Abstract: Disclosed embodiments relate to systems and methods for classifying network session activities. Techniques include identifying a session established using a native client between a network identity and a network resource; monitoring messages conveyed during the session to identify a first data element associated with the session; analyzing the first data element to identify a characteristic of the native client; monitoring messages conveyed during the session to identify a second data element associated with an action requested by the network identity; and analyzing the action and the characteristic of the native client to determine whether the action is a human-initiated action.