Abstract: A bot detection service associated with an overlay network and configured as a centralized control plane, and a data plane that operates in an overlay network entity, e.g., an edge server. The control plane performs analytics continuously to generate a machine learning (ML) model, a set of device anomaly (DAN) patterns, and false positive (FP) tuning data. During a request processing workflow at the edge server, a request is received. A subset of detector rules triggered by the request are identified, optionally using the DAN patterns. The ML model is then applied to the subset to classify the request as a bot or human. When the request is classified as a bot, the FP tuning data is applied to determine whether to selectively override the classification as being a false positive. When the request is classified as a bot and not overridden, an action is taken, e.g., denying the request.

Abstract: A bot detection service associated with an overlay network and configured as a centralized control plane, and a data plane that operates in an overlay network entity, e.g., an edge server. The control plane performs analytics continuously to generate a machine learning (ML) model, a set of device anomaly (DAN) patterns, and false positive (FP) tuning data. During a request processing workflow at the edge server, a request is received. A subset of detector rules triggered by the request are identified, optionally using the DAN patterns. The ML model is then applied to the subset to classify the request as a bot or human. When the request is classified as a bot, the FP tuning data is applied to determine whether to selectively override the classification as being a false positive. When the request is classified as a bot and not overridden, an action is taken, e.g., denying the request.