A method of identifying non-human user activity on a computerized device comprising: selecting a plurality of attributes relevant to computerised device activity; receiving information relating to the plurality of attributes from an infected device group comprising a plurality of computerized devices that are known to be infected with at least one non-human user software and generating a score for each of the plurality of attributes for the infected device group; receiving information relating to the plurality of attributes from a control device group comprising a plurality of computerized devices that are determined not to be infected with a non-human user software, and generating a score for each of the plurality of attributes for the control device group; determining correlations between each of the plurality of attributes and the presence of non-human user activity based on the attribute scores generated from the infected device group and the control device group, and defining threshold scores for attributes that are determined to correlate with the presence of non-human user activity; selecting from the plurality of the attributes two or more attributes for use as factors for identifying the presence of non-human user activity, the two or more attributes being selected for use as factors based on determined correlations of the attributes with the presence of non-human user software; defining a threshold factor score for each factor indicating a likelihood of non-human user activity for that factor, and defining a threshold combined factor score indicating a likelihood of non-human user activity; receiving information relating to the plurality of attributes from a user device, the user device being a computerized device that is not known to be infected or not infected with non-human user software, generating factor scores for the user device for each of the two or more attributes selected as factors, and generating a combined factor score based on the individual factor scores; and determining a likelihood that the user device is infected with at least one non-human user software by comparing the factor scores from the user device to the threshold factor scores, and comparing the combined factor score from the user device to the threshold combined factor score. selecting a plurality of attributes relevant to computerised device activity; receiving information relating to the plurality of attributes from an infected device group comprising a plurality of computerized devices that are known to be infected with at least one non-human user software and generating a score for each of the plurality of attributes for the infected device group; receiving information relating to the plurality of attributes from a control device group comprising a plurality of computerized devices that are determined not to be infected with a non-human user software, and generating a score for each of the plurality of attributes for the control device group; determining correlations between each of the plurality of attributes and the presence of non-human user activity based on the attribute scores generated from the infected device group and the control device group, and defining threshold scores for attributes that are determined to correlate with the presence of non-human user activity; selecting from the plurality of the attributes two or more attributes for use as factors for identifying the presence of non-human user activity, the two or more attributes being selected for use as factors based on determined correlations of the attributes with the presence of non-human user software; defining a threshold factor score for each factor indicating a likelihood of non-human user activity for that factor, and defining a threshold combined factor score indicating a likelihood of non-human user activity; receiving information relating to the plurality of attributes from a user device, the user device being a computerized device that is not known to be infected or not infected with non-human user software, generating factor scores for the user device for each of the two or more attributes selected as factors, and generating a combined factor score based on the individual factor scores; and determining a likelihood that the user device is infected with at least one non-human user software by comparing the factor scores from the user device to the threshold factor scores, and comparing the combined factor score from the user device to the threshold combined factor score.