How to Analyze Session Behavior for Invalid Traffic: A Step‑by‑Step Guide

Analyzing session behavior helps you separate genuine human visitors from bots that waste ad budget. Bots often show unnaturally short sessions, no scrolling, linear mouse paths, and instant form submissions. By capturing these signals on the client side, comparing them to a clean baseline, and flagging outliers, you can identify invalid traffic, protect conversion data, and build evidence for refund claims.

Prerequisites

Before you start, make sure you have:

• Access to click identifiers from your ad platforms (e.g., GCLID for Google Ads, fbclid for Meta).
• Permission to add a small JavaScript snippet to every landing page you want to monitor.
• A storage destination for session data – this can be a web‑analytics tool, a data‑layer, or BotRefund’s dedicated endpoint.
• A period of known‑good traffic to use as a baseline (branded search, retargeting, or any source with low fraud risk).

BotRefund’s documentation confirms that the client‑side tag works with standard CSP policies as long as the script domain is allowed (source S2).

Collect Session Data – Step‑by‑Step Tag Installation

BotRefund provides a ready‑to‑use snippet that captures the signals needed for session‑behavior analysis. Follow these steps:

1. Log in to your BotRefund dashboard and navigate to Integration → Client‑side tag.
2. Copy the generated <script> block. It looks like:

   <script src="https://cdn.botrefund.com/tag.js" async></script>
   <script>
     BotRefund.init({
       clickIdParam: 'gclid', // or 'fbclid' for Meta
       capture: ['sessionStart','sessionEnd','scrollDepth','pointerPath','formTiming']
     });
   </script>

3. Paste the block just before the closing </head> tag on every landing page.
4. Verify that the script loads without CSP violations (check the browser console).
5. Test a few visits and confirm that a network request is sent to https://api.botrefund.com/collect with a JSON payload containing timestamps, scroll percentages, pointer coordinates, and the click ID.

Once deployed, the tag records each session’s start/end time, scroll depth, mouse movement speed, and form interaction events (source S1).

Identify Key Session‑Behavior Signals

BotRefund monitors more than 50 detection vectors. The most relevant for invalid‑traffic analysis are:

• Unnatural session durations – visits that are too short, too long, or unusually uniform.
• Scrollbar width leak – a mismatch in expected scrollbar dimensions that bots struggle to reproduce (source S5).
• Clean context iframe – inconsistencies in browser API exposure that indicate automation (source S7).
• Pointer behavior – linear paths, super‑human speed, or lack of jitter (source S2).
• Scroll behavior – zero or minimal scroll depth, or scrolls that jump in fixed increments.
• Form timing – immediate submission after page load, or identical typing intervals.

These signals together form a behavioral fingerprint that distinguishes bots from humans.

Baseline Calculation – Concrete Example

To spot outliers, you need a statistical baseline derived from clean traffic. Here is a simple example using Google Sheets or a Python notebook:

# Assume you have a CSV export with columns: session_id, duration_sec, scroll_pct, pointer_speed_px_s, form_time_ms
import pandas as pd
import numpy as np

data = pd.read_csv('clean_traffic.csv')
# Calculate median and 5th/95th percentiles
median_duration = data['duration_sec'].median()
perc5_duration = np.percentile(data['duration_sec'], 5)
perc95_duration = np.percentile(data['duration_sec'], 95)

median_scroll = data['scroll_pct'].median()
median_speed = data['pointer_speed_px_s'].median()
median_form = data['form_time_ms'].median()

print('Baseline:')
print(f'Duration median={median_duration}s, 5th percentile={perc5_duration}s')
print(f'Scroll median={median_scroll}%')
print(f'Pointer speed median={median_speed}px/s')
print(f'Form time median={median_form}ms')

In a typical clean dataset, you might see a median session length of 45 seconds, 5th percentile of 12 seconds, median scroll depth of 68 %, pointer speed median of 350 px/s, and form‑time median of 1,200 ms.

These numbers become the reference for threshold setting.

Threshold‑Setting Approaches – Comparison Table

Approach	How It Works	Pros	Cons	Typical Use‑Case
Percentile‑Based	Flag sessions below the 5th percentile or above the 95th percentile of each metric.	Simple, transparent, easy to audit.	May miss subtle bots that sit just inside the range.	Small teams, quick rollout.
Standard‑Deviation	Compute mean and standard deviation; flag values > 2 σ from the mean.	Accounts for normal distribution shape.	Assumes normality; outliers can skew mean.	Data‑rich environments.
Dynamic Percentile (rolling window)	Re‑calculate percentiles weekly to adapt to traffic seasonality.	Responsive to campaign changes.	Requires ongoing automation.	Large advertisers with fluctuating spend.
Machine‑Learning Score	Train a model on labeled good/bad sessions using all BotRefund signals.	High detection accuracy, captures complex patterns.	Needs labeled data and model maintenance.	Enterprise‑level fraud teams.

Choose the approach that matches your data volume and operational capacity. For most advertisers, starting with percentile‑based thresholds provides a clear, auditable baseline.

Apply Thresholds and Flag Outliers

Using the baseline from the earlier example, you could set the following thresholds:

• Session length < 2 × 5th percentile (e.g., < 24 seconds).
• Scroll depth < 10 % of baseline median (e.g., < 7 %).
• Pointer speed > 3 × median or < 0.3 × median (e.g., > 1,050 px/s or < 105 px/s).
• Form‑time < 500 ms or > 5 × median (e.g., > 6 seconds).

