Time Between

TemporalBot Detection

Measures the time gap between consecutive matching events for the same user or device. Every time the target event fires, it records how many seconds elapsed since the last time it fired.

Returns{ time_between_seconds, count, last_timestamp }

When to Use

• Bot detection: humans have natural pauses between actions; bots fire events in milliseconds
• Session analysis: how often does this user return to the app?
• Detecting artificially paced activity (e.g., a script firing exactly one event per second)
• Identifying abnormally fast interactions (e.g., completing a song in 0.2 seconds)

Configuration

{
  "name": "time_between_logins_15m",
  "group_by": "event_properties.email",
  "operation": "time_between",
  "window_duration_seconds": 900,
  "filters": { "field": "event_name", "operator": "equals", "value": "Login" }
}

Response

{
  "behaviors": {
    "time_between_logins_15m": {
      "count": 3,
      "time_between_seconds": 2,
      "last_timestamp": "2025-06-12T21:49:01.872Z",
      "timestamp": "2025-06-12T21:48:56.473Z",
      "remaining_window_seconds": 894
    }
  }
}

Bot detection threshold

A time_between_seconds of 2 means this user triggered 3 login attempts with only 2 seconds between them — far faster than a human typing credentials. Compare this with typical human login timing (15–60 seconds between attempts) to calibrate your detection threshold.

---

Use Case: Detecting Inhuman Play Speed

A bot farming streams might trigger PauseSong events (song completions) at a rate no human could achieve. Measuring the time between consecutive PauseSong events reveals whether the "listener" is completing songs at physically impossible speeds.

{
  "name": "time_between_song_plays",
  "group_by": "identity",
  "operation": "time_between",
  "window_duration_seconds": 3600,
  "filters": {
    "field": "event_name",
    "operator": "equals",
    "value": "PauseSong"
  }
}

Reading the output

If time_between_seconds is 0.3 for PauseSong events, the account is completing songs in under a second — a clear bot signal. Pair this with count (high play volume) and ratio (high skip rate) for a comprehensive abuse profile.