Patent ID: 8413250

Claim:
A computer-implemented method comprising: monitoring activity at one or more servers accessible via a network and capturing event entries in an activity log for activity that is detected, wherein each of the event entries includes descriptive information regarding at least one action performed with respect to a communication session, a client identifier and a session identifier; attempting to classify each respective session as being associated with a human user or with an automated process based at least partially on the at least one action, the respective session identifier and the respective client identifier associated with one or more event entries for the respective session, wherein the respective session identifier is associated with a single user; identifying unclassified sessions, wherein the unclassified sessions were not classified, as a result of the attempt to classify each respective session, as being associated with human users or with automated processes; determining a count of a number of unclassified sessions that were not classified as a result of the attempt to classify, the unclassified sessions being associated with a particular client identifier but with different session identifiers; and classifying the unclassified sessions associated with the particular client identifier but with different session identifiers as being associated with a human user or with an automated process based at least partially on the number of unclassified sessions associated with the particular client identifier but with different session identifiers, wherein each session identifier is communicated from a server to a user device remote from the server when a communication session between the server and the user device is established.