Machine Learning

Reading time: About 8 minutes

Feature Overview

Machine Learning Detection is one of the core capabilities in Bot Management used to identify complex automated threats. It relies on network-wide traffic data analysis, model training, and behavior pattern recognition to uncover automated access behavior that rules and static signatures cannot directly cover.

Compared with Heuristic Detection, Machine Learning Detection is better suited to identifying the following types of threats:

• Bots with strong disguise capabilities
• Automated requests that use dynamic proxies and frequently rotate identities
• Coordinated group activity with complex behavior patterns and no obvious characteristics
• Attack methods that continuously change or evolve

The results of Machine Learning Detection serve as a key input into the Bot Score, working together with Heuristic Detection results to assess request risk — improving the ability to identify complex Bots and overall detection coverage.

How It Works

To balance the analytical power of complex models with the stability of live business traffic, Machine Learning Detection uses an architecture that combines asynchronous analysis with edge execution.

Asynchronous Intelligent Analysis (Offline Computation Layer)

• Role: Serves as the system’s analytical center, responsible for offline computation tasks such as model training, feature engineering, cluster analysis, and anomaly detection.
• Input: Aggregates massive volumes of desensitized, anonymized request log data collected from edge nodes worldwide.
• Processing: Uses unsupervised learning and group clustering analysis to identify unknown threats, abnormal group behavior, and potential automated attack networks.
• Output: Periodically generates and updates lightweight risk rules, which are then distributed to edge nodes worldwide. This decouples complex computation from online request processing, helping ensure real-time detection efficiency and business stability.

Real-Time Edge Decision-Making (Dynamic Execution Layer)

• Role: Serves as the online execution layer deployed at edge nodes, combining risk rules distributed from the central analysis layer to complete real-time risk assessment as requests arrive.
• Input: Access request data from websites with detection enabled.
• Processing: When a request reaches an edge node, the system extracts request characteristics in real time and quickly matches and computes them against the risk rules distributed from the central layer.
• Output: Produces a risk assessment result, which is combined with the Heuristic Detection result to generate the two core risk indicators: the Bot Score and Bot Tag.

Use Cases

Machine Learning Detection is well suited to the following scenarios:

• Identifying highly disguised Bots: Detects automated access that bypasses traditional rule-based detection by mimicking real browser behavior.
• Detecting coordinated group attacks: Identifies automated attacks where individual requests show no obvious characteristics, but clear correlation exists across group behavior.
• Detecting continuously evolving attack methods: Uncovers new types of Bots and attack variants that rules and static signatures cannot cover in a timely manner.
• Filling gaps left by Heuristic Detection: Provides additional identification for complex access behavior that known rules cannot directly determine.

How It Works with Heuristic Detection

Machine Learning Detection and Heuristic Detection are the two core technologies behind the Bot Score, and each plays a distinct role:

Heuristic Detection is better suited to identifying:

• Known tools
• Known anomalies
• High-confidence risk characteristics
• Automated behavior that can be quickly matched using rules

Its strengths are strong real-time performance and highly explainable results, making it well suited to quickly identifying known risks.

Machine Learning Detection is better suited to identifying:

• Automated behavior without obvious characteristics
• Bots with complex behavior patterns
• Attack methods that continuously change or evolve
• Anomalous access patterns that are difficult to cover directly with rules

Its strengths are that it is better suited to uncovering unknown threats and complex behavior patterns, filling the coverage gaps left by Heuristic Detection.

Combined Assessment
The system combines heuristic tags, behavioral characteristics, and machine learning analysis results to jointly assess each request and generate a final Bot Score. Based on the Bot Score and related detection results, you can further configure protective actions such as Log, Challenge, or Deny.

Key Capabilities

• Well suited to identifying complex threats: Detects disguised, coordinated, and continuously evolving automated attacks that rules cannot directly cover.
• Supports dynamic updates: Continuously improves its detection capability through ongoing training and traffic analysis.
• Fills detection gaps: Can be used together with Heuristic Detection to improve overall detection coverage.
• Supports policy integration: Analysis results feed into the Bot Score and can be used in policy configuration and risk handling.