Abstract: A method includes obtaining first data identifying first user interactions with one or more computing or networking resources during at least one first user session that is known to be valid. The method also includes generating one or more profiles defining typical user interactions with the one or more resources based on the first data. The method further includes obtaining second data identifying second user interactions with at least one of the one or more resources during a subsequent second user session. The method also includes determining whether the second user session is valid based on the second data and at least one of the one or more profiles by comparing the second user interactions to the typical user interactions defined in the at least one profile. In addition, the method includes taking one or more actions in response to determining that the second user session is not valid.