Detect a bot in a audit log
It sounds like you have good initial data but you might need to develop a meta data set. I would start by taking all this info and building behavior profiles. How often do they query per session? When do they query? How many sessions per hour/day/week/month? And so on, I think you get the idea. It just doesn't strike me like the raw file is the way to go, you need a little bit more to work with but you can get there with what you have now. Get down to various behaviors, one ID per row, and you'll be in a much better position to model this out.