Any session that breaches one or more thresholds is marked as suspicious. Store the flag in a column called invalid_flag for later reporting.

Verify Findings with a Manual Audit

Automation is powerful, but a human review adds confidence. Follow this workflow:

1. Select a random 5 % sample of flagged sessions.
2. Use BotRefund’s replay console to watch pointer paths and scroll actions in real time.
3. Look for tell‑tale signs: perfectly straight mouse lines, no hesitation before clicks, identical form field values.
4. Record the proportion of clearly robotic sessions. If > 70 % are robotic, your thresholds are well‑tuned.
5. Adjust thresholds if the false‑positive rate is high (see Limitations).

The FinTrust case study shows that after applying a similar workflow, the client reduced bot‑generated registrations by 14 % and recovered $140,000 in ad spend (source S6).

Case Study Snippet – FinTrust

FinTrust, a modern neobank, faced massive bot registration attempts that inflated cost‑per‑click and distorted CAC metrics. By deploying BotRefund’s behavioral auditing:

• They identified a bot click rate of 14 % across search‑ad landing pages.
• Suppressed conversion events that matched automated‑browser signals.
• Recovered $140,000 in ad spend, representing an 18 % increase in total refunded spend.
• Conversion rates improved because Meta and Google AI trained only on verified human leads.

“Enterprise‑grade security is in our DNA, but ad fraud happens outside our product walls. BotRefund audit trails are the gold standard that Meta ad reps accept,” says Marcus Vance, VP of Acquisition at FinTrust (source S6).

Limitations and Mitigation Strategies

Session‑behavior analysis is highly effective, yet it has known limits:

• False Positives – Legitimate users on fast connections or using assistive technologies may exhibit short sessions or minimal scrolling. Mitigate by adding a secondary check such as IP reputation or device fingerprint.
• False Negatives – Advanced bots can mimic human jitter, random scrolls, and realistic typing delays. Counteract by combining behavior signals with network‑level data (user‑agent, IP range) as BotRefund recommends (source S1).
• Caching & CDN Interference – Aggressive edge caching can strip the client‑side script, preventing data capture. Ensure the tag is whitelisted in your CDN configuration.
• Privacy Regulations – Collecting granular mouse data may raise GDPR concerns. Use anonymized aggregates and provide clear consent notices.
• Browser Extensions – Some privacy extensions hide automation signals, potentially masking bots. Pair behavior analysis with server‑side logs for a fuller picture.

By layering multiple evidence sources—behavioral, network, and device—you reduce both types of error and build a robust case for ad‑platform refunds.

Terminology

Invalid traffic: Clicks or impressions that are not generated by genuine user interest, including bots, click farms, and accidental clicks.

Session behavior: Observable actions during a single site visit—timing, scrolling, pointer movement, and form interaction.

Baseline: A reference distribution of metrics derived from traffic considered valid, used to spot outliers.

Key Facts About BotRefund Session‑Behavior Detection

Signal	What it measures	How BotRefund captures it
Unnatural session durations	Visits that are too short, too long, or too uniform to be human	Detected via session‑duration checks in the client‑side tag (source S1)
Scrollbar Width Leak	Mismatch between expected and actual scrollbar width indicating automation	One of 106 independent checks; flags scripts that cannot reproduce natural scrollbar behavior (source S5)
Clean Context Iframe	Consistency of browser APIs when inspected from an isolated iframe	One of 106 checks; looks for API patches typical of automation tools (source S7)
Pointer and scroll behavior	Mouse movement patterns, speed, jitter, and scroll depth	Included among 50+ detection vectors (source S2)
Click and typing timing	Time between clicks, keypresses, and form submissions	Part of BotRefund’s behavioral suite (source S1)
Navigation flow and session replay	Sequence of page views and interactions within a session	Captured for forensic evidence and refund requests (source S1)

FAQ

• Why does session behavior matter for invalid traffic? Bots lack natural hesitation, scrolling, and mouse jitter. These gaps create reliable signals that separate non‑human activity from real users (source S1).
• How long does it take to set up session‑behavior tracking? Adding the BotRefund snippet takes under a minute. Data collection starts immediately (source S2).
• What if my site uses a strict Content Security Policy? You must allow the BotRefund script domain in the CSP; otherwise the tag cannot collect pointer or scroll data (source S2).
• Can I use this method with Meta and Google Ads simultaneously? Yes. Capture the appropriate click ID (fbclid or gclid) alongside session data to link behavior to each platform (source S1).
• What is the cost of BotRefund’s session‑behavior analysis? BotRefund offers a free bot audit; paid plans start at the tiers shown on the pricing page (source S2).
• How do I reduce false positives? Combine behavioral thresholds with IP reputation, device fingerprinting, and manual audit sampling (source S1).
• What if sophisticated bots mimic human jitter? Use multiple signals—scrollbar width leak, clean‑context iframe, and network‑level checks—to catch bots that evade a single vector (source S5, S7).

Further Reading and Comparison Sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• How to Detect Invalid Traffic: A Strategic Guide to Eliminating ...
• Guide to Threat Detection with Network Traffic Pattern Analysis
• Generating Session Data from Traffic: Complete Guide

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• How to Detect Invalid Traffic: A Strategic Guide to Eliminating ...
• Guide to Threat Detection with Network Traffic Pattern Analysis| ...
• Generating Session Data from Traffic: Complete Guide - Network ...

Learn more

Visit the website for more information.