| CPC G06F 12/0842 (2013.01) [G06F 16/355 (2019.01); G06N 3/08 (2013.01); G06Q 40/06 (2013.01); H04L 41/16 (2013.01); H04L 63/1483 (2013.01)] | 20 Claims |

|
1. A method comprising:
receiving a first indication of a first network interaction by a client agent, wherein the client agent includes one or more characteristics;
determining, based on the first network interaction, one or more behaviors of the client agent;
making a first determination, by a heuristics module, based a first classification of the client agent, that the client agent is in an unknown class, wherein the first classification is based on the one or more characteristics of the client agent and the one or more behaviors of the client agent;
making a second determination, by a trained adversarial neural network, based on a second classification of the client agent, that the client agent in the unknown class;
generating a graph representation of the first network interaction;
based on the first classification and the second classification of the client agent as in the unknown class, determining, by a trained graph convolutional neural network, based on a third classification of the client agent, that the client agent is in a bot class, wherein the third classification is performed using the graph representation of the first network interaction;
based on the third classification of the client agent as in the bot class, executing a command to cause a bot countermeasure; and
generating a notification comprising information about the one or more characteristics of the client agent and the one or more behaviors of the client agent.
|