A method and system of detecting the activity of “bots” in an online community, by measuring the time elapsed between user actions and comparing this time to a timespan established as normal for users performing the same user actions without the assistance of bots. The timespan may be adjusted when other suspicion characteristics are detected. When detecting actions suspected to be bot-assisted, the method and system respond by executing one or more response instructions against the user suspected of using the bot, with the aim of preventing further bot activity. The response instructions are stored by associating them with a type of user action and a total number of suspect user actions. As a result, the response instructions may be set to increase in severity with each additional suspect act by a user.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method of detecting and responding to unwanted user actions in a community, the method comprising: (a) detecting a plurality of user actions performed by a user, the plurality of user actions comprising a first user action and a last user action; (b) determining a timespan T; (c) comparing the timespan T to the time elapsed between the first user action and the last user action; and (d) if the time elapsed is less than the timespan T, responding to the action, wherein each user action can be categorized by type, wherein each type of user action is associated with a timespan Tx in a database, wherein the determining of the timespan T comprises: determining the type of the last user action, and determining the timespan Tx associated with the type of the last user action, and wherein the responding to the action comprises recording information of the last user action to a violation log associated with the user. 2. The method of claim 1, wherein a timespan Tx associated with at least one type of user action is set by: (1) performing a user action of the type of user action, (2) measuring and recording the time interval between a starting time and a completion time of the performing of the user action, (3) repeating (1) and (2) at least once, such that a plurality of time intervals for user actions of the type of user action are recorded, and (4) calculating the timespan TX such that at least 80% of the plurality of time intervals are greater than TX. 3. The method of claim 2, wherein the calculating of the timespan TX comprises: calculating a normal distribution of the plurality of time intervals, and setting TX to 2.5 standard deviations below the mean on the normal distribution of the plurality of time intervals. 4. The method of claim 2, wherein the calculating of the timespan TX comprises: calculating a normal distribution of the plurality of time intervals, and setting TX to 3.0 standard deviations below the mean on the normal distribution of the plurality of time intervals. 5. The method of claim 1, wherein the plurality of user actions consists of the first user action and the last user action. 6. The method of claim 1, wherein the plurality of user actions further comprises one or more intermediary user actions, and wherein the determining of the timespan T further comprises: for each of the one or more intermediary user actions, determining a type of the intermediary user action, for each of the one or more intermediary user actions, determining a timespan TX associated with the type of the intermediary user action, and generating a sum of all timespans TX determined from the last user action and the one or more intermediary user actions. 7. The method of claim 1, wherein all of the plurality of user actions have the same type. 8. The method of claim 1, wherein the determining of the timespan T further comprises: detecting a characteristic of the user, the characteristic comprising an IP address, location, browser, or suspicion flag; and if the characteristic of the user is designated as a suspicious characteristic, increasing the timespan T. 9. The method of claim 1, wherein the determining of the timespan T further comprises: detecting a characteristic of the user, the characteristic comprising an IP address, location, browser, or suspicion flag; and if the characteristic of the user is not recognized, increasing the timespan T. 10. The method of claim 1, wherein a rule set comprises a plurality of rules, each rule comprising a number value and one or more response instructions, and wherein the responding to the action further comprises: determining a number of user actions for which information has been recorded in the violation log associated with the user. matching the number of recorded user actions to the number value for a rule in the rule set, and executing the one or more response instructions of the matched rule. 11. The method of claim 1, wherein a rule set comprises a plurality of rules, each rule comprising a number value, a type value, and one or more response instructions, and wherein the responding to the action further comprises: determining a number of user actions of the type of the last user action for which information has been recorded in the violation log associated with the user. matching both the number of recorded user actions and the type of the last user action to the number value and type value, respectively, for a rule in the rule set, and executing the one or more response instructions of the matched rule. 12. The method of claim 11, wherein at least one response instruction comprises blocking the last user action. 13. The method of claim 11, wherein at least one response instruction comprises blocking all user actions of the type of the last user action performed by the user for a set time period. 14. The method of claim 11, wherein at least one response instruction comprises blocking all user actions performed by the user for a set time period. 15. The method of claim 14, wherein the set time period is infinite. 16. The method of claim 11, wherein at least one response instruction comprises setting a suspicion flag for the user to true for a set time period. 17. The method of claim 16, wherein the set time period is infinite. 18. A system of detecting unwanted user actions in a community, the system comprising: a computer readable memory; a transceiver in communication with the memory and further in communication with a network; and a processor in communication with the memory and configured to execute the method of claim 1. 19. A non-transitory computer readable medium encoded with processing instructions for implementing the method of claim 1 using one or more processors.