On account of the duration of the visits, there's not much advise. But for the number of visits, please.
When first entering the website, I put it to supercook, a month or a year.
1) Read the supercook or generated by it if such was not
2) all logs probressive this supercook.
3) While processing the log looking for object with this supercookie and fill it up with information who, when, and under what name. what browser or client, etc., Associated with the user supercoco.
In other words, we have and supercook and the user, and it does not matter, he went in, came out, went somewhere, etc.
PS. On the schem residence time on the website, make an ajax timer that works off of 5, 10, 30 sec and 1, 3, 5 minutes, knocking on the endpoint, and supercook will be included with the request. In this way, even bots you can catch that work without JS (which JS also caught),