# Bot Detection > Understanding how modern bot detection combines network, protocol, browser, and behavioural intelligence to identify automated and fraudulent traffic. --- ## Overview Bot detection is the process of identifying automated traffic and determining whether interactions should be trusted. Modern bots are no longer limited to simple scripts sending automated requests. Today's automation can execute JavaScript, operate real browsers, use proxy networks, manipulate fingerprints, and imitate human browsing behaviour. Because of this evolution, reliable bot detection cannot depend on a single signal. A visitor may appear legitimate when viewed from one perspective but reveal automation or fraud when analysed across multiple layers. The foundation of effective detection is **correlating evidence across different parts of the interaction**. --- # Why Traditional Bot Detection Fails Simple bot detection approaches often rely on individual signals: * IP address * user-agent string * request frequency * browser fingerprint * known automation signatures These approaches are useful, but each has limitations. Attackers can: * rotate IP addresses * modify browser properties * imitate popular user agents * slow down automated actions * use real browsers * distribute activity across many sources A reliable system must understand the complete context of an interaction. --- # The Four Layers of Detection Button Solutions approaches bot detection through four complementary layers: ```text Bot Detection │ ├── Layer 1: Network Intelligence │ ├── Layer 2: Protocol Intelligence │ ├── Layer 3: Browser Intelligence │ └── Layer 4: Behavioural Intelligence ``` Each layer provides additional evidence. No single layer should be treated as a complete decision-maker. Strong classifications come from combining signals across all four. --- # Layer 1: Network Intelligence Network intelligence analyses where traffic originates and whether the underlying infrastructure can be trusted. Signals may include: * IP reputation * ASN information * hosting providers * proxy indicators * suspicious infrastructure patterns * geographic anomalies Network intelligence is especially valuable for identifying: * request bots * automated infrastructure * untrusted traffic sources However, network signals alone are not enough. A legitimate user may share infrastructure with other users, and attackers can rotate through different IP addresses. An IP address is evidence, not identity. --- # Layer 2: Protocol Intelligence Protocol intelligence examines how a client communicates with the website. Signals may include: * HTTP characteristics * TLS fingerprints * connection behaviour * request consistency * protocol-level anomalies Different clients produce different communication patterns. A browser, an automation framework, and a scripted request client may all reach the same endpoint but behave differently at the protocol level. Protocol intelligence helps identify traffic that does not match expected browser behaviour. --- # Layer 3: Browser Intelligence Browser intelligence analyses the client execution environment. Signals may include: * JavaScript execution * browser capabilities * fingerprint consistency * rendering characteristics * environment properties * automation indicators Browser intelligence is particularly important for identifying: * basic automation * advanced bots * browser-based fraud --- ## JavaScript Execution and Replay Resistance Client-side JavaScript provides valuable insight into the real execution environment. However, browser-side detection faces an important challenge: Attackers may attempt to: * inspect client logic * extract generated responses * automate expected behaviour * replay previously captured results Static client-side challenges become less effective when attackers can fully understand and reproduce their behaviour. To increase resistance against replay-based attacks, Ad Protect uses an obfuscated JavaScript layer built around a custom dynamically compiled virtual machine (VM). This approach makes client-side execution logic more difficult to: * analyse * reproduce * automate * replay The goal is to preserve the value of browser-side signals while increasing the effort required for attackers to build reliable automation. Browser intelligence remains one layer within the broader detection system. The strongest decisions come from combining browser evidence with network, protocol, and behavioural signals. --- # Layer 4: Behavioural Intelligence Behavioural intelligence focuses on identifying suspicious patterns that emerge from interactions over time. Unlike automated bots, some fraudulent activity may come from real browsers and real devices. Examples include: * manual click fraud * coordinated clicking activity * clustered clicks * repeated interaction patterns Behavioural analysis helps identify patterns that may not be visible through technical fingerprinting alone. --- ## Clustered Click Detection Fraudulent activity may appear as groups of interactions that share unusual characteristics. Examples: * concentrated clicks within short time periods * repeated interaction patterns * coordinated behaviour across sources * abnormal distribution of activity The objective is not simply counting clicks, but understanding whether activity patterns represent genuine user interest. --- ## Manual Click Fraud Analysis Manual click fraud presents a unique challenge because the traffic may come from: * real browsers * real devices * residential networks Traditional bot detection signals may be weaker in these cases. Behavioural intelligence focuses on detecting patterns that indicate coordinated or unnatural activity. Manual click fraud analysis continues to evolve as attackers adapt their techniques. --- ## Session Consistency and IP Rotation Invalidation Behavioural analysis also considers whether activity remains consistent over time. Examples include: * session consistency * identity continuity * changes in network origin * suspicious IP rotation patterns Rapid changes in network identity can be a signal that a single activity stream is being distributed across multiple sources. --- # Detection by Traffic Type Different types of invalid traffic expose different signals. | Traffic Type | Primary Detection Layers | | ------------------------- | ------------------------------------------------ | | Request Bots | Network + Protocol | | Basic Automation | Protocol + Browser | | Advanced Bots | Network + Protocol + Browser + Behavioural | | Untrusted Traffic Sources | Network intelligence with supporting evidence | | Manual Click Fraud | Behavioural intelligence with supporting signals | --- # Why Correlation Matters Sophisticated attackers optimize for individual detection layers. Examples: * A bot may use a clean IP address. * A browser may have a realistic fingerprint. * A request may look normal at the protocol level. * A user may appear human. The inconsistency appears when these signals are evaluated together. Examples: * A browser fingerprint may not match protocol behaviour. * Network origin may conflict with observed activity. * Clicking patterns may reveal coordination. * Session identity may become inconsistent after IP rotation. Correlation turns individual observations into a stronger classification. --- # Bot Detection and Invalid Traffic Bot detection is a major component of invalid traffic analysis. However, the concepts are different: **Bot detection asks:** > How was this interaction generated? **Traffic classification asks:** > Should this interaction be trusted for this purpose? A legitimate crawler may be automated but acceptable. A human-operated click farm may not be automated but may still represent invalid activity. Context matters. --- # Key Takeaways * Modern bot detection requires multiple layers of evidence. * Network, protocol, browser, and behavioural intelligence complement each other. * Advanced bots attempt to imitate legitimate users across multiple layers. * JavaScript-based detection requires protection against replay and extraction attempts. * A custom dynamically compiled VM increases the difficulty of reproducing client-side behaviour. * Behavioural intelligence helps identify clustered activity and manual fraud patterns. * The strongest classifications come from correlation, not individual signals. --- # Related Documentation * `ad-fraud.md` * `click-fraud.md` * `invalid-traffic.md` * `browser-fingerprinting.md` * `canvas-fingerprinting.md` * `replay-attacks.md` * `traffic-classification.md` * `trust-and-false-positives.md` * `automation-analytics.md`