Try fingerprinting the behaviour in the sessions. Over time you should be able to distinguish between various automated tools and live people.