Find the users that aren't real.
Upload the same CSV you use for FlowMeter. Six behavioral physics signals surface synthetic patterns invisible to rule engines.
The Must-Haves & How-To's
01 ยท Required Column Mapping
FraudSignal operates on the exact same 4 dimensions as FlowMeter. Column names are case-insensitive and stripped of whitespace.
-
user_id string / intUnique identifier for every user/subscriber or click token.Aliases: userid, id
-
is_success binary (0 / 1)1 = Success / conversion / rebill; 0 = Abandon / failure.Aliases: success, target
-
funnel_level numeric (1, 2, 3...)Journey step or checkout milestone reached by the user.Aliases: level, step
-
session_minute numeric (minutes)Elapsed session duration in minutes from journey start.Aliases: minutes, minute, time
02 ยท Synthetic Behavioral Physics
Bots bypass static rules (IP rotation, user-agent spoofing, cookie clearing). But they cannot counterfeit the natural thermodynamics of human behavior.
The engine extracts 6 real-time signals: Timing Entropy (mechanical inter-step clock intervals), Speed Z-Score (superhuman pace), Momentum Flatness (suspicious lack of hesitation), Fatigue Absence (defying cognitive exhaustion), Markov Conformity (abnormal survival through high-dropoff steps), and Clone Similarity (swarm fingerprints across identical journey paths).
| user_id | is_success | funnel_level | session_minute |
|---|---|---|---|
| usr_101 | 1 | 1 | 0.5 |
| usr_101 | 1 | 2 | 1.8 |
| usr_101 | 1 | 3 | 3.2 |
| usr_101 | 0 | 4 | 5.9 |
| bot_010 | 1 | 1 | 2.0 |
| bot_010 | 1 | 2 | 4.0 |
Example of FraudSignal Analysis Result
| User ID | Events | σ Prob | Entropy | Speed Z | Flatness | Clone | Verdict | Prescribed Action |
|---|---|---|---|---|---|---|---|---|
| bot_010 | 6 | 0.936 | 1.371 | -0.858 | 0.992 | 0.999 | SYNTHETIC | BLOCK / QUARANTINE |
| bot_014 | 6 | 0.918 | 1.371 | -0.845 | 0.992 | 0.999 | SYNTHETIC | BLOCK / QUARANTINE |
| suspect_008 | 5 | 0.857 | 1.500 | -0.384 | 0.860 | 0.985 | SYNTHETIC | BLOCK / QUARANTINE |
| suspect_003 | 5 | 0.818 | 1.500 | -0.499 | 0.854 | 0.986 | SUSPICIOUS | FLAG / REVIEW |
| human_001 | 7 | 0.184 | 2.241 | +0.412 | 0.120 | 0.640 | HUMAN | ALLOW / TRUST |
SYNTHETIC (σ > 0.85)
Action: BLOCK / QUARANTINE. Clock-like timing, superhuman velocity, and identical journey cloning. Pure automated risk.
SUSPICIOUS (0.60 – 0.85)
Action: FLAG / REVIEW. Abnormal consistency or elevated clone correlation. Route to CAPTCHA or 2FA verification.
UNCERTAIN (0.30 – 0.60)
Action: MONITOR / LOG. Short session depth (<5 events) or mixed entropy signals. Keep passive event telemetry active.
HUMAN (σ < 0.30)
Action: ALLOW / TRUST. Natural human cognitive friction, hesitation gaps, and standard step-to-step drop-off curves.
Drop a CSV here โ or click to select
Scan complete.
Timing Entropy
Shannon entropy of inter-step time gaps. Real users have varied timing. Bots tick like clocks.
Speed Z-Score
Session speed vs. population median. Extremely fast users are likely scripted.
Momentum Flatness
How constant is behavioral momentum across steps? Humans fluctuate. Bots stay flat.
Fatigue Absence
Deviation from the expected cognitive fatigue curve. No fatigue = not human.
Markov Conformity
Does the user survive every step? A user who never drops off defies the population's Markov chain.
Clone Score
Cosine similarity to nearest neighbors. Bot farms produce users with identical behavioral fingerprints.
| User | Events | ฯ Prob | Entropy | Speed Z | Flatness | Fatigue | Markov | Clone | Verdict | Action |
|---|