On Fri, Mar 1, 2013 at 11:07 PM, Marco Cirillo <[email protected]> wrote: > Il 01/03/2013 23:03, Kevin Smith ha scritto: > >> On Fri, Mar 1, 2013 at 9:59 PM, Marco Cirillo <[email protected]> >> wrote: >>> >>> expecially to the "high usage" ones (possibly more, >>> those with unprotected IBR)... Did you actually ever make a census of how >>> many of your concurrent users are actual human beings..? >> >> It's not immediately clear to me how one would reliably do this - do >> you have any suggestions? >> > Well Kevin beside "greeting the target" (before or after), they may be very > clichy... but 2 enough effective ways to profile bots in my opinion are: > - They tend being either incredibly idle or incredibly active, and usual > have sudden activity bursts (idleness is to be treated with care and checked > with other factors...) > - They tend doing stuff a normal user wouldn't do (e.g. large amount of > random service discoveries, which could reflect on servers with a high > amount of non human beings having a way larger s2s connections number for > instance) > - They could have very large rosters or, very empty ones (as usual treat the > latter case with care...)
I think you're describing how bots may act in the above, but it also seems to quite accurately describe how humans act so I think the FPR here would be quite significant. /K
