Session Replay Bots: When the Bot Plays Back a Real Customer's Session

The mouse movement that is real, and still a bot

For years, telling a bot from a person came down to how the cursor moved. A human moving a mouse never travels in a straight line. The cursor accelerates, overshoots the target, corrects back, pauses while the eye catches up, and drifts with tiny tremors no person notices. A naive bot teleports the cursor to exact coordinates or slides it along a perfect line at constant speed. The gap between those two motion profiles was one of the richest behavioral signals available, because it came from the physics of human motion: Fitts's law says the time to reach a target depends on its distance and size, producing a characteristic accelerate-then-decelerate velocity curve that simple automation does not reproduce.

Session replay bots close that gap by not faking anything. They record a real session, a real person's mouse paths, clicks, scrolls, and pauses, and then inject that recording into an automated session. The movement is genuinely human, because it was human when it was recorded. It just is not happening now. A check that looks at one session in isolation sees a plausible human and waves it through, which is exactly why replay bots are described in the research as the latest and most sophisticated generation of web bots, and also the most difficult to defend against.

What gives a replay away

The weakness of a replay is the same as its strength: it is a recording, and recordings repeat. A bot that sets element.click() produces no motion at all, and a bot that animates the cursor linearly produces motion with none of the properties of human movement. Both are easy to flag. A replayed path is realistic but repeated identically, or changed only trivially, and that repetition is detectable only by comparing sessions with each other. The ReMouse dataset, a real-world mouse dynamics dataset published in the Journal of Cybersecurity and Privacy in 2023, was built for exactly this problem. Its analysis showed that two different human users cannot generate the same or similar-looking sessions when performing the same task, and even repeat sessions generated by the same human user are sufficiently distinguishable from one another. If two sessions look identical, at least one of them is a recording.

That finding sets the defense. Single-session analysis catches the naive bots and loses to replay. Cross-session correlation catches the replay, because the same path showing up twice, or fifty times, from different accounts is not a coincidence. It is a tape. Generative motion is the next step past replay: models trained on human data can synthesize plausible curves that defeat single-session checks too, and those need correlation with device and network signals, not just movement. And mouse analysis has a hard limit that no tuning fixes: touchscreens have no mouse, so on mobile the analysis does not apply at all, and the fallback is touch-gesture and scroll dynamics instead.

Where this sits in a real defense

Mouse movement analysis belongs in a layered system, not standing alone. On its own it is defeatable by replay and generative motion, and it is inapplicable on touch. In a stack it earns its place: velocity curves and micro-corrections catch the bulk of automation, which is Selenium, Puppeteer, and Playwright scripts that interact with the page but never bother to simulate realistic motion. Cross-session correlation catches the replays. Device fingerprint stability, IP reputation, and conversion plausibility catch the rest. The mistake is treating any one signal as a verdict. A human on a remote desktop session or using assistive technology can produce movement that looks odd, so production systems tune thresholds and use behavioral context rather than blocking on a single score. The signal that matters is not whether one session looks human. It is whether fifty sessions look like the same human, because no real person moves the same way twice. If the older signals are the gap in your defense, how sites actually spot a headless browser covers the checks that catch automation before it reaches the mouse, and why IP reputation stopped working explains why the network address is no longer the first thing to trust.