sequential classification ap- proach,

A. Cabri et al. , “Online web bot detection using a sequential classification ap- proach,” in IEEE 20th International Conference on High Performance Computing and Communications; IEEE 16th International Conference on Smart City; IEEE 4th International Conference on Data Science and Systems (HPCC/SmartCity/DSS) . IEEE, 2018

work page 2018

[3] [3]

Social bots distort the 2016 us presidential election online discussion,

A. Bessi and E. Ferrara, “Social bots distort the 2016 us presidential election online discussion,” First Monday , vol. 21, no. 11-7, 2016

work page 2016

[4] [4]

A low-cost attack against the hcaptcha system,

M. I. Hossen and X. Hei, “A low-cost attack against the hcaptcha system,” in IEEE Security and Privacy Workshops (SPW) , 2021, pp. 422–431

work page 2021

[5] [5]

Commercial image captcha solving service,

“Commercial image captcha solving service,” https://bestcaptchasolver.com/, 2022, last visited on October 6th

work page 2022

[6] [6]

Web bot detection evasion using generative adversarial networks,

C. Iliou et al. , “Web bot detection evasion using generative adversarial networks,” in IEEE International Conference on Cyber Security and Resilience (CSR) . IEEE, 2021

work page 2021

[7] [7]

Yet another text captcha solver: A generative adversarial network based approach,

G. Ye et al. , “Yet another text captcha solver: A generative adversarial network based approach,” in ACM SIGSAC Conference on Computer and Communications Security, 2018

work page 2018

[8] [8]

Introducing recaptcha v3: the new way to stop bots,

W. Liu, “Introducing recaptcha v3: the new way to stop bots,” https://developers. google.com/search/blog/2018/10/introducing-recaptcha-v3-new-way-to, 2018, ac- cessed: 2021-05-20

work page 2018